Nehals LimitedMultiple XSS Bugs: Real-World Lessons & Fixes
Reflected and stored XSS found in a real web app — the risk, business impact, and the secure fixes teams should apply.
Read on Medium →Blog
Security research & write-ups
Real-world vulnerability write-ups from authorised testing and responsible disclosure — what was found, the business impact, and how to fix it.
HTML Injection: Risks, Lessons & Hidden Cost
Two HTML injection vulnerabilities discovered in AT&T's website URL parameters, the business impact, and how to prevent them.
Read on Medium →XSS: A Direct Hit to Brand Trust — Revenue, Reputation, Users
A reflected XSS found in BlackBerry's website, its business risk, and the defensive controls that shut it down.
Read on Medium →Open Redirects: The Little Link That Could Destroy Your Reputation
How an open-redirect flaw fuels phishing and brand damage — and how to stop it with validation and allowlists.
Read on Medium →Published research
Penetration Testing for the Cloud-Based Web Application
Peer-reviewed book chapter on methodology for penetration testing cloud-hosted web applications.
Read on Springer →CTF & lab profile
Ongoing hands-on practice in reconnaissance, exploitation and attack simulation through Hack The Box challenges.
View profile →Bug bounty profile
Responsibly disclosed vulnerabilities through bug bounty programs on Bugcrowd and HackerOne.
View profile →