HACKERBADGER

Breaking things. Writing it down.

Visual_ID: HACKERBADGER

Latest Research

[RECORDS_FOUND: 96]

GalaxyDash: Server-Side Template Injection → Secret Disclosure

2026.06.19

BugForge medium Server-Side Template Injection (Context Traversal)

Part 1: Pentest Report

#ssti #template-injection #information-disclosure #nodejs #express #bugforge

Ottergram: Broken Access Control on an Admin DELETE Verb

2026.06.18

BugForge easy Broken Access Control

Part 1: Pentest Report

#broken-access-control #idor #missing-authorization #file-upload #jwt #bugforge

Sokudo: GraphQL Authorization Bypass via Introspection-Off Field Suggestions

2026.06.17

BugForge easy GraphQL Authorization Bypass

Part 1: Pentest Report

#graphql #broken-access-control #authorization-bypass #introspection-bypass #plaintext-password #api-security #bugforge

FurHire: Client-Side Path Traversal to Account Takeover

2026.06.15

BugForge hard Client-Side Path Traversal to Account Takeover

Part 1: Pentest Report

#cspt #client-side-path-traversal #account-takeover #csrf #2fa-bypass #bugforge #webapp

CopyPasta: API Token Name Confusion to Cross-User Impersonation

2026.06.15

BugForge easy Token-Name Identity Confusion

Part 1: Pentest Report

#authentication-bypass #impersonation #api-tokens #identity-confusion #idor #cwe-287 #cwe-639 #bugforge #webapp

CopyPasta: IDOR Snippet Delete (Broken Object-Level Authorization)

2026.06.12

BugForge easy IDOR / Broken Object-Level Authorization

#idor #broken-access-control #bola #verb-tampering #bugforge

analytics

Activity Log

[2026.06.19] New writeup published: GalaxyDash: Server-Side Template Injection → Secret Disclosure

[2026.06.18] New writeup published: Ottergram: Broken Access Control on an Admin DELETE Verb

[2026.06.17] New writeup published: Sokudo: GraphQL Authorization Bypass via Introspection-Off Field Suggestions

[2026.06.15] New writeup published: FurHire: Client-Side Path Traversal to Account Takeover

[2026.06.15] New writeup published: CopyPasta: API Token Name Confusion to Cross-User Impersonation

construction

Toolkit

web v0.3.0

Caido Workbench

SQLi and JWT workbench plugin for Caido proxy.

speed v1.2.0

Race

HTTP/2 single-packet race condition testing.

key v1.0.0

JWTForge

JWT creation, modification, and signing tool.

more_horiz

More Coming

Additional tools in development.