Full Account Takeover on an MCP OAuth Proxy: Why PKCE Can't Save YouTL;DR: Got an MCP OAuth proxy to hand me real production access tokens for any user who clicked one link. No fake login page. No cert warning. No MFA bypass. The victim actually signs in at the real S3Apr 21 · 8 min readhackt.us
From Tomcat JMX Proxy to RCE via AccessLogValve InjectionDisclaimer: This research is published for educational and authorized security testing purposes only. The techniques described here should only be used against systems you own or have explicit written permission to test. The author is not responsible...101Apr 14 · 18 min readhackt.us
How I Tricked an AI Into Thinking I Owned Your DataIn this blog post, I'll walk you through one of the most unusual and creative bugs I've ever found. This isn't your typical IDOR or privilege escalation. This is a story about how an AI agent, designed to protect data, became the very thing that leak...Feb 7 · 8 min readhackt.us
What Can You Do With a Leaked Cognito Identity Pool ID?Leaking a Cognito Identity Pool ID is often dismissed as a low-impact information disclosure. But when the IAM policy attached to the unauthenticated role is misconfigured, that "low-impact" leak becomes a direct path into the cloud infrastructure. W...Jan 23 · 3 min readhackt.us
Can you compromise a multi-billion dollar company via /health?We all have those endpoints we instantly ignore in our HTTP history. You see GET /favicon.ico, you ignore it. You see GET /assets/logo.png, you ignore it. And usually, when you see GET /health, you ignore that too. Why? Because 99.9% of the time, the...1ADec 21, 2025 · 4 min readhackt.us
