All Posts
-
ModHeader: Covert Data Exfiltration to api.stanfordstudies.com
ModHeader is a popular Chrome extension with over 1.6 million combined installs (900K Chrome + 700K Edge). This week, Reddit and HN lit up after people noticed it phones home to api.stanfordstudies.com/app/log. I pulled the latest version (v7.0.17) and did a full reverse engineering of the exfiltration pipeline. The results...
-
How I Found 3,800+ Leaked Secrets on GitHub Archive Using AI
I found verified, live credentials leaking from Microsoft, Google, Red Hat, Grafana, and LlamaIndex in public GitHub repositories. Not stale junk; tokens that, at the moment of discovery, still authenticated against their issuing API. Microsoft Research’s microsoft/maro repo shipped a working Weights & Biases token from a @microsoft.com account. A...
-
NPM Supply Chain Attack: Fake Job Offer Drops Info-Stealer
I received an email on June 22, 2026, from “Adam Q” offering me $7,500 to finish an NFT staking frontend project called Foxtopia. The email included a Google Drive link to the source code. The source code looked clean. The package.json had one extra entry in devDependencies that was not...
-
Odysseus: Broken Access Control + SSRF in AI Embedding Endpoint
The repo had no private vulnerability reporting channel, so I filed it as a public issue: pewdiepie-archdaemon/odysseus#132. This writeup is the long form.
-
NLTK Command Injection via eval() in collocations.py
I reported this to huntr on November 14th, 2025. No CVE has been assigned. The vulnerability is real (you can get arbitrary code execution), but exploitation requires running the script locally, which puts it in a gray area for most bug bounty scopes. I’m writing it up anyway because the...
-
CVE-2026-5728: Content-Type spoofing on LollMS chat image upload
$ curl -F 'files=@malware.py;type=image/png' \ -H 'Authorization: Bearer <token>' \ http://localhost:9642/api/upload/chat_image # 200 OK; response still carries malware.py in filename / server_path
-
CRLF Injection in CPython's http.server and wsgiref
I found a CRLF injection vulnerability in CPython’s standard library — specifically in http.server and wsgiref. When an application reflects user-controlled input into HTTP headers via send_header(), an attacker can inject arbitrary new headers. The CPython team updated the documentation with security warnings across pull requests #142605, #143395, #148020, and...
-
CVE-2026-0562: IDOR in LollMS friend request response
I reported this on December 29th, 2025, and it was assigned CVE-2026-0562 with a CVSS score of 8.3 (HIGH). The vulnerability is a classic IDOR: any authenticated user can accept or reject another user’s friend request just by guessing a sequential integer.
-
Finding Security Fixes Without CVE: Changelog & Commit Pipeline
Many real security fixes never get a CVE. Maintainers patch a vulnerability, mention it in release notes or commit messages, and move on. If you care about supply-chain risk or tracking silent fixes, those changelogs and commits are a useful but underused signal. In this post I’ll walk through a...
-
IP Classification Inconsistencies Across Programming Languages
As a security researcher, I’ve been analyzing IP address classification behaviors across various programming languages. Recently, I noticed some intriguing inconsistencies, particularly concerning how loopback and private IP addresses are treated. In this post, I’ll share my observations and insights on this matter.
-
SSRF DNS Rebinding: Bypassing Protection with CVE-2025-69660
While conducting security research, I discovered an SSRF (Server-Side Request Forgery) vulnerability in an application’s proxy and file parsing APIs. This vulnerability could be bypassed using a DNS rebinding attack. I reported it to the simstudioai/sim project; the development team fixed it quickly, and it was assigned CVE-2025-69660. In this...
-
PyPI, npm, RubyGems Secret Scanning: Microsoft & More Leaks
In the ever-shifting realm of cybersecurity, staying one step ahead of potential threats is a non-negotiable mission. Package repositories like PyPI, npm, NuGet, and RubyGems are goldmines of software packages, cherished by developers worldwide. While these packages are indispensable for crafting powerful applications, they may also harbor concealed secrets, making...
-
Game Hacking 101 Part 2: Minesweeper Reverse Engineering
In the first part of the Game Hacking 101 series, we learned memory manipulation techniques in Mount and Blade Warband. In this second part, we’ll explore more advanced techniques by reverse engineering Minesweeper. We’ll use Cheat Engine for pointer scanning, x64dbg for hardware breakpoints, and memory analysis to decode the...
-
Crypto Scam Detection: Coin Mixing Analysis with Wallet-Tracker
Online scams are becoming increasingly common in today’s digital world. From phishing attempts to fake cryptocurrency exchanges, it can be hard to know who to trust. One tool that can help protect yourself from cryptocurrency scammers is Wallet-Tracker. This tool uses the Wallet-Tracker CLI, Neo4j database, and a user-provided scammer...
-
Writing Redis in x86-64 Assembly: A Vibe-Coding Response
Everyone’s writing code these days. AI assistants generate functions, classes, entire applications. But here’s the thing: nobody’s reading it. We’re in this weird era where developers can produce thousands of lines without understanding what any of it does. I call it vibe-coding: you vibe with the AI, it writes code,...
-
Bokeh CVE-2026-21883: Cross-Site WebSocket Hijacking Explained
During a security review of Bokeh, I found a vulnerability in the WebSocket origin validation logic that allows Cross-Site WebSocket Hijacking (CSWSH). The match_host function in Bokeh’s server code uses flawed hostname matching that can be bypassed by registering malicious subdomains.
-
CVE-2026-22787: XSS Vulnerability in html2pdf.js Library
A Cross-Site Scripting (XSS) vulnerability has been identified in the html2pdf.js library. The vulnerability exists due to unsanitized user input being directly assigned to the innerHTML property. This allows attackers to execute arbitrary JavaScript code in the context of the application, potentially leading to session hijacking, data theft, and unauthorized...
-
Game Hacking 101: Memory Manipulation with Cheat Engine
Game hacking opens a window into how games store and manage data in memory. By understanding memory manipulation, you can modify in-game values, experiment with game mechanics, and gain deeper insights into how software works at a low level. In this guide, we’ll explore memory manipulation techniques using Mount and...
-
SQL Injection in GeoPandas to_postgis(): CVE Analysis and Fix
While using the GeoPandas library one day, I noticed something was wrong with the to_postgis() function. User inputs were being directly concatenated into SQL queries. This was a classic SQL injection vulnerability. After finding the vulnerability, I also wrote the fix myself and opened a pull request. In this post,...
-
CVE-2025-66019: LZW DoS Vulnerability in pypdf Library
PDF files use various algorithms to compress their content. This compression reduces file size but also carries some security risks. While conducting security research, I discovered a DoS (Denial of Service) vulnerability in the pypdf library’s LZW (Lempel-Ziv-Welch) decompression implementation. In this post, I’ll first explain how the LZW algorithm...
-
PassDetective: Find Passwords and Secrets in Shell History
Your shell command history might contain accidentally written passwords, API keys, or secrets. This information is stored in your history files and poses a security risk. PassDetective is a command-line tool that scans your shell history to detect such sensitive information. Available on both Kali Linux and NixOS, this tool...
-
AI CAPTCHA Bypass: Solving reCAPTCHA with GPT-4o and Gemini
While conducting security research, I wanted to test how effective CAPTCHAs really are. I was curious about how well modern AI models could solve visual and text-based CAPTCHAs. That’s why I developed a tool that uses large multimodal models (LMMs) like OpenAI’s GPT-4o and Google’s Gemini to automatically solve various...
-
exifLooter: Extracting Hidden Location Data from Images
While using exiftool in OSINT research, I developed exifLooter as an enhanced version that makes it easier to extract GPS coordinates and visualize them on OpenStreetMap. exifLooter is built on top of exiftool and provides a more practical solution, especially for extracting GPS coordinates and visualizing them on maps. Moreover,...
-
Hacking Instagram Scammers: OSINT Investigation Guide
Security research on Instagram phishing scams. Learn how scammers steal Instagram accounts through phishing websites and how to investigate them using OSINT techniques and XSS vulnerabilities.
-
Bypassing Door Passwords: Smart Lock Security Research
Instead of a key, this type of lock system requires a numerical code to grant entry to a facility or property. The code is punched in by users via a numerical pad, similar to those on a basic calculator. If the correct code is entered, the door lock or deadbolt...