XSS
High
Stored XSS via SVG Upload in Profile Editor
Bypassed MIME-type validation to upload a crafted SVG with embedded <script> tags. The payload executed in the context of every visitor viewing the profile page.
Security Researcher | Bug Bounty Hunter
Hunting web vulnerabilities across HackerOne & Bugcrowd programs. Specializing in XSS, SQL Injection, IDOR, and SSRF chains. Turning attack surfaces into detailed, reproducible reports.
// about_me
I'm a self-taught security researcher obsessed with breaking web applications before the bad guys do. With over 3 years of active bug bounty hunting, I've reported 100+ valid vulnerabilities to programs ranging from FinTech startups to Fortune 500 companies.
My approach is methodology-driven: I map every attack surface, enumerate endpoints, and chain low-severity findings into high-impact exploits. When I find something, I write reports that developers can actually act on.
// write_ups
Bypassed MIME-type validation to upload a crafted SVG with embedded <script> tags. The payload executed in the context of every visitor viewing the profile page.
Discovered unsanitized sort parameter in a paginated API. Time-based extraction confirmed full DB read access, exposing 2M+ user records.
Sequential integer IDs on /api/invoices/{id} with no authorization check. Iterated 50k records to retrieve name, email, address, and last-4 card digits.
Webhook URL field fetched arbitrary hosts without SSRF mitigations. Pointed to 169.254.169.254 to retrieve IAM credentials with full EC2 role permissions.
Serialized Java object in a cookie was passed to ObjectInputStream without validation. Crafted a ysoserial payload achieving unauthenticated RCE as www-data.
Reset tokens remained valid after password change and lacked expiry. An attacker intercepting a single token could perform account takeover indefinitely.
React SPA passed window.location.hash directly to dangerouslySetInnerHTML. Crafted URL with encoded payload bypassed WAF and triggered cookie theft.
Profile update endpoint accepted role parameter and assigned it without privilege checks. Sent "role":"admin" to self-escalate to full admin access.
// hall_of_fame
// contact
Found a collaboration opportunity? Running a private program? Want to discuss a finding or commission a security review? Drop a message — I respond within 24 hours.