Research and exploit chains
Vulnerabilities that require understanding how systems are designed. Most are public articles; a couple of complex chains are reserved for subscribers.
- GraphQL: enumeration and mass extraction
- postMessage: origin validation bypasses
- RCE in sandboxes (Python, JS)
- Parser differential, prototype pollution
Client-side admin bypass — boolean manipulation + BAC in a modern SPA
Real Quora report: SPA with an isAdmin boolean in localStorage that controls the UI + a backend that doesn't validate server-side. How to chain a boolean flip with BAC for admin takeover.
All advanced-level articles
32 articles
Client-side admin bypass — boolean manipulation + BAC in a modern SPA
Real Quora report: SPA with an isAdmin boolean in localStorage that controls the UI + a backend that doesn't validate server-side. How to chain a boolean flip with BAC for admin takeover.
Cloudflare WAF — payload size bypass, oversized body, plan-specific limits
Bypassing the Cloudflare WAF by exploiting body size limits per plan (Free 100kb, Pro 100kb, Business 500kb, Enterprise 1mb): oversize payload trick + chunked transfer encoding.
Headless browsers — SSRF and RCE in endpoints that render URLs
Endpoints that accept URLs for screenshots/PDF (Puppeteer, Playwright, wkhtmltopdf) are an SSRF goldmine: cloud metadata, file://, gopher://, JS injection with XSS-to-RCE in the chromium sandbox.
HTTP request smuggling — H2→H1 desync, TE.CL, CL.TE and H2.CL in 2026
An updated catalog of HTTP smuggling: classic CL.TE, TE.CL, H2→H1 downgrade desyncs, HTTP/2 SETTINGS frame abuse, chunked extensions and HTTP/2 pseudo-headers.
LLM hacking — prompt injection, jailbreaks, indirect injection and data exfiltration
Vulnerabilities in systems with exposed LLMs: direct prompt injection, indirect injection via external sources (RAG poisoning), system prompt extraction, jailbreaks and data exfiltration.
Next.js attack surface 2026 — middleware bypass, internal SSRF, RSC abuse
Next.js 13-16 specific vulnerabilities: middleware bypass with manipulated headers, SSRF in API routes, RSC (React Server Components) data leak, image optimization SSRF.
Cloudflare WAF Bypass — oversized body, header stuffing and cache poisoning
Cloudflare's WAF has per-plan inspection limits (~8KB Free, 128KB Enterprise). Padding bypass, header stuffing >100 headers, IP origin disclosure.
DOM XSS — gadgets, postMessage handlers and CVE-2025-59840
DOM XSS isn't just innerHTML. Sources/sinks, gadget chains via toString(), postMessage handlers without origin checks, broken hash-based routing.
HTTP Request Smuggling — CL.TE, TE.CL, TE.TE and caching exploitation
When the frontend and the backend interpret the same request differently. Smuggling for auth bypass, cache poisoning, victim-aware attacks.
Mass PII Extraction via GraphQL — 93 real profiles in 1 hour
A contact-sync GraphQL endpoint with no rate limiting, no ownership verification and batching of 200 numbers per request. Phone → real identity resolution.
RCE in a Python sandbox — from the bot editor to the server shell
An AI platform's Python sandbox didn't block os.popen(). Two lines of Python to run system commands, read environment variables and fingerprint the runtime.
SSRF — complete bypasses: localhost, IPv6, decimal, DNS and cloud metadata
11 techniques to bypass SSRF validation: enclosed alphanumeric, decimal IP, dot bypass, DNS rebinding, parameter pollution. Cloud metadata AWS/GCP/Azure.
Zero-Click postMessage Origin Bypass — from the canvas to credit drain
The postMessage listener only validated a field of e.data — controlled by the attacker. e.origin was never checked. From an iframe loaded when opening a bot, messages injected as if the victim had written them.
ASP.NET — ViewState deserialization, machineKey leak, padding oracle
Classic and modern vulnerabilities in the ASP.NET stack: ViewState deserialization without signature validation, machineKey leak via web.config disclosure, padding oracle attacks against encrypted ViewState.
CloudFront cache deception — exfiltrate PII via other users' cached responses
How to abuse CloudFront cache rules with fake extensions (.css, .js, .png) to serve cached authenticated responses to other users. Real-world PII leakage.
CSP bypass + CORS misconfig + XSS — a complete exploitation chain
How to chain CSP misconfiguration (unsafe-inline, wildcard sources, whitelisted JSONP endpoints), CORS with credentials and XSS for unrestricted data exfiltration.
DOM clobbering — overriding global JS variables to bypass sanitizers
How to use DOM clobbering (name/id collisions) to overwrite global JS variables and bypass sanitizers like DOMPurify, achieving XSS where innerHTML is blocked by default.
DOM XSS — sources, sinks and gadgets to chain filter bypasses
A complete map of sources (location, postMessage, document.referrer, localStorage) and sinks (innerHTML, eval, document.write, jQuery $.html) + gadgets to build undetectable payloads.
DoS via WAF body size — exhausting the inspection budget on Cloudflare/Akamai
How to abuse the body inspection limit in WAFs (Cloudflare 100kb, Akamai 32kb) to drain the inspection budget and force a bypass — useful both for evasion and for controlled DoS.
OAuth open redirect — backslash bypass of redirect_uri (POE report walkthrough)
Walkthrough of the POE report: open redirect via `\` (backslash) in redirect_uri that POE's parser didn't normalize correctly. URL-based XSS chained for token theft.
PHP class pollution — the PHP equivalent of Prototype Pollution
How PHP class pollution (via recursive merge / object instantiation with user input) produces deserialization-like RCE in Laravel, Symfony, WordPress apps without needing gadget chains.
Android XSS — exported Activity via ContentActivity (POE/Quora real report)
Walkthrough of Android XSS exploitable via an exported Activity intent in POE: how a filter-less ContentActivity leaks the WebView to attacker-controlled sites.
Secondary context XSS — finding XSS where the primary parsing doesn't detect it
When the primary parsing escapes but a secondary context (markdown render, BBCode, a custom template engine) re-interprets, opening XSS hidden from traditional sanitizers.
SSRF — localhost bypasses, DNS rebinding, cloud metadata, gopher://
A complete catalog of SSRF bypasses in 2026: IP encodings (decimal, hex, octal, dword), DNS rebinding, IPv6 abuse, cloud metadata (AWS IMDSv2, GCP, Azure), gopher:// for chaining to Redis/Memcached RCE.
XS-Leaks — cross-site timing attacks, error-based leaks, frame-counting
XS-Leaks techniques 2026: timing attacks with performance.now(), error-based leaks via tag onerror/onload, frame-counting with CSP violations, ID-based leaks via element selector and storage timing.
XSS escalation — from Self-XSS to Account Takeover with real chains
How to turn a seemingly useless Self-XSS into a full takeover: clickjacking, login-CSRF + Self-XSS, cookie tossing, postMessage hijack, hash injection, OAuth flow abuse.
XSS WAF bypass — encoding, parser differentials, case-only mutations
WAF bypass techniques for XSS: HTML entities, hex/decimal/unicode encoding, parser differentials (browser vs WAF), comment injection, case variations, JS template literals.
CSP Bypass — JSONP, base-uri, AngularJS gadgets, dangling markup
Content-Security-Policy broken with strict-dynamic + JSONP, missing base-uri, AngularJS sandbox escapes, JSON hijacking. How to escalate XSS when the CSP theoretically blocks it.
Mutation XSS — when the HTML changes between sanitizing and rendering
The sanitizer sees A but the browser renders B. SVG namespace tricks, badly-closed comments, MathML, the template element. How to find mXSS against DOMPurify and homemade sanitizers.
Prototype Pollution — from malicious JSON to XSS, RCE and auth bypass
How an attacker pollutes Object.prototype and breaks the code's assumptions. Client-side and server-side vectors, gadgets in lodash/jQuery/Angular.
Reflected XSS on a 429 page via Google Analytics — the tracking snippet as vector
The Google Analytics snippet took part of the URL as unsanitized input. A string-literal breakout inside the script itself: the injection was already in JavaScript context.
SSTI — Server-Side Template Injection in Jinja2, Twig, Velocity and Freemarker
Detection with polyglots, engine identification, escalation to RCE in Jinja2/Python, Twig/PHP, Velocity/Java. Patterns where user input reaches templates.
Practice this vulnerability in an interactive lab.
- hunters training
- 711
- labs from real reports
- 55
- completions
- 1,205
- in bounties practiced
- $213,970
hunters training
labs from real reports
completions
in bounties practiced