HACKERBADGER

Breaking things. Writing it down.

Visual_ID: HACKERBADGER

Latest Research

[RECORDS_FOUND: 121]

Vaultly: Next.js Image Optimizer SSRF to Ops Session Forgery

2026.09.29

BugForge medium Next.js Image Optimizer SSRF

Executive Summary

#ssrf #nextjs #next-image #jwt-forgery #webapp #bugforge

MesaNet Access Panel: OAuth Connector-Review Confused Deputy to Restricted Archive

2026.09.26

BugForge hard OAuth Connector-Review Confused Deputy

Executive Summary

#oauth #confused-deputy #broken-access-control #idor #account-takeover #bugforge #webapp

Cheesy Does It: Mass Assignment via Hidden PATCH Verb

2026.09.12

BugForge easy Mass Assignment via Hidden Update Verb

Executive Summary

#mass-assignment #verb-tampering #hidden-handler #business-logic #bugforge

Tali: Custom Token Signature Verification Bypass

2026.09.11

BugForge easy Custom Token Signature Verification Bypass

Executive Summary

#signature-bypass #custom-token #graphql #hmac #alg-none-analog #bugforge

WordMess: Capability Map Mass Assignment to Full Site Takeover

2026.08.28

BugForge medium Capability Map Mass Assignment

Executive Summary

#mass-assignment #broken-access-control #privilege-escalation #capability-model #open-redirect #wordpress #cwe-915 #bugforge

FurHire: Operator Injection in Account Recovery

2026.08.14

BugForge medium Operator Injection / Type Confusion

Executive Summary

#operator-injection #type-confusion #blind-extraction #account-recovery #socket-io #bugforge

analytics

Activity Log

[2026.09.29] New writeup published: Vaultly: Next.js Image Optimizer SSRF to Ops Session Forgery

[2026.09.26] New writeup published: MesaNet Access Panel: OAuth Connector-Review Confused Deputy to Restricted Archive

[2026.09.12] New writeup published: Cheesy Does It: Mass Assignment via Hidden PATCH Verb

[2026.09.11] New writeup published: Tali: Custom Token Signature Verification Bypass

[2026.08.28] New writeup published: WordMess: Capability Map Mass Assignment to Full Site Takeover

construction

Toolkit

web v0.3.0

Caido Workbench

SQLi and JWT workbench plugin for Caido proxy.

speed v1.2.0

Race

HTTP/2 single-packet race condition testing.

key v1.0.0

JWTForge

JWT creation, modification, and signing tool.

more_horiz

More Coming

Additional tools in development.