https://awwfensive.github.io/research/AI security, vulnerability research, and technical analyses by Aniket. Explore public findings, reproductions, and research notes.en-UShttps://awwfensive.github.io/escaping-the-recipe-book-path-traversal-in-flytos-run-recipe/https://awwfensive.github.io/escaping-the-recipe-book-path-traversal-in-flytos-run-recipe/Tue, 14 Jul 2026 00:00:00 +0000A disclosed path traversal in flyto-core’s MCP recipe runner that crossed the bundled recipe boundary.https://awwfensive.github.io/react2shell-cve-2025-55182-technical-analysis/https://awwfensive.github.io/react2shell-cve-2025-55182-technical-analysis/Sat, 20 Dec 2025 11:51:55 +0530Exploring deserialization, prototype traversal, and the React2Shell exploit chain in a reproducible lab.https://awwfensive.github.io/container-escape-from-enumeration-to-host-root/https://awwfensive.github.io/container-escape-from-enumeration-to-host-root/Mon, 10 Nov 2025 11:51:55 +0530A practical note on container boundaries and the configurations that commonly collapse them.https://awwfensive.github.io/breaking-authentication-bcrypt-truncation-email-normalization/https://awwfensive.github.io/breaking-authentication-bcrypt-truncation-email-normalization/Sat, 25 Oct 2025 11:51:55 +0530How bcrypt's 72-byte limit and inconsistent email normalization combined into a CTF authentication bypass.https://awwfensive.github.io/exploiting-symlink-upload-and-session-forgery/https://awwfensive.github.io/exploiting-symlink-upload-and-session-forgery/Mon, 01 Sep 2025 00:00:00 +0000Chaining symlink upload, secret disclosure, session forgery, and path traversal in a CTF challenge.https://awwfensive.github.io/exploiting-cve-2025-29744-when-prepared-statements-arent-safe/https://awwfensive.github.io/exploiting-cve-2025-29744-when-prepared-statements-arent-safe/Sat, 02 Aug 2025 00:00:00 +0000A pg-promise SQL injection reproduction exploring negative numeric formatting and PostgreSQL comment syntax.