Infosec · field notes
Writeups, research & notes from the field.
What broke, why, and how I found it. Bug bounty and API recon writeups.
-
DeadBolt: how a "private plugin marketplace" turned into full RCE
Critical · CVSS 9.8Chain a reversible license key, a Zip Slip, and an auto-loading plugins folder into full RCE on the YesWeHack Dojo #51 challenge.
Read the writeup → -
bypassing a rate limiter with a single fake header
High · CVSS 7.5Rotate one X-Forwarded-For and the limit is gone.
Read the writeup → -
entity authorization bypass: the debug page that got left in prod
Critical · CVSS 9.3An unauthenticated debug page in a vet PMS prefilled itself with live entity IDs and a verification salt. Identity to entity-level access, no auth required.
Read the writeup →