$ whoami
$ cat role.txt
Security enthusiast
$ cat focus.txt
I've always been curious about how systems work and what happens when they break. That's what got me into security. These days, I spend my free time solving challenges, doing bug bounty, and digging through source code to see what I can find. Every now and then, that turns into a vulnerability disclosure. Most of the time, it's just a good way to keep learning and getting better.
cat about.md
I work on web security: application and API bugs, authentication logic, and the request-handling code that sits in front of everything else. Lately that has meant the servers AI agents talk to, where the same old mistakes keep showing up in new places.
Most of my published work started the same way. Read how something was built, notice an assumption that does not hold, then check whether it actually matters.
I learned this through CTFs rather than coursework. Several hundred challenges across web exploitation, boot2root machines and crypto, all written up as I went.
cat experience.log
cat education.log
ls -la ./cves
50 published CVEs, disclosed through GitHub Security Advisories. Each entry links to its advisory and the fixed version; technical writeups are added as each disclosure clears.
brandsystem-mcp's anti-SSRF guard only checks a few hardcoded IPv6 prefixes and never recognizes IPv4-mapped literals, so writing a blocked address as ::ffff:a.b.c.d reaches loopback, RFC1918 and cloud metadata endpoints.
basic-memory's HTTP/SSE MCP transport has no authentication and no Host/Origin validation, so the documented bind-to-localhost mitigation does not help: a malicious web page can reach the server through DNS rebinding and search, read and delete the user's notes.
dbmcp's http subcommand serves MCP with no caller authentication, relying only on Host/Origin allowlists that a direct (non-browser) client can satisfy by setting the headers itself, so any network peer can query the database with dbmcp's credentials, and write to it when write mode is enabled.
Six of rsigma-mcp's eight path-accepting tools resolve paths without honoring --rules-dir for absolute paths or collapsing ../ in relative ones, so any MCP caller can read any file the server user can read, and fix_rules with write: true can modify out-of-tree files in place.
orion-cli mcp serve --http disables the MCP SDK's default Host/Origin allowlist and adds no auth middleware of its own, while binding 0.0.0.0:8081 by default, so a DNS-rebound browser can reach the endpoint and call any of the 32 administrative tools (workflow/channel/connector CRUD, data injection, DLQ purge, engine reload) with no credential, under whatever backend admin API key the operator configured.
The mastyf.ai dashboard enforces authentication on its HTTP API, but the MCP bridge route is mounted ahead of that gate, so any caller can execute tools against every connected MCP server without credentials. The Fleet Hub local ingress exposes the same unauthenticated tool access through DNS rebinding.
cat bounty.txt
Microsoft Security Response Center (MSRC) vulnerability research. (2026)
Israeli National Cyber Directorate - Vulnerability Disclosure Program (VDP) vulnerability research.
cat publications.bib
Hands-on walkthrough of a mobile app assessment, from a Genymotion and Burp Suite lab to a chain of Broken Access Control and IDOR flaws in an Israeli delivery app's white-label backend: address theft, credit-card token theft and full PII exposure. Written in Hebrew.
Analysis of GraphQL injection vectors: how introspection and resolver mishandling create exploitable paths, the attack chains that follow, and the real-world weaknesses behind them.
Two CVEs in jupyter-mcp-server chain into a zero-click hijack of any live Jupyter notebook connection.
Chaining a filename and a DNS record to take over CircleCI's MCP server.
cat speaking.log
Open redirects taken from a CTF warm-up to real phishing: JBL / HARMAN, where the fix fell to the @ trick, and Haaretz three times over, including a redirect that sends phishing from their own mail servers.
DNS rebinding across the MCP ecosystem - 50+ CVEs and advisories. A CircleCI MCP server taken from a web page to RCE, Docker Hub credentials abused through the browser, and one unsafe Go SDK default that spread to many servers.
ls -la ./projects
Research framework for turning MCP DNS rebinding into a live attack lab. Scans local MCP servers from a Chrome extension, drives a real DNS rebinding attack through your own VM and DNS zone, captures the MCP session, and operates it from a token-protected dashboard.
Academic project implementing time side-channel attacks: password-verification timing, defeating artificial random delays with statistics, and ECDSA key extraction. Runs against ESP32 and Arduino hardware, with a written report.
A Docker-based lab for standing up WordPress with arbitrary plugin sets and versions, so vulnerability research can be reproduced locally against a target you control.
Writeups across HackTheBox, TryHackMe, OverTheWire, root-me, webhacking.kr, pwnable.kr and more, published as a Jekyll site with its own search.
A CTF challenge authored during the third year of my BSc, covering network security and exploitation.
Telegram bot that translates and forwards messages between channels.
./contact.sh
Open to vulnerability research roles, collaboration and disclosure coordination.
