CRITICAL · CVSS 9.6
YesWeHack Private Program
€1,000+ Bounty
CWE-639 · BOLA / IDOR
Critical Multi-Tenant IDOR to Full Organization Takeover
During a private assessment of an enterprise SaaS platform, I identified a critical authorization flaw on the workspace membership API. The endpoint failed to cryptographically validate tenant boundaries, enabling any low-privilege authenticated user to inject foreign workspace IDs into role update payloads and promote themselves to super-administrator across arbitrary customer organizations.
Attack & Verification Chain
- 01Intercepted
PATCH /api/v2/workspaces/{target_id}/members while inviting team members in an attacker-controlled tenant.
- 02Replaced the active workspace UUID with the target organization's identifier obtained from public asset headers.
- 03Server responded with HTTP 200 and updated the user's role mask, granting instant super-admin access to all tenant databases, customer records, and API secrets.
- 04Reported via YesWeHack; confirmed by security triage within 24 hours and verified patched with strict session-tenant binding.
HIGH · CVSS 8.2
European eCommerce Target
€450 Bounty
CWE-284 · Access Control
Horizontal Privilege Escalation & PII Leakage in Invoice Gateway
Discovered an authorization bypass on a European retail platform's dynamic invoice generation microservice. While frontend controls masked other customers' invoices, the underlying REST endpoint accepted sequential invoice numbers without matching them against the requesting account's order history, leaking full billing addresses, phone numbers, and payment tokens.
Attack & Verification Chain
- 01Analyzed network requests during invoice PDF download:
GET /invoices/pdf?ref=INV-2026-08492.
- 02Automated parameter enumeration with Burp Intruder across adjacent sequence identifiers.
- 03Observed unrestricted extraction of customer invoices, containing full names, residential delivery addresses, and masked credit card details.
- 04Promptly reported with reproducible proof of concept. Validated by security engineers and patched with cryptographic signed URLs.
MEDIUM · CVSS 6.5
Android Security Research
Tooling Case Study
CWE-798 · Hardcoded Credentials
Automating Mobile Recon: APK Bytecode Decompilation & Secret Extraction
A technical breakdown of mobile application reverse engineering workflows that led to the development of APKLens and DroidHawk. Explores how deobfuscating APK dex bytecode reveals unsecured cloud staging endpoints, production OAuth client secrets, and exposed Firebase database instances.
Methodology & Tooling Architecture
- 01Manifest Parsing: Extracting exported broadcast receivers, unconstrained content providers, and excessive permission grants.
- 02Bytecode Decompilation: Converting DEX classes into readable smali/Java code using in-browser WebAssembly decompilers.
- 03Regex Heuristics: Pattern matching against AWS access keys, Stripe test/live tokens, Firebase endpoints, and JWT private keys.
- 04Live verification using APKLens with zero server-side file uploads.
PRIVACY RESEARCH
Digital Forensics
Tooling Case Study
Metadata Forensics
Digital Image Forensics: Detecting Hidden Geolocation & Camera Fingerprints
An investigation into how modern web applications inadvertently leak sensitive user geolocations, device serial numbers, and creator identity through unstripped EXIF, IPTC, and XMP metadata headers uploaded by users — inspiring the creation of MetaForensic.
Inspection & Privacy Scrubber Mechanics
- 01Binary Header Decoding: Parsing TIFF IFD structures, GPS sub-IFDs, and MakerNote vendor blocks in client-side JavaScript.
- 02Coordinate Triangulation: Translating raw Rational degree/minute/second byte arrays into exact decimal latitude/longitude maps.
- 03Zero-Knowledge Scrubber: Canvas re-encoding engine that strips 100% of EXIF markers without altering image dimensions or quality.