Keys to the Kingdom: Anonymous SQL Injection in Drupal Core ↗
Unauthenticated SQL injection reachable in Drupal core.
Patrik Grobshäuser
Security researcher at Assetnote. Hunting bugs since 2012, previously in triage at HackerOne and Shopify. Published as Patrik Fehrenbach until 2025.
Selected research
New Age of Collisions: Pre-Auth Arbitrary File Read as root in cPanel ↗
Reading arbitrary files pre-authentication, as root, on cPanel.
Jolokia endpoints: JNDI RCE and heap dumps
A reproducible lab for Jolokia XSS, JNDI remote code execution, and recovering credentials from Java heap dumps.
Writing
Projects
h1-brain
An MCP server that turns your HackerOne report history and public disclosures into a starting point for your next bug bounty hunt.
RD Intelligence
A platform that brings together vulnerability disclosures, exploit activity, and threat context to help teams decide what to investigate first.
threatover
My security consulting practice, covering penetration testing, security advisory, bug bounty programmes, and vulnerability triage.