Hi! I’m Patrik, Security Researcher at Assetnote, a Searchlight Cyber company. I find bugs in software that is deployed everywhere and then write up how I found them.
I’ve been doing this since 2012, and before Assetnote I was at Recorded Future, Shopify and HackerOne.
CargoWise WebTracker — The Keys Were in the Cargo↗
A logistics platform's own tracking interface handed out credentials. The keys really were sitting in the cargo.
Keys to the Kingdom: Anonymous SQL Injection in Drupal Core↗
SQL injection you can reach without an account, in Drupal core itself rather than some contributed module.
To Kara, Alex, and Michiel — Your Researchers Are Leaving↗
Bug bounty platforms never humanized researchers or triage. Now they’re drowning in AI slop and wondering why their best people are leaving.
New Age of Collisions: Pre-Auth Arbitrary File Read as root in cPanel↗
Read any file on a cPanel box, as root, before you authenticate at all.
Hyoketsu — Solving the Vendor Dependency Problem in RE↗
Reverse engineering stalls the moment the firmware only comes from the vendor. Hyoketsu is the way around that.
Running h1-brain Against a Real Target↗
A start-to-finish walkthrough of using h1-brain on an actual program. From hack() briefing to attack plan.
Teaching Claude Everything You've Hacked↗
h1-brain is an MCP server that gives Claude your HackerOne bounty history and a database of public disclosures. Setup and first sync.
What h1-brain Actually Does↗
Every tool in h1-brain, explained. Your reports, public disclosures, and the hack() briefing that ties them together.
Replaced by a Goldfish↗
Opus 4.6, the pentesting hype, and why most of the AI discourse around security is just noise.
A full lab build and exploitation walkthrough for exposed Jolokia JMX endpoints: reflected XSS (CVE-2018-1000129), JNDI remote code execution via a rogue LDAP server (CVE-2018-1000130), and dumping the Java heap to recover credentials.
An in-scope Shopify POS endpoint exposed the card reader’s firmware bundles, which unpack via binwalk, a dd carve at 0x202024 and jffs2dump into a JFFS2 root filesystem containing a salted MD5 root hash.
An XSS payload stored as a Google Cloud project name executed months later in the unfiltered project-deletion error message, earning a $5,000 VRP reward, plus the impact argument that got it past a self-XSS classification.