- CVE-2025-6031 - Amazon Cloud Cam
- What was novel: The original exploitation was done in 2024. I used captured API traffic and an LLM to help reconstruct a backend platform that had been shut down years earlier. I believe this was a new way to compromise end-of-life hardware
- While the device was in pairing mode, you could bypass SSL pinning and connect it to any network. This allowed an attacker to intercept and change its network traffic.
- AWS Security Bulletin AWS-2025-013
- DistrictCon Junkyard presentation
- Multiple Advisories in SAP Products
- CVE-2014-9320
- I found this critical SAP BusinessObjects privilege escalation by fuzzing its native protocol. It allowed a guest user to gain full administrator privileges.
- SAP Advisory 2039905
- Denial of Service XML Expansion (CVE-2014-8080)
- I found this critical denial-of-service vulnerability in core Ruby. Because the vulnerable feature was enabled by default, an unauthenticated remote attacker could crash any Rails installation. I did not publicize its severity at the time.
- CVE-2014-5265, CVE-2014-5266, CVE-2014-5267
- I found the original XML-RPC denial-of-service exploit. It affected all versions of Drupal and WordPress.
- SAP HANA Web-based Development Workbench Code Injection (SAP Advisory 2015446)
- Unauthenticated Username Enumeration in Business Objects (SAP Advisory 2001109)
- Unauthenticated Remote Crash of Business Objects (CVE-2014-8310)
- I found this unauthenticated remote crash by fuzzing the native SAP BusinessObjects protocol.
- SAP Advisory 2001106
- Information Disclosure in Business Objects (CVE-2014-8311)
- SAP Advisory 1998990
- XSS in Business Objects (CVE-2014-8308)
- SAP Advisory 1941562
- Multiple XSS in SAP HANA (CVE-2014-8314)
- SAP Advisory 2009696
- Multiple XSS in SAP HANA (CVE-2014-5172)
- SAP Advisory 1993349
- Multiple XSS in SAP BO (CVE-2014-3134)
- SAP Advisory 1931399
- Multiple Advisories in SAP Products
- CVE-2010-0219
- Although classified as a default-password issue, the vulnerable application shipped with many products and allowed straightforward remote code execution out of the box. I also created a Metasploit module for it.
- SAP Advisory 1432881
- FCKEditor.NET File Upload Code Execution
Selected Bug Bounties
I have had a mixed experience with bug bounties. I think in total I have received a bounty or Hall of Fame from 40+ companies; not a ton but enough to see some of the good and bad. Below are some programs I really enjoyed participating with.
Top 50 hacker at one point.
- I had enough bugs to get MVP 2019 as well, but one of the programs unfairly gave me a negative rating which dropped me below the threshold
- I had a limited number of bounties with Mozilla but at one point I held the record for highest payout on a single bounty. It allowed a guest to access admin credentials through a desync attack.
- I had a handful of critical bugs in hardware including remote code execution but the details are unfortunately private.