OBSERVE // QUESTION // RESEARCH

Research beyond the obvious

Technical notes, vulnerability research, reverse engineering and offensive security.

LATEST RESEARCH MEET HAKAI SECURITY

PERCEPTION // BEYOND THE OBVIOUS

LATEST SIGNAL

VIEW ARCHIVE

Client-Side Path Traversal in the Wild: From Stored XSS to Account Deletion

NEW RESEARCH 15 Oct 2026

Research Blog

Client-Side Path Traversal in the Wild: From Stored XSS to Account Deletion

Two CSPT chains discovered in production bug bounty targets and the thought process behind turning a frontend URL quirk into real impact. Table of contents * Introduction * Background: anatomy of a CSPT * Finding 1 — CSPT to Stored XSS and

BY Pedro Cruz "gankd" 11 MIN READ

↗

Client-Side Path Traversal na Prática: De Stored XSS à Exclusão de Conta

NEW RESEARCH 15 Oct 2026

Research Blog

Client-Side Path Traversal na Prática: De Stored XSS à Exclusão de Conta

Duas cadeias de CSPT descobertas em alvos reais de bug bounty em produção e o raciocínio por trás de transformar uma peculiaridade de URL no frontend em impacto real. Sumário * Introdução * Contexto: anatomia de um CSPT * Descoberta 1

BY Pedro Cruz "gankd" 12 MIN READ

↗

RESEARCH AREAS

CLASSIFICATION MATRIX

Insights Blog

19 ENTRIES

↗ 02

Research Blog

67 ENTRIES

↗ 03

White paper

1 ENTRY

↗

LATEST RESEARCH

FIELD NOTES / REPORTS

Research Blog 15.10.26

Client-Side Path Traversal in the Wild: From Stored XSS to Account Deletion

Two CSPT chains discovered in production bug bounty targets and the thought process behind turning a frontend URL quirk into real impact. Table of

pt-br 01.10.26

[Pt-Br] Por Trás do Espelho: Investigando Vulnerabilidades no MagicMirror² (CVE-2026-63642, CVE-2026-63643)

Durante uma análise do código-fonte do MagicMirror², uma plataforma open source utilizada para transformar um espelho semitransparente em um display inteligente, o time

en 01.10.26

[EN] Behind the Mirror: Investigating Vulnerabilities in MagicMirror² (CVE-2026-63642, CVE-2026-63643)

During an analysis of the source code of MagicMirror², an open-source platform used to turn a semi-transparent mirror into a smart display,

pt-br 25.09.26

[PT-BR] CVE-2026-16764: Uma validação faltando, acesso total

O OWASP DefectDojo é uma plataforma open-source de gerenciamento de vulnerabilidades amplamente utilizada por equipes de segurança para centralizar, rastrear e priorizar findings

en 25.09.26

[EN] CVE-2026-16764: Missing validation, full access

OWASP DefectDojo is an open-source vulnerability management platform widely used by security teams to centralize, track, and prioritize findings from various scanning tools.