Abhi HackZ — Security Research & Writeups

Abhi HackZ — Security Research & Writeups https://abhihackz.com/blog/ CVE research, bug bounty, API, web, AI-agent and mobile security writeups by Abhishek Bhaskar (Abhi HackZ). en Tue, 27 Oct 2026 12:53:29 +0000 Four CVEs in Progress Software Products: Command Injection, SSRF and Chart-Tooltip XSS https://abhihackz.com/blog/progress-software-cves-2026 https://abhihackz.com/blog/progress-software-cves-2026 Wed, 14 Oct 2026 00:00:00 +0000 CVE What CVE-2026-91140, CVE-2026-92931, CVE-2026-106138 and CVE-2026-106139 are, how each bug class works, how the vendor fixed them and what your team should check. From a Bugcrowd VDP Report to a Published CVE: How Coordinated Disclosure Actually Works https://abhihackz.com/blog/vdp-to-cve-disclosure-process https://abhihackz.com/blog/vdp-to-cve-disclosure-process Tue, 13 Oct 2026 00:00:00 +0000 CVE The full path from finding a bug in a vendor's product to a CVE record with your name on it — VDP submission, triage, CNA assignment, advisories and what to put in the report. Testing AI Agents and MCP Servers: A Practical Prompt-Injection Playbook https://abhihackz.com/blog/ai-agent-mcp-security-testing https://abhihackz.com/blog/ai-agent-mcp-security-testing Mon, 12 Oct 2026 00:00:00 +0000 AI Tool-calling agents and MCP integrations turn every document, web page and ticket into an attack surface. Here is how I test them — threat model, payload classes, proof of impact and fixes. BOLA, Mass Assignment and the API Bugs That Still Pay in 2026 https://abhihackz.com/blog/api-security-bola-2026 https://abhihackz.com/blog/api-security-bola-2026 Sun, 11 Oct 2026 00:00:00 +0000 API The OWASP API Top 10 hasn't changed, but the apps have. How I test object-level and function-level authorization, property-level exposure and GraphQL in modern APIs. Framework-Level Bugs: Middleware Bypasses, SSR Fetches and the SSRF Hiding in Your Renderer https://abhihackz.com/blog/web-framework-ssr-ssrf https://abhihackz.com/blog/web-framework-ssr-ssrf Sat, 10 Oct 2026 00:00:00 +0000 Web Modern web stacks move logic into frameworks, SDKs and renderers — and so do the vulnerabilities. How to test Next.js-style middleware, server-side fetchers and headless-CMS renderers. Android App Pentesting in 2026: MASVS-Aligned Method, Frida Workflow and the Findings That Matter https://abhihackz.com/blog/android-pentesting-2026 https://abhihackz.com/blog/android-pentesting-2026 Fri, 09 Oct 2026 00:00:00 +0000 Mobile A repeatable Android methodology — static review, dynamic instrumentation, network and storage checks — mapped to OWASP MASVS v2, with the bug classes that keep showing up in fintech and consumer apps. Building a Recon Pipeline That Scales: From ASN to Live Attack Surface (With AI Where It Helps) https://abhihackz.com/blog/recon-pipeline-2026 https://abhihackz.com/blog/recon-pipeline-2026 Thu, 08 Oct 2026 00:00:00 +0000 Recon The four-stage recon system behind my bug-bounty and VAPT work — seeding, enumeration, resolution, change detection — and where LLM assistance actually earns its place. Bug Bounty in 2026: VDPs, AI-Assisted Triage and How to Earn Real Hall of Fame Credit https://abhihackz.com/blog/bug-bounty-2026-playbook https://abhihackz.com/blog/bug-bounty-2026-playbook Wed, 07 Oct 2026 00:00:00 +0000 Bug Bounty What changed in bug bounty, why vulnerability disclosure programs are worth your time, how to write reports that survive AI-assisted triage, and the path from first valid report to CVE credit.