HACKERBADGER
Breaking things. Writing it down.
Visual_ID: HACKERBADGER
Latest Research
DiceForge: XXE File Disclosure via Session Import
2026.10.14
BugForge
easy
XML External Entity Injection (XXE)
Executive Summary
CafeClub: Server-Side Template Injection in Invoice Rendering
2026.10.14
BugForge
easy
Server-Side Template Injection
Executive Summary
Mosaic: IDOR on Board Export
2026.10.12
BugForge
easy
IDOR / Broken Object Level Authorization
Executive Summary
WordMess: Nested Widget Allowlist Bypass to Dangerous Hook Execution
2026.10.07
BugForge
medium
Nested Deserialization Allowlist Bypass
Executive Summary
Vaultly: Next.js Image Optimizer SSRF to Ops Session Forgery
2026.09.29
BugForge
medium
Next.js Image Optimizer SSRF
Executive Summary
MesaNet Access Panel: OAuth Connector-Review Confused Deputy to Restricted Archive
2026.09.26
BugForge
hard
OAuth Connector-Review Confused Deputy
Executive Summary
analytics
Activity Log
[2026.10.14]
New writeup published: DiceForge: XXE File Disclosure via Session Import
[2026.10.14]
New writeup published: CafeClub: Server-Side Template Injection in Invoice Rendering
[2026.10.12]
New writeup published: Mosaic: IDOR on Board Export
[2026.10.07]
New writeup published: WordMess: Nested Widget Allowlist Bypass to Dangerous Hook Execution
[2026.09.29]
New writeup published: Vaultly: Next.js Image Optimizer SSRF to Ops Session Forgery
construction
Toolkit
v0.3.0
Caido Workbench
SQLi and JWT workbench plugin for Caido proxy.
v1.2.0
Race
HTTP/2 single-packet race condition testing.
v1.0.0
JWTForge
JWT creation, modification, and signing tool.
More Coming
Additional tools in development.