---
title: "security_researcher (@securityresearcher1) | Hashnode"
description: "Security_researcher. Read the latest articles by security_researcher on Hashnode."
url: "https://hashnode.com/@securityresearcher1"
---

@securityresearcher1

# security\_researcher

@securityresearcher1 · La · Joined October 2023

Security\_researcher

### [Breaking Through the Invisible Walls: How JS Recon and Parameter Pollution Exposed Sensitive KYC Data](https://security11.hashnode.dev/breaking-through-the-invisible-walls-how-js-recon-and-parameter-pollution-exposed-sensitive-kyc-data?utm_source=hashnode&utm_medium=feed)

Some of the best vulnerabilities are hidden not in plain sight, but in the dark, forgotten corners of an application. This writeup details the discovery of a logical flaw chain within a project manage

5 min read · [security11.hashnode.dev](https://security11.hashnode.dev/breaking-through-the-invisible-walls-how-js-recon-and-parameter-pollution-exposed-sensitive-kyc-data?utm_source=hashnode&utm_medium=feed)

[Jul 3](https://hashnode.com/posts/breaking-through-the-invisible-walls-how-js-recon-and-parameter-pollution-exposed-sensitive-kyc-data/6a4793115c907b25dcbe33d9)

### [Privilege Escalation to full-admin via Mass Assignment in Team Invitation Flow](https://security11.hashnode.dev/privilege-escalation-to-full-admin-via-mass-assignment-in-team-invitation-flow?utm_source=hashnode&utm_medium=feed)

Prologue – The Temptation It was a rainy Tuesday afternoon, and I had just finished my third cup of coffee. My target for the week was target.com—a sleek, modern team-collaboration platform that promi

8 min read · [security11.hashnode.dev](https://security11.hashnode.dev/privilege-escalation-to-full-admin-via-mass-assignment-in-team-invitation-flow?utm_source=hashnode&utm_medium=feed)

[Jul 2](https://hashnode.com/posts/privilege-escalation-to-full-admin-via-mass-assignment-in-team-invitation-flow/6a4647a8c59471fbd9fba8c1)

### [From SSRF to RCE — Extracting AWS Credentials and Achieving Remote Code Execution](https://security11.hashnode.dev/from-ssrf-to-rce-extracting-aws-credentials-and-achieving-remote-code-execution?utm_source=hashnode&utm_medium=feed)

Summary During testing of an AWS-hosted application, I identified a Server-Side Request Forgery (SSRF) issue in a URL-based feature. The application attempted to fetch user-supplied URLs on the server

5 min read · [security11.hashnode.dev](https://security11.hashnode.dev/from-ssrf-to-rce-extracting-aws-credentials-and-achieving-remote-code-execution?utm_source=hashnode&utm_medium=feed)

[Jun 26](https://hashnode.com/posts/from-ssrf-to-rce-extracting-aws-credentials-and-achieving-remote-code-execution/6a3eca612026ac539218da73)