https://patrik.re/topics/ Browse Patrik Grobshäuser's research by subject, including articles published on Searchlight Cyber. en-GB Wed, 05 Aug 2026 00:30:00 +0200 https://patrik.re/where-was-mythos-when-wordpress-fell/ https://patrik.re/where-was-mythos-when-wordpress-fell/ Wed, 05 Aug 2026 00:30:00 +0200 On marketing claims nobody checks, the 1,000 projects Anthropic never listed, and why an industry full of experts followed along. patrik.reai-security https://slcyber.io/research-center/cargowise-webtracker-the-keys-were-in-the-cargo/ https://slcyber.io/research-center/cargowise-webtracker-the-keys-were-in-the-cargo/ Thu, 25 Jun 2026 00:00:00 +0000 Credentials recoverable from a logistics platform's own tracking interface. Searchlight Cyberweb-exploitation https://slcyber.io/research-center/keys-to-the-kingdom-anonymous-sql-injection-in-drupal-core-cve-2026-9082/ https://slcyber.io/research-center/keys-to-the-kingdom-anonymous-sql-injection-in-drupal-core-cve-2026-9082/ Thu, 21 May 2026 00:00:00 +0000 Unauthenticated SQL injection reachable in Drupal core. Searchlight Cyberweb-exploitation https://patrik.re/to-kara-alex-and-michiel-your-researchers-are-leaving/ https://patrik.re/to-kara-alex-and-michiel-your-researchers-are-leaving/ Wed, 20 May 2026 00:00:00 +0000 Bug bounty platforms never humanized researchers or triage. Now they're drowning in AI slop and wondering why their best people are leaving. patrik.redisclosureai-security https://slcyber.io/research-center/new-age-of-collisions-reading-arbitrary-files-pre-auth-as-root-in-cpanel-cve-2026-29205/ https://slcyber.io/research-center/new-age-of-collisions-reading-arbitrary-files-pre-auth-as-root-in-cpanel-cve-2026-29205/ Mon, 18 May 2026 00:00:00 +0000 Reading arbitrary files pre-authentication, as root, on cPanel. Searchlight Cyberweb-exploitation https://slcyber.io/research-center/hyoketsu-solving-the-vendor-dependency-problem-in-re/ https://slcyber.io/research-center/hyoketsu-solving-the-vendor-dependency-problem-in-re/ Wed, 18 Mar 2026 00:00:00 +0000 Tooling for reverse engineering without waiting on vendor firmware. Searchlight Cyberreverse-engineering https://patrik.re/running-h1-brain-against-a-real-target/ https://patrik.re/running-h1-brain-against-a-real-target/ Tue, 10 Mar 2026 00:00:00 +0000 A start-to-finish walkthrough of using h1-brain on an actual program. From hack() briefing to attack plan. patrik.reai-security https://patrik.re/teaching-claude-everything-youve-hacked/ https://patrik.re/teaching-claude-everything-youve-hacked/ Tue, 10 Mar 2026 00:00:00 +0000 h1-brain is an MCP server that gives Claude your HackerOne bounty history and a database of public disclosures. Setup and first sync. patrik.reai-security https://patrik.re/what-h1-brain-actually-does/ https://patrik.re/what-h1-brain-actually-does/ Tue, 10 Mar 2026 00:00:00 +0000 Every tool in h1-brain, explained. Your reports, public disclosures, and the hack() briefing that ties them together. patrik.reai-security https://patrik.re/replaced-by-a-goldfish/ https://patrik.re/replaced-by-a-goldfish/ Fri, 06 Mar 2026 00:00:00 +0000 Opus 4.6, the pentesting hype, and why most of the AI discourse around security is just noise. patrik.reai-security https://patrik.re/daily-workflows-with-the-email-agent/ https://patrik.re/daily-workflows-with-the-email-agent/ Wed, 25 Feb 2026 00:00:00 +0000 Real usage patterns for an AI email agent — morning triage, thread summaries, draft replies, and where the human stays in the loop. patrik.reai-security https://patrik.re/gmail-api-credentials-the-paranoid-way/ https://patrik.re/gmail-api-credentials-the-paranoid-way/ Wed, 25 Feb 2026 00:00:00 +0000 Setting up Google Cloud OAuth credentials with minimal scopes for an AI email agent — because 'full access' is never the right default. patrik.reai-security https://patrik.re/guardrails-that-actually-work/ https://patrik.re/guardrails-that-actually-work/ Wed, 25 Feb 2026 00:00:00 +0000 A four-layer defense model for AI email agents — because no single safety measure is enough when your inbox is on the line. patrik.reai-security https://patrik.re/wiring-gmail-into-openclaw/ https://patrik.re/wiring-gmail-into-openclaw/ Wed, 25 Feb 2026 00:00:00 +0000 Installing the Gmail MCP server, configuring agent tools, and filtering down to only the operations you actually want. patrik.reai-security https://patrik.re/writing-a-soul-md-for-email/ https://patrik.re/writing-a-soul-md-for-email/ Wed, 25 Feb 2026 00:00:00 +0000 Defining hard rules, tone guidelines, and PII handling for an AI email agent — because 'be helpful' isn't a security policy. patrik.reai-security https://patrik.re/syncing-obsidian-to-a-headless-server/ https://patrik.re/syncing-obsidian-to-a-headless-server/ Fri, 20 Feb 2026 00:00:00 +0000 Running Obsidian in a headless Docker container with Obsidian Sync, giving AI agents direct access to your vault. patrik.reai-security https://patrik.re/connecting-claude-max-and-telegram/ https://patrik.re/connecting-claude-max-and-telegram/ Thu, 19 Feb 2026 00:00:00 +0000 Using OAuth credentials from a Claude Max subscription to power OpenClaw agents, and wiring up a Telegram bot for mobile access. patrik.reai-security https://patrik.re/securing-the-dashboard-with-nginx-proxy-manager/ https://patrik.re/securing-the-dashboard-with-nginx-proxy-manager/ Wed, 18 Feb 2026 00:00:00 +0000 Putting the OpenClaw Control UI behind HTTPS with basic auth, WebSocket passthrough, and a proper Content Security Policy — all through Nginx Proxy Manager. patrik.reai-security https://patrik.re/setting-up-openclaw-on-hetzner-arm64/ https://patrik.re/setting-up-openclaw-on-hetzner-arm64/ Tue, 17 Feb 2026 00:00:00 +0000 Getting Node.js 22 and OpenClaw running on a fresh Hetzner CAX ARM64 Ubuntu Noble server — including the ARM64 gotchas nobody warns you about. patrik.reai-security https://patrik.re/how-i-made-more-than-30k-with-jolokia-cves/ https://patrik.re/how-i-made-more-than-30k-with-jolokia-cves/ Tue, 16 Jun 2020 00:00:00 +0000 A full lab build and exploitation walkthrough for exposed Jolokia JMX endpoints: reflected XSS (CVE-2018-1000129), JNDI remote code execution via a rogue LDAP server (CVE-2018-1000130), and dumping the Java heap to recover credentials. patrik.reweb-exploitation https://patrik.re/visual-recon-a-beginners-guide/ https://patrik.re/visual-recon-a-beginners-guide/ Sat, 05 May 2018 00:00:00 +0000 A VPS-based workflow chaining Aquatone subdomain discovery, WebScreenshot capture and express-photo-gallery into a browsable wall of screenshots for triaging a large attack surface. patrik.rereconnaissance https://patrik.re/the-stony-path-of-android--f0-9f-a4-96-bug-bounty-bypassing-certificate-pinning/ https://patrik.re/the-stony-path-of-android--f0-9f-a4-96-bug-bounty-bypassing-certificate-pinning/ Sat, 21 Oct 2017 00:00:00 +0000 A walkthrough of installing the Burp CA on an Android device, running frida-server and using an SSL re-pinning Frida script to intercept traffic from apps that pin certificates. patrik.rereverse-engineering https://patrik.re/bugbounty-decoding-a--f0-9f-98-b1-00000-htpasswd-bounty/ https://patrik.re/bugbounty-decoding-a--f0-9f-98-b1-00000-htpasswd-bounty/ Thu, 08 Sep 2016 00:00:00 +0000 Directory brute-forcing a private bug bounty target turned up a world-readable .htpasswd whose descrypt hash, once cracked, opened four staging and development subdomains. patrik.reweb-exploitationreconnaissance https://patrik.re/bugbounty-sleeping-stored-google-xss-awakens-a-5000-bounty/ https://patrik.re/bugbounty-sleeping-stored-google-xss-awakens-a-5000-bounty/ Tue, 17 May 2016 00:00:00 +0000 An XSS payload stored as a Google Cloud project name executed months later in the unfiltered project-deletion error message, earning a $5,000 VRP reward, plus the impact argument that got it past a self-XSS classification. patrik.reweb-exploitation https://patrik.re/digging-into-the-shopify-pos-firmware-part-1/ https://patrik.re/digging-into-the-shopify-pos-firmware-part-1/ Fri, 09 Oct 2015 00:00:00 +0000 An in-scope Shopify POS endpoint exposed the card reader's firmware bundles, which unpack via binwalk, a dd carve at 0x202024 and jffs2dump into a JFFS2 root filesystem containing a salted MD5 root hash. patrik.reweb-exploitationreverse-engineering https://patrik.re/research-stop-osx-spotlight-from-sending-your-location/ https://patrik.re/research-stop-osx-spotlight-from-sending-your-location/ Mon, 15 Jun 2015 00:00:00 +0000 Proxying OS X Spotlight through Burp showed it shipping the user's latitude and longitude to api.smoot.apple.com on every search, with two ways to block the request. patrik.reweb-exploitationreverse-engineering https://patrik.re/bugbounty-papyal-xml-upload-cross-site-scripting-vulnerability/ https://patrik.re/bugbounty-papyal-xml-upload-cross-site-scripting-vulnerability/ Wed, 07 Jan 2015 00:00:00 +0000 PayPal's invoicing feature accepted .xml attachments, and an XHTML-namespaced script element inside the XML executed when the file was served back. Includes the exploitability argument needed to qualify it for a bounty. patrik.reweb-exploitation https://patrik.re/bugbounty-reflected-cross-site-scripting-at-paypal-com/ https://patrik.re/bugbounty-reflected-cross-site-scripting-at-paypal-com/ Mon, 15 Dec 2014 00:00:00 +0000 A duplicated q parameter in PayPal's merchant directory let an injected payload break out of script context, producing a reflected XSS that PayPal patched within days. patrik.reweb-exploitation https://patrik.re/bugbounty-malicious-redirect-on-mailroom-prezi-com/ https://patrik.re/bugbounty-malicious-redirect-on-mailroom-prezi-com/ Wed, 10 Dec 2014 00:00:00 +0000 mailroom.prezi.com concatenated the request path onto its own hostname when redirecting, so a request to /.attacker-domain sent victims to a lookalike attacker-controlled host. patrik.reweb-exploitation https://patrik.re/bugbounty-reflected-cross-site-scripting-billmelater/ https://patrik.re/bugbounty-reflected-cross-site-scripting-billmelater/ Mon, 17 Nov 2014 00:00:00 +0000 A Firefox-only reflected XSS on wwwb.search.billmelater.com, achieved by closing out of a style attribute and injecting a fresh script element, which the vendor classified as out of scope. patrik.reweb-exploitationdisclosure https://patrik.re/research-ssh-honeypot-honey-wss-sh-com/ https://patrik.re/research-ssh-honeypot-honey-wss-sh-com/ Mon, 17 Nov 2014 00:00:00 +0000 Results from two weeks of a Kippo SSH honeypot in November 2014: roughly 4,000 brute-force attempts, 2,500 distinct credential pairs, and a source distribution dominated by hosts in China. patrik.reweb-exploitationreconnaissance https://patrik.re/bugbounty-paypal-stored-xss-security-bypass/ https://patrik.re/bugbounty-paypal-stored-xss-security-bypass/ Tue, 11 Nov 2014 00:00:00 +0000 A stored XSS in PayPal's account name field, delivered to arbitrary users through invoices after bypassing the signup flow's security check by truncating the workflow URL to /webapps/. patrik.reweb-exploitation https://patrik.re/bugbounty-paypal-dom-xss-main-domain/ https://patrik.re/bugbounty-paypal-dom-xss-main-domain/ Wed, 05 Nov 2014 00:00:00 +0000 A payload placed in the URL fragment reached a DOM sink on PayPal's main domain and executed; PayPal closed the report as a duplicate. patrik.reweb-exploitation https://patrik.re/bugbounty-the-5000-google-xss/ https://patrik.re/bugbounty-the-5000-google-xss/ Fri, 31 Oct 2014 00:00:00 +0000 Google Tag Manager validated macro names in the web UI but not in the JSON container import path, so a payload smuggled through a file upload executed and earned a $5,000 bounty. patrik.reweb-exploitation https://patrik.re/wordpress-3x-vulnerable-chat-plugins-3/ https://patrik.re/wordpress-3x-vulnerable-chat-plugins-3/ Thu, 02 Oct 2014 00:00:00 +0000 WP Live Chat Support, MyLiveChat and Provide Support all accepted stored cross-site scripting during a 2014 customer install. patrik.reweb-exploitationdisclosure https://patrik.re/google-chrome-security-multiple-leading-slashes-in-urls-may-confuse-some-server-side-xss-filters/ https://patrik.re/google-chrome-security-multiple-leading-slashes-in-urls-may-confuse-some-server-side-xss-filters/ Tue, 17 Jun 2014 00:00:00 +0000 Chrome resolves and executes a script URL written as http: followed by any number of backslashes. Firefox does not, and that difference can slip past pattern-matching XSS filters, closed by Chromium as wontfix. patrik.reweb-exploitationdisclosure https://patrik.re/bug-bounty-prezi-map-prezi-com-path-traversal/ https://patrik.re/bug-bounty-prezi-map-prezi-com-path-traversal/ Wed, 21 May 2014 00:00:00 +0000 A path traversal issue on Prezi's map.prezi.com subdomain, fixed within two days of reporting and rewarded with a $1,000 bounty. patrik.reweb-exploitationdisclosure https://patrik.re/a-tale-of-7-vulnerabilities-paypal-bug-bounty/ https://patrik.re/a-tale-of-7-vulnerabilities-paypal-bug-bounty/ Sun, 20 Apr 2014 00:00:00 +0000 A 2014 run through PayPal's bug bounty scope: seven confirmed issues across paypal.com, financing.paypal.com, apps.paypal.com and the paypal-*.com family, all closed as duplicate or invalid. patrik.reweb-exploitationreconnaissance https://patrik.re/were-on-heise-german-found-160-sites-vulnerable-to-xss/ https://patrik.re/were-on-heise-german-found-160-sites-vulnerable-to-xss/ Mon, 11 Nov 2013 00:00:00 +0000 Reflected cross-site scripting across 160 German tax office websites, disclosed via heise.de and forwarded to CERT-Bund for coordinated remediation. patrik.reweb-exploitationdisclosure https://patrik.re/php-5-3-3-5-3-6-exploit-bind-shell/ https://patrik.re/php-5-3-3-5-3-6-exploit-bind-shell/ Sat, 06 Jul 2013 00:00:00 +0000 A public PHP 5.3.3-5.3.6 socket_connect exploit carrying a bind-TCP shell payload, dropped as an uploaded PHP file and located with an nmap sweep of ports 4000-4500. patrik.reweb-exploitationreconnaissance https://patrik.re/from-nobody-to-root-advanced-sql-injection/ https://patrik.re/from-nobody-to-root-advanced-sql-injection/ Tue, 07 May 2013 00:00:00 +0000 Chaining a login-form SQL injection through sqlmap's --os-shell into a Linux 2.6.32 local root exploit to go from the 'nobody' user to full control of the server. patrik.reweb-exploitation https://patrik.re/itunes-exploit-development/ https://patrik.re/itunes-exploit-development/ Sun, 10 Mar 2013 00:00:00 +0000 Defeating iTunes' ptrace-based anti-debugging on OS X by breaking on ptrace and rewriting the rdi register, and porting the bypass from Apple's GDB to LLDB to get a Python-capable debugger. patrik.rereverse-engineering https://patrik.re/bugbounty-yahoo-phpinfo-php-disclosure/ https://patrik.re/bugbounty-yahoo-phpinfo-php-disclosure/ Sun, 20 Jan 2013 00:00:00 +0000 Pivoting from Yahoo's main A record to its ARIN netblock and sweeping all 260,000 addresses in the /14 for an exposed phpinfo.php. patrik.reweb-exploitationreconnaissance