hacktus.techHow I Tricked an AI Into Thinking I Owned Your DataIn this blog post, I'll walk you through one of the most unusual and creative bugs I've ever found. This isn't your typical IDOR or privilege escalation. This is a story about how an AI agent, designed to protect data, became the very thing that leak...Feb 7路8 min read
hacktus.techWhat Can You Do With a Leaked Cognito Identity Pool ID?Leaking a Cognito Identity Pool ID is often dismissed as a low-impact information disclosure. But when the IAM policy attached to the unauthenticated role is misconfigured, that "low-impact" leak becomes a direct path into the cloud infrastructure. W...Jan 23路3 min read
hacktus.techCan you compromise a multi-billion dollar company via /health?We all have those endpoints we instantly ignore in our HTTP history. You see GET /favicon.ico, you ignore it. You see GET /assets/logo.png, you ignore it. And usually, when you see GET /health, you ignore that too. Why? Because 99.9% of the time, the...Dec 21, 2025路4 min read
hacktus.techHow a "Fixed" IDOR and an Empty String Led to 5 Million+ File LeaksWhen I start looking at a target in finance, medical, etc, I always go for the most valuable data. In this case, on a major application we'll call "Redacted Corp," that meant file uploads. Invoices, personal documents, signatures... all the PII. Part...Oct 29, 2025路6 min read
hacktus.techMore of Games-related Bugs!Exploring Chests or Boxes: Unraveling the Secrets 馃幉 In the digital realm of gaming, chests and boxes are akin to Pandora's Box, each unveiling unique rewards and surprises. For instance, you're generally allowed to open a 'Golden Box', but what if, ...Apr 12, 2024路3 min read
