Full Account Takeover on an MCP OAuth Proxy: Why PKCE Can't Save YouTL;DR: Got an MCP OAuth proxy to hand me real production access tokens for any user who clicked one link. No fake login page. No cert warning. No MFA bypass. The victim actually signs in at the real S8 min read·hackt.us3Apr 21
From Tomcat JMX Proxy to RCE via AccessLogValve InjectionDisclaimer: This research is published for educational and authorized security testing purposes only. The techniques described here should only be used against systems you own or have explicit written permission to test. The author is not responsible...18 min read·hackt.us101Apr 14
How I Tricked an AI Into Thinking I Owned Your DataIn this blog post, I'll walk you through one of the most unusual and creative bugs I've ever found. This isn't your typical IDOR or privilege escalation. This is a story about how an AI agent, designed to protect data, became the very thing that leak...8 min read·hackt.usFeb 7
What Can You Do With a Leaked Cognito Identity Pool ID?Discover risks of leaked AWS Cognito Identity Pool IDs and misconfigured IAM policies causing severe security vulnerabilities3 min read·hackt.usJan 23
Can you compromise a multi-billion dollar company via /health?Discover how a seemingly innocuous `/health` endpoint leak led to exposing a multi-billion dollar company's entire cloud infrastructure4 min read·hackt.us1ADec 21, 2025
