HACKERBADGER

Breaking things. Writing it down.

Visual_ID: HACKERBADGER

Latest Research

[RECORDS_FOUND: 107]

Vaultly: Next.js Middleware Authorization Bypass (CVE-2025-29927)

2026.07.15

BugForge medium Next.js Middleware Authorization Bypass (CVE-2025-29927)

Part 1: Pentest Report

#access-control #nextjs #middleware-bypass #cve-2025-29927 #bugforge

Tanuki: XML Entity Smuggling to SQL Injection

2026.07.15

BugForge medium XML Entity Smuggling to SQL Injection

Tanuki SRS Flash Cards: XML Entity Smuggling to SQL Injection

#sqli #xml-entity-smuggling #filter-bypass #blind-sqli #bugforge

Shady Oaks Financial: Server-Side Template Injection via Undocumented Parameter

2026.07.14

BugForge easy Server-Side Template Injection (Undocumented Parameter)

Part 1: Pentest Report

#ssti #template-injection #format-string #information-disclosure #nodejs #express #bugforge

MesaNet Access Panel: OTP Verify Bypass Chained to SSRF Internal Disclosure

2026.07.14

BugForge hard OTP Bypass + SSRF to Internal Store

Part 1: Pentest Report

#ssrf #broken-access-control #otp-bypass #waf-bypass #url-parser-confusion #bugforge

Cheesy Does It: Single-Use Coupon Reuse via Reorder

2026.07.14

BugForge easy Single-Use Coupon Reuse via Reorder

Part 1: Pentest Report

#bugforge #webapp #business-logic #coupon-reuse #reorder #insecure-design #cwe-841 #cwe-837

CopyPasta: Forgeable Session Tokens Enable Cross-User Impersonation

2026.07.13

BugForge easy Forgeable Session Tokens

Part 1: Pentest Report

#predictable-session #session-forgery #account-takeover #impersonation #broken-access-control #bugforge

analytics

Activity Log

[2026.07.15] New writeup published: Vaultly: Next.js Middleware Authorization Bypass (CVE-2025-29927)

[2026.07.15] New writeup published: Tanuki: XML Entity Smuggling to SQL Injection

[2026.07.14] New writeup published: Shady Oaks Financial: Server-Side Template Injection via Undocumented Parameter

[2026.07.14] New writeup published: MesaNet Access Panel: OTP Verify Bypass Chained to SSRF Internal Disclosure

[2026.07.14] New writeup published: Cheesy Does It: Single-Use Coupon Reuse via Reorder

construction

Toolkit

web v0.3.0

Caido Workbench

SQLi and JWT workbench plugin for Caido proxy.

speed v1.2.0

Race

HTTP/2 single-packet race condition testing.

key v1.0.0

JWTForge

JWT creation, modification, and signing tool.

more_horiz

More Coming

Additional tools in development.