Blog

Fuzzing for Exposed Origin Hosts

Tue, 08 Apr 2025 14:55:06 -0700

Intro

After spending a lot of time staring at this page, I was a little tired of seeing it.

Over the past few months, I’ve developed a testing methodology for discovering origin hosts.
I originally thought that this methodology was just a WAF bypass. However, in the six months it took me to write this up, I’ve used origin host discovery to find applications with unlisted DNS addresses, to access restricted application paths, and to perform server-side attacks with absolutely no rate limits or content filtering. Since this is a methodology and not a direct vulnerability, the potential uses are limited only by your imagination.

Cert unpinning with Frida

Sun, 22 Sep 2024 20:45:56 -0700

This guide will enable you to unpin android applications, and forward traffic to a local proxy (i.e. Burp/Caido/Zap) running on port :8080 on your local machine.

References:
https://gist.github.com/teknogeek/4dc35fb3801bd7f13e5f0da5b784c725
https://gitlab.com/newbit/rootAVD
https://github.com/frida/frida/releases

Prerequisites

You should be running an emulated device with Play Store enabled.
You have a rooted device and adb working. If you do not already, follow instructions on https://gitlab.com/newbit/rootAVD

Modern versions of android require you to use the “FAKEBOOTIMG” option with rootAVD. More info can be found at the link above. You may need to do a clean boot during the setup like so: emulator @device_name -no-snapshot-load

Hi there! 👋

Mon, 01 Jan 0001 00:00:00 +0000

I go by Syndrome Impostor. I am a full-time bug bounty hunter and security researcher specializing in OAuth and OIDC implementations.

My handle was given to me by two very close friends. I carry it as a reminder that nearly everyone in this industry experiences impostor syndrome, and we all have something valuable to contribute.

🎯 Technical Focus

I focus on finding vulnerabilities at the intersection of different technologies, specifically:

Published CVEs

Mon, 01 Jan 0001 00:00:00 +0000

CVE-2026-27733 Medium 4.3

Authorization bypass via MCP endpoint

CVE-2026-27716 Medium 4.3

Information disclosure on OpenProject through /api/v3/custom_fields/{id}/items

CVE-2026-26968 Medium 4.3

Improper Access Control on OpenProject instance through /api/v3/capabilities

CVE-2026-24775 High 8.9

Forced Actions, Content Spoofing, and Persistent DoS via ID Manipulation in OpenProject Blocknote Editor Extension

CVE-2026-24772 Medium 6.3

SSRF and CSWSH in Hocuspocus Synchronization Server

CVE-2026-23646 Medium 6.5

Users can delete other user's session, causing them to be logged out

CVE-2026-22600 Critical 9.1

Arbitrary File Read via ImageMagick SVG Coder