INDEPENDENT SECURITY RESEARCH

Finding the cracks
between trust boundaries.

Android, mobile applications, WebViews, deep links, native bridges, web applications, APIs, reverse engineering, and reproducible PoCs.

Read write-ups About me

01Android / Mobile

WebViews, deep links, native bridges and client-side attack surfaces.

02Web / API

Endpoints, authentication, authorization and application trust boundaries.

03Proof over theory

Practical research with clean, reproducible proof-of-concepts.

TARGETNo active research

AREACurrently offline

FOCUS

No active focus

FIELD NOTES

Latest write-ups

View all →

Critical · Published20 Aug 2026

How to pwn a website and take over any account

How a broken password-reset flow exposed recovery secrets to unauthenticated users and turned account recovery into a complete account-takeover primitive.

WebAPIAuthenticationAccount TakeoverPassword ResetInformation Disclosure

High · Published19 Aug 2026

Cross-Session Session Leakage Through Cached Next.js Responses

How a shared CloudFront cache exposed an HttpOnly session credential embedded in server-rendered Next.js responses.

WebNext.jsCloudFrontSession ManagementCDNInformation Disclosure

RESEARCH

Notes & articles

View all →

24 Aug 2026

BlueHammer: From Zero-Day PoC to Weaponized Malware

We found BlueHammer exploit logic inside a malware sample — another sign that CVE-2026-33825 had moved from public research into real-world offensive tooling.

MalwareWindowsBlueHammerCVE-2026-33825Zero-DayPrivilege EscalationThreat Research

19 Aug 2026

WebView ↔ Native Bridges: where trust boundaries get interesting

A short field note on why WebView-to-native interfaces deserve careful threat modeling.

AndroidWebViewMobileResearch

research@womp:~

$ whoami
womp — independent security researcher

$ focus --current
android · webviews · api · reverse-engineering · web

$ methodology
"practical research + reproducible PoCs"