CargoWise WebTracker — The Keys Were in the Cargo ↗
Credentials recoverable from a logistics platform's own tracking interface.
Archive
Old posts, 2013 to 2018. They stay up because people still link to them and I would rather not break someone’s citation.
Everything in here was true when I wrote it. The bugs are long fixed and half these vendors have rebuilt the products since. Some of what I wrote back then is advice I would not give today.
2026
Keys to the Kingdom: Anonymous SQL Injection in Drupal Core ↗
Unauthenticated SQL injection reachable in Drupal core.
To Kara, Alex, and Michiel — Your Researchers Are Leaving
Bug bounty platforms never humanized researchers or triage. Now they're drowning in AI slop and wondering why their best people are leaving.
New Age of Collisions: Pre-Auth Arbitrary File Read as root in cPanel ↗
Reading arbitrary files pre-authentication, as root, on cPanel.
Hyoketsu — Solving the Vendor Dependency Problem in RE ↗
Tooling for reverse engineering without waiting on vendor firmware.
Running h1-brain Against a Real Target
A start-to-finish walkthrough of using h1-brain on an actual program. From hack() briefing to attack plan.
Teaching Claude Everything You've Hacked
h1-brain is an MCP server that gives Claude your HackerOne bounty history and a database of public disclosures. Setup and first sync.
What h1-brain Actually Does
Every tool in h1-brain, explained. Your reports, public disclosures, and the hack() briefing that ties them together.
Replaced by a Goldfish
Opus 4.6, the pentesting hype, and why most of the AI discourse around security is just noise.
Daily Workflows with the Email Agent
Real usage patterns for an AI email agent — morning triage, thread summaries, draft replies, and where the human stays in the loop.
Gmail API Credentials the Paranoid Way
Setting up Google Cloud OAuth credentials with minimal scopes for an AI email agent — because 'full access' is never the right default.
Guardrails That Actually Work
A four-layer defense model for AI email agents — because no single safety measure is enough when your inbox is on the line.
Wiring Gmail into OpenClaw
Installing the Gmail MCP server, configuring agent tools, and filtering down to only the operations you actually want.
Writing a SOUL.md for Email
Defining hard rules, tone guidelines, and PII handling for an AI email agent — because 'be helpful' isn't a security policy.
Syncing Obsidian to a Headless Server
Running Obsidian in a headless Docker container with Obsidian Sync, giving AI agents direct access to your vault.
Connecting Claude Max and Telegram
Using OAuth credentials from a Claude Max subscription to power OpenClaw agents, and wiring up a Telegram bot for mobile access.
Securing the Dashboard with Nginx Proxy Manager
Putting the OpenClaw Control UI behind HTTPS with basic auth, WebSocket passthrough, and a proper Content Security Policy — all through Nginx Proxy Manager.
Setting Up OpenClaw on a Hetzner ARM64 Server
Getting Node.js 22 and OpenClaw running on a fresh Hetzner CAX ARM64 Ubuntu Noble server — including the ARM64 gotchas nobody warns you about.
2018
Visual recon with Aquatone and WebScreenshot
A VPS-based workflow chaining Aquatone subdomain discovery, WebScreenshot capture and express-photo-gallery into a browsable wall of screenshots for triaging a large attack surface.
2017
Android certificate pinning bypass with Frida
A walkthrough of installing the Burp CA on an Android device, running frida-server and using an SSL re-pinning Frida script to intercept traffic from apps that pin certificates.
2016
.htpasswd exposed, DES hash cracked
Directory brute-forcing a private bug bounty target turned up a world-readable .htpasswd whose descrypt hash, once cracked, opened four staging and development subdomains.
2015
Stop OS X Spotlight Leaking Your Location
Proxying OS X Spotlight through Burp showed it shipping the user's latitude and longitude to api.smoot.apple.com on every search, with two ways to block the request.
2014
PayPal merchant directory reflected XSS
A duplicated q parameter in PayPal's merchant directory let an injected payload break out of script context, producing a reflected XSS that PayPal patched within days.
Hijacking a Prezi Subdomain Redirect ($500)
mailroom.prezi.com concatenated the request path onto its own hostname when redirecting, so a request to /.attacker-domain sent victims to a lookalike attacker-controlled host.
BillMeLater: XSS Through a Style Attribute
A Firefox-only reflected XSS on wwwb.search.billmelater.com, achieved by closing out of a style attribute and injecting a fresh script element, which the vendor classified as out of scope.
Two Weeks of a Kippo SSH Honeypot
Results from two weeks of a Kippo SSH honeypot in November 2014: roughly 4,000 brute-force attempts, 2,500 distinct credential pairs, and a source distribution dominated by hosts in China.
DOM XSS on PayPal's Main Domain
A payload placed in the URL fragment reached a DOM sink on PayPal's main domain and executed; PayPal closed the report as a duplicate.
Stored XSS in Three WordPress Chat Plugins
WP Live Chat Support, MyLiveChat and Provide Support all accepted stored cross-site scripting during a 2014 customer install.
Path Traversal on map.prezi.com ($1,000)
A path traversal issue on Prezi's map.prezi.com subdomain, fixed within two days of reporting and rewarded with a $1,000 bounty.
Seven PayPal Bugs, Zero Bounties
A 2014 run through PayPal's bug bounty scope: seven confirmed issues across paypal.com, financing.paypal.com, apps.paypal.com and the paypal-*.com family, all closed as duplicate or invalid.
2013
160 German tax office sites vulnerable to XSS
Reflected cross-site scripting across 160 German tax office websites, disclosed via heise.de and forwarded to CERT-Bund for coordinated remediation.
PHP 5.3.3–5.3.6 socket_connect Bind Shell
A public PHP 5.3.3-5.3.6 socket_connect exploit carrying a bind-TCP shell payload, dropped as an uploaded PHP file and located with an nmap sweep of ports 4000-4500.
SQL injection to root on a 2013 lab box
Chaining a login-form SQL injection through sqlmap's --os-shell into a Linux 2.6.32 local root exploit to go from the 'nobody' user to full control of the server.
Yahoo's /14 and an exposed phpinfo.php
Pivoting from Yahoo's main A record to its ARIN netblock and sweeping all 260,000 addresses in the /14 for an exposed phpinfo.php.