--- title: "Hacktus (@Hacktus) | Hashnode" description: "I hunt for bugs and cacti sometimes :). Read the latest articles by Hacktus on Hashnode." url: "https://hashnode.com/@Hacktus" --- @Hacktus # Hacktus @Hacktus · Joined January 2023 I hunt for bugs and cacti sometimes :) [Website](https://hackerone.com/hacktus) ### [Full Account Takeover on an MCP OAuth Proxy: Why PKCE Can't Save You](https://hackt.us/full-account-takeover-on-an-mcp-oauth-proxy-why-pkce-can-t-save-you?utm_source=hashnode&utm_medium=feed) TL;DR: Got an MCP OAuth proxy to hand me real production access tokens for any user who clicked one link. No fake login page. No cert warning. No MFA bypass. The victim actually signs in at the real S 8 min read · [hackt.us](https://hackt.us/full-account-takeover-on-an-mcp-oauth-proxy-why-pkce-can-t-save-you?utm_source=hashnode&utm_medium=feed) [Apr 21](https://hashnode.com/posts/full-account-takeover-on-an-mcp-oauth-proxy-why-pkce-can-t-save-you/69e76319e43672781428a36e) ### [From Tomcat JMX Proxy to RCE via AccessLogValve Injection](https://hackt.us/from-tomcat-jmx-proxy-to-rce-via-accesslogvalve-injection?utm_source=hashnode&utm_medium=feed) Disclaimer: This research is published for educational and authorized security testing purposes only. The techniques described here should only be used against systems you own or have explicit written permission to test. The author is not responsible... 18 min read · [hackt.us](https://hackt.us/from-tomcat-jmx-proxy-to-rce-via-accesslogvalve-injection?utm_source=hashnode&utm_medium=feed) [1](https://hashnode.com/posts/from-tomcat-jmx-proxy-to-rce-via-accesslogvalve-injection/69de6e9a91716f3cfb565f07) [Apr 14](https://hashnode.com/posts/from-tomcat-jmx-proxy-to-rce-via-accesslogvalve-injection/69de6e9a91716f3cfb565f07) ### [How I Tricked an AI Into Thinking I Owned Your Data](https://hackt.us/how-i-tricked-an-ai-into-thinking-i-owned-your-data?utm_source=hashnode&utm_medium=feed) In this blog post, I'll walk you through one of the most unusual and creative bugs I've ever found. This isn't your typical IDOR or privilege escalation. This is a story about how an AI agent, designed to protect data, became the very thing that leak... 8 min read · [hackt.us](https://hackt.us/how-i-tricked-an-ai-into-thinking-i-owned-your-data?utm_source=hashnode&utm_medium=feed) [Feb 7](https://hashnode.com/posts/how-i-tricked-an-ai-into-thinking-i-owned-your-data/69875fdded5ad9cfe9f62f4c) ### [What Can You Do With a Leaked Cognito Identity Pool ID?](https://hackt.us/what-can-you-do-with-a-leaked-cognito-identity-pool-id?utm_source=hashnode&utm_medium=feed) Discover risks of leaked AWS Cognito Identity Pool IDs and misconfigured IAM policies causing severe security vulnerabilities 3 min read · [hackt.us](https://hackt.us/what-can-you-do-with-a-leaked-cognito-identity-pool-id?utm_source=hashnode&utm_medium=feed) [Jan 23](https://hashnode.com/posts/what-can-you-do-with-a-leaked-cognito-identity-pool-id/69737d2933399ec8f3ff48fd) ### [Can you compromise a multi-billion dollar company via /health?](https://hackt.us/can-you-compromise-a-multi-billion-dollar-company-via-health?utm_source=hashnode&utm_medium=feed) Discover how a seemingly innocuous \`/health\` endpoint leak led to exposing a multi-billion dollar company's entire cloud infrastructure 4 min read · [hackt.us](https://hackt.us/can-you-compromise-a-multi-billion-dollar-company-via-health?utm_source=hashnode&utm_medium=feed) [1](https://hashnode.com/posts/can-you-compromise-a-multi-billion-dollar-company-via-health/6947e3c8505c0d43dc7b1ffd) [Dec 21, 2025](https://hashnode.com/posts/can-you-compromise-a-multi-billion-dollar-company-via-health/6947e3c8505c0d43dc7b1ffd)