Leaking internal headers in Flask Ninja with deserialization
Jul 21, 2026There’s an unfixed gadget living in Flask Ninja. Its HttpBearer authenticator reads the credential from a header named by a plain, writable …
Research
Stealing OAuth tokens of connected Microsoft accounts via open redirect in Harvest App
Oct 21, 2023Reported an OAuth token leak via open redirect in Harvest.
Breaking The Mutant Language's "Encryption (Writeup)"
Aug 15, 2023AppSec Village DEF CON 31 CTF^2 (developer) winning entry. Bypassed the encryption and mutation techniques of the Mutant Language.
CraftCMS Zero-day Chain: XSS to SSTI triggering RCE
Jul 29, 2021Reported CVE-2021-27902 (XSS) and CVE-2021-27903 (SSTI) that can be chained together to gain Remote Code Execution in CraftCMS.
Internal IP Address leak in Misconfigured WordPress to bypass WAF
Dec 27, 2020Discovered a method to leak IP addresses in a misconfigured WordPress instance (useful when targets are behind a dns firewall like CloudFlare)