Rajat Raghav Senior Content Engineer / Hack The Box 8 posters / 2024—2026 me@xclow3n.com

XCLOW3N

  1. 09 RESEARCH Featured

    The Validator Can Lie: SSRF Beyond URL Validation

    A URL validator can approve one representation while the client sends another. This audit covers thirteen language stacks, twelve bug families, and product cases including changedetection.io reaching IMDS, GitLab discarding its DNS pin, and Mealie approving A while the fetcher dialled AAAA.

    • 13 stacks
    • 12 families
    • 1,855 verdicts
    • wire-confirmed
    • SSRF
    • URL Parsing
    • Parser Differential
    • HTTP/2
    • DNS

    SSRF → 08

  2. 08 RESEARCH

    The URL Parser Cheatsheet

    A pinned comparison of fourteen URL parsers, fifteen bug families indexed by pipeline stage, and a differential oracle covering sixteen validators and five clients across eight languages. Includes 1855 wire-backed verdicts, unchecked cells, and mechanisms that did not reach a shipped product.

    • 15 families
    • 1,855 verdicts
    • 8 languages
    • 16 validators x 5 clients
    • SSRF
    • URL Parsing
    • Parser Differential
    • HTTP/2
    • DNS
    • Tooling

    SSRF → 09

  3. 07 RESEARCH

    Testing AI for Vulnerability Research: 4 Approaches & Where I Failed

    Results from testing four AI-assisted vulnerability-research workflows over one week, including 14 confirmed bugs in one target and one approach that produced no reportable findings.

    • 4 approaches
    • 14 confirmed vulns
    • 20 minutes
    • 1 week
    • AI
    • Vulnerability Research
    • SAML
    • HTTP Smuggling
    • Security

    HTTP Smuggling → 06

  4. 06 RESEARCH

    Breaking Pingora: HTTP Request Smuggling & Cache Poisoning in Cloudflare's Reverse Proxy

    Three HTTP request-smuggling bugs and one cache-poisoning vulnerability in Cloudflare's Pingora reverse proxy, including root causes, proofs of concept, fixes, and disclosure notes.

    • 3 CVEs
    • $5,000 bounty
    • 98 days to disclosure
    • CVE-2026-2835
    • HTTP Smuggling
    • Cache Poisoning
    • Cloudflare
    • Pingora
    • CVE

    HTTP Smuggling → 07

  5. 05 RESEARCH

    HTML Sanitize Bypass Using MXSS

    Discovering how Mutation XSS (MXSS) can bypass the sanitize-html library due to differences between htmlparser2 and browser HTML parsers, allowing XSS attacks through style and math elements.

    • htmlparser2 vs browser
    • style + math
    • Security Research
    • MXSS
    • XSS
    • HTML Sanitization
    • htmlparser2

    Security Research → 04MXSS → 03XSS → 02

  6. 04 RESEARCH

    Email Parser Discrepancy in Nodemailer

    Discovering two email parsing issues in Nodemailer that could lead to email misrouting. The first was patched in v6.9.16, and the second was finally patched in v7.0.7 after I reported it as a security advisory.

    • 2 bugs
    • v6.9.16 + v7.0.7
    • GHSA-mm7p-fcc7-pg87
    • Security Research
    • Nodemailer
    • Email Parser
    • RFC 5322
    • GHSA-mm7p-fcc7-pg87

    Security Research → 05Nodemailer → 03

  7. 03 MY CHALLENGES

    Intergalactic Bounty: HTB University CTF 2024

    Exploiting Nodemailer parser discrepancies, bypassing HTML sanitization with MXSS, and achieving RCE through prototype pollution file overwrite in this HTB University CTF 2024 challenge.

    • MXSS → RCE
    • prototype pollution
    • CTF
    • Web
    • Nodemailer
    • MXSS
    • Prototype Pollution
    • RCE

    MXSS → 05Nodemailer → 04CTF → 02

  8. 02 MY CHALLENGES

    EncoDecept: HTB University CTF 2024

    Intended solution for EncoDecept challenge from Hack the Box University CTF 2024 involving Web Cache Deception, encoding differential attacks, and ORM leak exploitation.

    • web cache deception
    • ORM leak
    • CTF
    • Web
    • Cache Deception
    • XSS
    • ORM Leak
    • Rails

    XSS → 05CTF → 03