Documented vulnerabilities discovered through ethical research and bug hunting.
Discovered a Server-Side Request Forgery that allowed internal IP probing, metadata endpoint access, and exposure of internal cloud infrastructure through manipulated request parameters.
↗ Read Full Write-UpIdentified a price manipulation vulnerability in an e-commerce application where the backend blindly trusted client-side request values, allowing attackers to modify product prices before checkout.
↗ Read Full Write-UpFound a Punycode-based vulnerability that can lead to a serious 0-click Account Takeover when applications blindly trust user-controlled input. No interaction from the victim required.
↗ Read Full Write-UpDiscovered that a learning platform failed to invalidate existing authenticated sessions after a password change. An attacker holding a stolen session token could maintain full account access even after the victim reset their credentials — and could even lock the legitimate user out by overwriting the password through the still-active session.
↗ Read Full Write-UpFound a healthcare platform login endpoint with no rate limiting, account lockout, CAPTCHA, or throttling of any kind. Over 100 consecutive failed login attempts were processed normally, leaving the endpoint fully exposed to brute-force and credential stuffing attacks.
↗ Read Full Write-UpWhile exploring a travel platform's staging subdomain, discovered a publicly accessible cloud storage bucket returning an unauthenticated XML listing of its contents. Object names, upload timestamps, file sizes, and stored assets were all enumerable without any credentials — exposing internal naming conventions and deployment structure.
↗ Read Full Write-UpDiscovered a publicly accessible Bitbucket pipeline configuration file on a travel platform with no authentication required. The file revealed deployment workflows, SSH-based deployment processes, internal directory layouts, and operational infrastructure details — providing an attacker with a detailed map of the backend environment without touching any exploit.
↗ Read Full Write-UpIdentified a GraphQL endpoint with no query complexity limits, depth restrictions, or execution throttling. By batching hundreds of identical aliased operations into a single HTTP request, the server could be forced to perform a disproportionate amount of work — a potential denial-of-service vector requiring zero special privileges.
↗ Read Full Write-UpUsing a single natural-language prompt against an AI chatbot embedded in a tax-filing platform, extracted the full system prompt including internal tool names, ticket escalation workflows, support routing logic, promotional instructions, and hidden behavioral rules — all without authentication bypass or technical exploits.
↗ Read Full Write-Up