WRITING.

A 2FA bypass so simple it was offensive. The server asked if 2FA was complete. I said yes. The server believed me. That was the whole thing.

A wildcard CORS misconfiguration that reflected any Origin header as trusted. I made a victim's browser make authenticated API calls to their own account and send me the results. Classic.

A GraphQL API with introspection enabled in production revealed every admin mutation. Then I called them. Without being an admin. Turns out the schema was more honest than the authorization layer.

Insecure deserialization in a session cookie. I modified my cookie. Their server deserialized it. My code ran. Remote code execution from a cookie. Still feels unreal.

Prototype pollution in a client-side library that cascaded into DOM-based XSS. One crafted URL parameter. Every user who visited the page. JavaScript runs.

An open redirect in a trusted OAuth callback parameter turned into a complete token theft chain. One link. One click. Full account access. No malware. No drama.

HTTP request smuggling on a load-balanced application. I sent one malformed request. The backend thought it was two. The second one belonged to the next user who visited. Critical.

An XXE injection buried inside a document import feature. I uploaded an XML file. Their server read its own filesystem back to me. Then I found the AWS credentials file.

A time-based blind SQL injection that started with a one-second delay and ended with 200,000 user records, internal API keys, and a very uncomfortable conversation with their CTO.

An SSRF that started as a curiosity and ended with me reading EC2 instance metadata from their internal AWS environment. Critical doesn't cover it.

A stored XSS that silently fired on every admin session. Turns out 'sanitized' and 'actually sanitized' are two very different things.

An IDOR so simple it made me question everything I knew about software engineering. And humanity.

A critical authentication bypass that let me log in as literally any user. No password required. Just vibes.

First blog. No CVE yet. Just curiosity, broken assumptions, and too much time in Burp Suite.