HACKERBADGER

Breaking things. Writing it down.

Visual_ID: HACKERBADGER

Latest Research

[RECORDS_FOUND: 101]

Cheesy Does It: Password-Reset Account Takeover via OTP Verification Bypass

2026.07.09

BugForge easy Password-Reset OTP Verification Bypass

Part 1: Pentest Report

#bugforge #webapp #account-takeover #password-reset #otp #otp-verification-bypass #type-confusion #broken-authentication #cwe-640 #cwe-697

Vaultly: Prototype Pollution to Anonymous Cross-Tenant File Disclosure

2026.07.04

BugForge medium Prototype Pollution

Part 1: Pentest Report

#prototype-pollution #access-control #multi-tenant #nextjs #merge-patch #bugforge

Sokudo: Version-Drift Mass-Assignment to Admin

2026.07.04

BugForge easy Version-Drift Mass Assignment

Part 1: Pentest Report

#mass-assignment #privilege-escalation #version-drift #broken-access-control #jwt #bugforge #webapp

CopyPasta: Collection Share Endpoint Over-Exposes Private Snippets

2026.06.25

BugForge easy Broken Access Control

Part 1: Pentest Report

#broken-access-control #broken-object-property-level-authorization #excessive-data-exposure #api-security #idor #express #react #bugforge

Ottergram: Unauthenticated Path Traversal / Arbitrary File Read

2026.06.23

BugForge easy Path Traversal / File Inclusion

Part 1: Pentest Report

#path-traversal #lfi #file-inclusion #arbitrary-file-read #unauthenticated #express #react #bugforge

GalaxyDash: Server-Side Template Injection → Secret Disclosure

2026.06.19

BugForge medium Server-Side Template Injection (Context Traversal)

Part 1: Pentest Report

#ssti #template-injection #information-disclosure #nodejs #express #bugforge

analytics

Activity Log

[2026.07.09] New writeup published: Cheesy Does It: Password-Reset Account Takeover via OTP Verification Bypass

[2026.07.04] New writeup published: Vaultly: Prototype Pollution to Anonymous Cross-Tenant File Disclosure

[2026.07.04] New writeup published: Sokudo: Version-Drift Mass-Assignment to Admin

[2026.06.25] New writeup published: CopyPasta: Collection Share Endpoint Over-Exposes Private Snippets

[2026.06.23] New writeup published: Ottergram: Unauthenticated Path Traversal / Arbitrary File Read

construction

Toolkit

web v0.3.0

Caido Workbench

SQLi and JWT workbench plugin for Caido proxy.

speed v1.2.0

Race

HTTP/2 single-packet race condition testing.

key v1.0.0

JWTForge

JWT creation, modification, and signing tool.

more_horiz

More Coming

Additional tools in development.