Software Engineering @ McMaster · Bug Bounty Hunter since 2021 · Web & Mobile Security Researcher
Writeups on XSS, IDOR, auth bypasses, privilege escalation, and more.
The Screenshot Service That Would Render Anything
A rendering API prepended its own domain to my input, which felt safe. A protocol-relative URL undid that in one line and pointed a headless Chrome instance at anything I wanted, including the cloud metadata service. A common shape for SSRF in any screenshot or render service.
A Post Title That Took Over Your Account
A post title got reflected into a script tag, which gave me stored XSS. From there I pulled the victim’s session token from an API endpoint and reset their password without the old one. One click, full account takeover.
Unauthenticated DB Access and Account Takeover via a Leaked Staging Domain
A hostname referenced inside a production JavaScript bundle pointed at a staging environment where every /api/admin/* route was reachable without authentication, including one that returned a password reset link for any user ID.
Forcefully Joining Private Servers via Shared Invite ID Namespace
How I discovered that a staging environment shared its invite ID namespace with production, allowing an attacker to generate invite codes on staging and use them to forcefully join random private servers on production — including invite-only ones.
Hello World — Why I Started This Blog
Introducing my security research blog — what to expect and why I’m writing.