root@anand

what_i_do

write_ups

• cloudflare workers and d1 as a stealthy command & control framework for data exfiltration
  march 2025
• remote code execution via dependency confusion
  march 2024
• abusing graphql idor to delete another user's profile picture
  july 2022
• blind ssrf via dns rebinding
  april 2022

tools

• knockknock: bash script that automates ip/host filtering using http status codes. [github]
• chromeshot: a headless chrome-powered tool for visual recon. [github]

miscellaneous

• first prize winners of c0c0n 2024 ctf competition [news link]
• delivered a talk at defcon dc0471 meetup 0x02 [event photos]

mail