My step-by-step solution for Intigriti's September 2026 challenge, including the confirmed bug and the extra vulnerability chains I tested.

Intigriti September 2026 Challenge Writeup

How I used weak channel validation and a JSONP CSP bypass to get blind stored XSS in Intigriti's August 2026 challenge and open hidden Channel 11.

Intigriti August 2026 XSS Challenge Writeup

How I used a CSRF bug in Intigriti's Leaky Jar bonus challenge to make the Master Baker share the admin vault and reveal the flag.

Intigriti June Bonus Challenge: Leaky Jar Writeup

How I leaked the admin bot's private note in Intigriti's June 2026 challenge by abusing CSP reports, dangling markup, CORS, and SameSite=None cookies.

Intigriti June 2026 XSS Challenge Writeup

How I solved Intigriti's May 2026 XSS challenge with a stored XSS in the display name, and the small payload I used to get around the SCA Shield filter.

Intigriti May 2026 XSS Challenge Writeup

How I Found a Free GPT Proxy in a Bug Bounty Program

How a single 10 MB gossipsub frame can force a node to allocate ~21 MB of message IDs before any cap kicks in, and the fix I sent to sigp/rust-libp2p that ended up upstream in libp2p/rust-libp2p.

A Memory Amplification Bug in Sigma Prime's rust-libp2p (used by Lighthouse)

How I chained four separate weaknesses in Intigriti's April 2026 challenge to steal the reviewer bot's cookie and capture the flag via stored XSS.

Intigriti April 2026 XSS Challenge Writeup

A practical incident response playbook for Vercel customers following the April 2026 breach. What happened, what's confirmed, and exactly what to do phase by phase.

Vercel Got Breached. Here's What You Should Do Right Now.

How I found two critical vulnerabilities in a crypto AI trading platform and everything I learned about hacking AI agents along the way.

AI Agents Think. They Just Don't Know They're Being Watched.

Hedera Hashgraph CTF Writeup

Outbound HacktheBox Writeup

DeepSeek AI in Chat Unveils the Risks of Prompt Injection to Account Takeover

Full walkthrough of Halborn's Offensive Security Engineer technical assessment VM — from initial recon to two captured flags via weak session tokens, SSTI, and a Puppeteer-powered SSRF.

Halborn Technical Assessment – Offensive Security Engineer VM Walkthrough

Verified public acknowledgments and CVE credits attributed to Adesh Nandkishor Kolte across Microsoft, Apple, Google, AT&T, HostBill, and others. Every entry links to a live source.