Dossier · Field Notes
Field Notes
Write-ups from the field: offensive security, tooling I had to build, and research worth keeping.
Defeating a Four-Layer Flutter RASP: When Frida Is the Wrong Tool
Defeating a four-layer Flutter RASP across Java, native C, and compiled Dart - and why, for a Frida-aware app, Frida is the wrong tool (use Magisk's Zygisk DenyList instead).
read →Intercepting and Tampering Firestore: building a proxy/repeater for a Firebase mobile app
How a small observation ("the app works, the proxy's running and traffic is flowing, yet I never capture a thing") turned into a reusable tool for intercepting, editing, and replaying Google Cloud Firestore traffic from a mobile app.
read →Infrastructure takeover through insecure attachment handling (LFI & SSRF)
An email feature fetched attachments by URL, but it also resolved a bare local path. No protocol, no metadata trick, just a filename: reading /proc/self/environ returned the process environment and its secrets (AWS, Twilio, SendGrid, Stripe, DB strings) straight into my inbox.
read →Cross-subdomain JWT account takeover: from email reuse to full org compromise
A red-team case study: weak JWT validation (keyed on email), no email verification, and a spoofable Source header let one token cross tenants and escalate to full admin across a multi-tenant SaaS.
read →Manipulating Email Trust: Invoice Import to GitHub and Slack Takeover
Accounting tools that import receipts by email decide who owns an incoming message by its sender. Set that source to noreply@github.com and GitHub's verification code lands in your portal; bridge Slack through an Apple OAuth account, and one invoice feature becomes account takeover of a company's GitHub and Slack.
read →From automated discovery to manual exploitation: PII leak to XSS in an appointment system
Wayback recon surfaced an appointment platform that carried session tokens in GET parameters and leaked PII in archived URLs. From there: a space-free XSS in the phone field a prior hunter missed, and a stored XSS through a file-upload URL reflected unsanitised into the admin panel.
read →Stored XSS in a SOQL query console
A management dashboard let admins run SOQL queries and rendered the results as HTML. By seeding XSS into user records on the managed site and hitting the raw QueryConsole endpoint, which returned HTML instead of JSON, the payload fired in any console user's browser.
read →Upgrade Free to Paid by rewriting the response
A hosting product gated its paid themes and features entirely in the client. By diffing a free response against a paid one and rewriting the bytes the browser trusts, a free account got the full paid experience, then I packaged it as a browser extension.
read →Weaponising a shared ML model: RCE via pickle deserialization
Loading a shared model file can be remote code execution, because Python's pickle format is not data, it is a program. A crafted phishing-detection model runs the attacker's command the moment an engineer calls pickle.load().
read →Came looking for SSRF and found XSS
A bookmark importer fetched a URL and previewed its title and link tags. Every SSRF payload failed, but the title tag was not sanitized (self-XSS), and an audio/onerror trick slipped past the save-time event-handler filter into a stored XSS.
read →