THREAT INTEL // CASE BOARD

Research case files

Vertical dossiers from the lab — multi-stage RCE, broken trust boundaries, and infrastructure ghosts. Open a case file to read the full chain.

10 cases
// case dossiers vertical board · click to open
2026
CASE-001 2026
NGINX RIFT
NGINX Rift: An 18-Year-Old Bug That Can Hand Attackers Your Server

Critical heap buffer overflow in NGINX rewrite/set dating back to 2008 — unauthenticated RCE risk on millions of deployments.

NGINX // rewrite/set // Heap Buffer Overflow → RCE
Web Application / NGINX 2026-05-29
CRITICAL open file →
CASE-002 2026
CVE-2026-21858
Ni8mare: Unauthenticated RCE in n8n via Parser Confusion

Technical breakdown of CVE-2026-21858 — content-type confusion to arbitrary file read, session forgery, workflow injection, and unauthenticated…

n8n // Webhooks // Workflow Engine
n8n Workflow Automation 2026-04-17
CRITICAL open file →
2024
CASE-003 2024
WEB APPLICATION SECURITY
Unauthenticated OS Command Injection in a Login Pre-Check

How a Windows-hosted asset management app turned username existence checks into out-of-band command execution and PowerShell reverse…

Asset Management // Login Pre-Check // Windows Host
Windows / Web Application 2024-12-10
CRITICAL open file →
2023
CASE-004 2023
WEB APPLICATION SECURITY
Free Diamond Memberships: Payment Logic vs Encrypted Add-On APIs

Reversing client-side AES on a hotel booking platform and abusing payment_method / membership flags to activate Diamond benefits without…

B2B Hotels // Membership Tiers // Purchase Add-Ons
Hotel Booking / Subscription Platform 2023-10-31
HIGH open file →
CASE-005 2023
WEB APPLICATION SECURITY
From Mass Assignment to Database Dump: When Type Confusion Becomes SQLi

How a profile-update mass-assignment bug, array injection, and verbose MySQL errors chained into error-based SQL injection and full…

Node.js API // Profile Update // MySQL
Node.js / Express / MySQL 2023-07-13
CRITICAL open file →
CASE-006 2023
WEB APPLICATION SECURITY
Account Takeover via SessionStorage Authorization

How a financial web app mixed cookie authentication with sessionStorage identity, user enumeration APIs, and OSINT-derived employee emails…

Financial SaaS // SessionStorage // User Lookup API
Financial Web Application 2023-03-30
CRITICAL open file →
CASE-007 2023
WEB APPLICATION SECURITY
CMS Privilege Escalation: Cognito Auth, localStorage Roles

Breaking a multinational CMS that used AWS Cognito for authentication but trusted a localStorage user_role flag for editor/publisher…

MNC CMS // Cognito // Content Publishing
ReactJS / AWS Cognito CMS 2023-03-25
HIGH open file →
CASE-008 2023
WEB APPLICATION SECURITY
Reversing Client-Side AES: When ‘Encrypted APIs’ Are Just Obscurity

How hardcoded AES-CBC keys and IVs in shared CDN JavaScript turned encrypted REST traffic into a fully automatable API surface — including…

Multi-App CDN // Encrypted REST // reCAPTCHA
Web / Android / iOS (shared API) 2023-02-15
HIGH open file →
2022
CASE-009 2022
WINDOWS APPLICATION SECURITY
DLL Search-Order Hijacking to RCE on a Business Automation Client

Process Monitor-driven DLL hijacking against a Windows business automation product — from missing module loads to Calculator proof and…

Windows Desktop // Business Automation Client
Windows Desktop Application 2022-12-15
HIGH open file →
2021
CASE-010 2021
WEB APPLICATION SECURITY
Mass Heroku Subdomain Takeover via Dangling DNS

Large-scale subdomain enumeration uncovered thousands of hostnames and multiple Heroku CNAMEs pointing at unclaimed apps — a systematic…

Corporate DNS // Heroku CNAMEs // Dangling Records
Web Infrastructure / DNS 2021-05-08
HIGH open file →