0xcan1337

cat certifications.txt

ls ./CVEs // public advisories

ls ./exploits

• CVE-2025-47812-poC
• Docker-Unauth-API-RCE

ls ./tools

• CRD_EXF.ps1 — data exfiltration (post-exploitation) tool
• KARAKURA — PowerShell-based secure reverse shell script

grep -r "writeup" ./blog // selected

• MRS #2: Bypassing premium features via "premium validation" parameters (€€€)
• Report Summaries #1: PM can see & download all users' login history (IDOR)
• Disclosure of any WordPress user's email via redacted service
• Bypassing email verification of a high-profile tech company ($$$)
• Bypassing Apple's redirection process with the dot (".") character
• Break the Logic: 5 different perspectives in a single page (€1500)
• Break the Logic: Insecure parameters (€300)
• Multiple bugs in one program leads to 1500€
• IDOR is NOT only about other people's IDs
• How I leaked 5.2k customer records via broken access control
• Tackling CVE-2021-41277 using a vulnerability database
• SONY Hunting I: Discovering hidden parameters (5x SWAG)
• What is BOLA? 3-digit bounty from Topcoder ($$$)
• The fine line of IDOR (ESET $WAG)
• Reflected XSS on a private program ($750)
• Analysis: FortiOS credentials disclosure (CVE-2018-13379) [TR]
• IDOR Practices I [TR]
• Business Logic Flaws — Giriş I [TR]

cat disclosures.log

• Report #1073420

cat hall_of_fame.log // public programs only

cat press_mentions.log

• Critical FOSSBilling SSTI Flaw Enables Information Disclosure and RCE — CyberPress
• CVE-2026-28496: FOSSBilling SSTI RCE Vulnerability — SentinelOne
• Bug Bytes #187 — Intigriti
• IW Weekly #40
• IW Weekly #39
• API Security — Issue 148
• Thursday Hacking Masala | EP #20 — YouTube