Eaton Works Feed

Tata’s nexarc platform had a vulnerability where OTPs could be decrypted from API responses, making it easy to take over any account.

VE Commercial Vehicles’ My Eicher platform had a critical vulnerability that let you take over anyone’s account and gain control over their vehicle fleets.

Coal India’s intelligent CCTV platform developed by DeepSight AI Labs and Accenture had plaintext passwords and no API authentication.

Campus Recruiting vulnerability exposed student information, and Audit Tracking Management System vulnerability exposed confidential internal audit data.

The Sri Krishna College of Engineering and Technology (SKCET) in India made elementary mistakes in web app security.

Super admin exploit on Dava India Pharmacy’s website gave complete control over everything.

Exploring security blunders in Bluspark Global’s BLUVOYIX, an ocean logistics / supply chain platform used by hundreds of the world’s largest companies.

Cracking open the rewards admin panel.

Tata Motors gave away the keys to their infrastructure and customer data on their public websites.

On August 10, 2025 at DEF CON 33 in Las Vegas, I presented what could possibly be the biggest vulnerability I may ever discover in the automotive industry.

Industrial generator smart platform had insecure APIs that could enable remote control by anyone.

Hardcoded credentials, pointless encryption, and generous APIs exposed details of every employee and made it possible to break into internal websites.

A series of API flaws in McDelivery India made it possible to order food for a penny, hijack other people’s delivery orders, view user information, and more.

(ASPEN) APIs are crucial for web apps but pose security risks.

(ASPEN) Understanding the Risks of Client-Side Authentication: Why relying on client-side security isn’t enough.

(ASPEN) Mobile device management (MDM) systems are essential for large enterprises to track devices accessing the corporate network and ensure security.

(ASPEN) A critical SSO vulnerability in a Fortune 500 app risked millions of records.

A vulnerable API on Toyota Tsusho Insurance Broker India’s premium calculator website exposed Microsoft corporate cloud credentials.

The story of CVE-2023-6483, my first CVE and biggest security disclosure yet.

API flaw enabled livestreaming of a telecommunications company’s office cameras.

A vulnerable password reset API made it possible to take over any account and gain admin-level access to the platform.

Breaking into a Toyota CRM and exploiting it to view customer information.

Inside an exploit that allowed logging in to Toyota’s GSPIMS application as any user, including system admins.

An Atom feed is now available for the site.

Reverse engineering the kernel-mode authenticity check, and how Microsoft knows about your hacked/custom hard-drive.

The October 2012 Xbox 360 dashboard update moved the dashboard from the nand flash to the hard-drive.

Two vulnerable Jacuzzi SmartTub administration panels exposed worldwide customer data for multiple brands.

A misconfigured staging site exposed several years worth of private Xbox game developer forum content.

The tech stack and decisions behind my new website.

Reporting sensitive content exposure on an MBUSA website to Daimler.

Find it on GitHub!

A deep dive into Pokémon GO’s certificate pinning.

Also: HSTS!

An old, private Xbox 360 development application has been released.

An update to the FATXplorer application has been released.

Disqus now powers comments on this site.

A major update is now available for FATXplorer.

A small and simple Xbox 360 patch viewer/editor.

Welcome to my new homepage!