Just published a new write-up where I walk through how a small HTTP method misconfiguration led to admin credentials being exposed.

It's a simple but impactful example of why misconfigurations matter.

📖 Read it here: https://is4curity.medium.com/admin-emails-passwords-exposed-via-http-method-change-da23186f37d3

Let me know what you think — and feel free to share similar cases!

#bugbounty #infosec #pentest #writeup #websecurity

Hey folks,

Just published a write-up where I turned a blind XSS into Remote Code Execution , and the final step?

Injecting commands via Accept-Language header, parsed by a vulnerable PHP script.

No logs. No alert. Just clean shell access.

Would love to hear your thoughts or similar techniques you've seen!

🧠🛡️

https://is4curity.medium.com/from-blind-xss-to-rce-when-headers-became-my-terminal-d137d2c808a3

I recently tested a language-learning site that used live frontend filtering to block HTML input (e.g., <img> <svg> tags were removed as you typed).

But by injecting the payload directly via browser console (without typing it), the input was submitted and stored.

Surprisingly, the XSS executed later on my own profile page — indicating stored execution from a DOM-based bypass.

I wrote a short write-up here:

https://is4curity.medium.com/xss-before-submit-a-dom-based-execution-flaw-hidden-in-plain-sight-5633bdd686c9

enjoy