Critical · Published
How to pwn a website and take over any account
How a broken password-reset flow exposed recovery secrets to unauthenticated users and turned account recovery into a complete account-takeover primitive.
INDEPENDENT SECURITY RESEARCH
Finding the cracks
between trust boundaries.
Android, mobile applications, WebViews, deep links, native bridges, web applications, APIs, reverse engineering, and reproducible PoCs.
01Android / Mobile
WebViews, deep links, native bridges and client-side attack surfaces.
02Web / API
Endpoints, authentication, authorization and application trust boundaries.
03Proof over theory
Practical research with clean, reproducible proof-of-concepts.
FEATURED RESEARCH
BlueHammer: From Zero-Day PoC to Weaponized Malware
We found BlueHammer exploit logic inside a malware sample — another sign that CVE-2026-33825 had moved from public research into real-world offensive tooling.
Read the research ↗LIVE RESEARCH STATUSPUBLIC UPDATES
LOADING
Checking the latest public update.
CONNECTING
PROJECT—
AREA—
FOCUS
RECENT ACTIVITY
FIELD NOTES
Latest write-ups
RESEARCH
Notes & articles
BlueHammer: From Zero-Day PoC to Weaponized Malware
We found BlueHammer exploit logic inside a malware sample — another sign that CVE-2026-33825 had moved from public research into real-world offensive tooling.
WebView ↔ Native Bridges: where trust boundaries get interesting
A short field note on why WebView-to-native interfaces deserve careful threat modeling.
RESEARCH LOG
From the notebook.
Follow the research.
New write-ups, articles and notes in your feed reader.
$ whoami
womp — independent security researcher
$ focus --current
android · webviews · api · reverse-engineering · web
$ methodology
"practical research + reproducible PoCs"