// writeups · reports · resources
Blog
Findings worth writing down: bug bounty notes, disclosure reports, and things that make the work easier.
posts
sep 14, 2026
Fuzz the type, not just the value
A one-line habit that keeps finding authorization bugs — swap the type, not just the payload.
dec 20, 2024
From Comments to Command Execution: How an E-Book Platform Gave Me RCE
Stored XSS in a comments feature became unrestricted file upload, and a PHP shell stitched into a PNG became remote code execution.
dec 5, 2024
From Frustration to Exploitation: How a Link Shortener Helped Me Bypass WAF
A 403 wall around a search box — and a built-in link shortener that turned out to be the road around it.