whoami
I'm a cybersecurity student who learns by breaking things.
Mostly security, and once in a while some development.
I write writeups, run experiments and stay curious about
how systems work, and more importantly, how they break.
And I love turning all of it into content you can learn from.
Latest videos
All videos
Latest posts
All posts
Bug Reports
Reflected XSS on a News Site: How One URL Ran My JavaScript
I changed one thing in the address bar of a news website, and the site ran my JavaScript. This is a real reflected XSS, explained step by step: how input is reflected into an HTML attribute, how an autofocus/onfocus breakout fires code on page load, why a slash filter completely missed it, and the fix that actually works.
Research
NotPetya: The $10 Billion Cyberattack Disguised as Ransomware
On 27 June 2017, a routine software update in Ukraine unleashed NotPetya — malware that looked like ransomware but was built to destroy. It spread worldwide, caused over $10 billion in damage, and was later attributed to Russia's GRU. Here is how it worked, and why it still matters.
Bug Reports
Account Takeover via Password Reset: Resetting Any User's Password
Forgot your password? So did I, and I used it to reset someone else's, silently, with no OTP and no notification sent to them. This is a real account-takeover bug in a university portal's reset flow, and the one architectural fix that closes it.