HACKERBADGER

Breaking things. Writing it down.

Visual_ID: HACKERBADGER

Latest Research

[RECORDS_FOUND: 116]

FurHire: Operator Injection in Account Recovery

2026.08.14

BugForge medium Operator Injection / Type Confusion

Executive Summary

#operator-injection #type-confusion #blind-extraction #account-recovery #socket-io #bugforge

Shady Oaks Financial: Negative Quantity Business Logic Flaw

2026.08.08

BugForge easy Negative Quantity Business Logic Flaw

Executive Summary

#business-logic #input-validation #negative-quantity #client-side-validation #cwe-1284 #cwe-602 #bugforge #webapp

Ottergram: Private Post Captions Are Searchable but Not Returned

2026.08.06

BugForge easy Private Content Disclosure via Search Matching

Executive Summary

#broken-access-control #idor #bola #information-disclosure #blind-extraction #search #bugforge

Tanuki: Set Membership Authorization Bypass to Admin Account Takeover

2026.08.05

BugForge medium Broken Access Control

Executive Summary

#broken-access-control #type-confusion #account-takeover #authorization #cwe-863 #bugforge

Shady Oaks Financial: UNION SQL Injection to Administrator Account Takeover

2026.08.05

BugForge easy UNION SQL Injection

Executive Summary

#sqli #union-injection #sqlite #account-takeover #cwe-89 #cwe-256 #bugforge #webapp

WordMess: Unauthenticated Privilege Bypass via Batch API Index Desynchronization (CVE-2026-63030)

2026.07.31

BugForge medium Batch API Authorization Index Desynchronization

Executive Summary

#cve-2026-63030 #broken-access-control #batch-api #wordpress #rest-api #cwe-436 #bugforge

analytics

Activity Log

[2026.08.14] New writeup published: FurHire: Operator Injection in Account Recovery

[2026.08.08] New writeup published: Shady Oaks Financial: Negative Quantity Business Logic Flaw

[2026.08.06] New writeup published: Ottergram: Private Post Captions Are Searchable but Not Returned

[2026.08.05] New writeup published: Tanuki: Set Membership Authorization Bypass to Admin Account Takeover

[2026.08.05] New writeup published: Shady Oaks Financial: UNION SQL Injection to Administrator Account Takeover

construction

Toolkit

web v0.3.0

Caido Workbench

SQLi and JWT workbench plugin for Caido proxy.

speed v1.2.0

Race

HTTP/2 single-packet race condition testing.

key v1.0.0

JWTForge

JWT creation, modification, and signing tool.

more_horiz

More Coming

Additional tools in development.