Skip to content
View 0xABCD01's full-sized avatar
🤔
🤔
14 followers · 0 following

Achievements

Achievement: Starstruckx2

Achievements

Achievement: Starstruckx2

Block or report 0xABCD01

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
0xABCD01/README.md

A constellation graph in navy, cream, lavender, sage, and gold, with the handle set in monospace

Areas of work: bug bounty, pentest, OSINT

Hafiar

Bug hunter, pentester, and OSINT investigator. I reproduce published vulnerabilities, run authorized engagements, and build the tools I would otherwise write by hand. I also audit open-source libraries and send the fixes upstream.

Breaking things locally, politely. Sending the fixes upstream. Reading changelogs so you don't have to.

An animated radar sweep with contacts lighting up as the beam passes them

Research

Advisory What it is Score
CVE-2026-41089 Netlogon CLDAP stack buffer overflow. One unauthenticated UDP packet to a domain controller. CVSS 9.8, CWE-121
CVE-2026-48866 Gravity Forms path traversal into arbitrary file deletion. CVSS 9.6, CWE-22
SA-CORE-2026-014 Drupal field_ui render-array callback. RCE once a contributed module is in play. Drupal 11.4.9, fixed in 11.4.10

The Drupal lab covers all three core advisories that 11.4.9 shipped with, including the two stored XSS issues. Every proof of concept runs against a local container, never a third-party host.

Open source

Project Contribution Status
symfony/symfony Strip the byte order mark at the start of a YAML stream Merged
symfony/symfony Skip empty lines when decoding CSV in the Serializer Merged
symfony/symfony Fix Glob patterns whose bracket expression contains a slash Merged
projectdiscovery/dsl Return errors instead of panicking on negative repeat counts and substr starts Merged
projectdiscovery/nuclei Bump govaluate and antchfx/xpath past two template panics Merged
projectdiscovery/nuclei Add a regression test for the govaluate string concatenation bug Merged
symfony/ux Let LiveComponent collections contain null items during (de)hydration Merged
WordPress/sqlite-database-integration Quote SQLite identifiers in LOCK TABLES, SHOW TABLES, and compound-PK indexes Merged
WordPress/sqlite-database-integration Split MySQL Proxy result packets at the maximum packet length Open
WordPress/sqlite-database-integration Pass workflow values via env in release workflows Open
pypi/warehouse Fix footer color contrast and landmark coverage Open
pypi/warehouse Make search-button focus visible and stop the classifier filter trapping keyboard focus Open
pypi/inspector Normalize archive member names so bad directory entries are browsable Open
Panniantong/agent-reach Treat an all-NOT_FOUND live test as a stale sample, not a broken channel Open
huggingface/transformers Fix CLAP loss double-counting the text-to-audio direction Open
dwisiswant0/apkleaks Stop the IP address pattern truncating the last octet Open
dwisiswant0/apkleaks Stop the CTF flag pattern matching plain CSS rules Open
thedotmack/claude-mem Keep the doc_type filter out of the semantic search fallback query Merged
thedotmack/claude-mem Park queued messages at the process hard cap instead of discarding them Merged
openai/codex-security Recheck empty targets before a resumed scan's first dispatch Merged
anthropics/claude-quickstarts Continue paused server-tool turns instead of returning them unfinished Open
anomalyco/opencode Do not reuse an unmigrated V1 session ID on create Open
thedotmack/claude-mem Persist SessionStart toggles and accept zero context counts via POST /api/settings Merged
thedotmack/claude-mem Resume stalled sessions on a backoff timer after the fixed-delay resumes run out Open
thedotmack/claude-mem Keep context reads working when the WAL index cannot be established Open
apache/httpd Bind mod_authn_socache cache keys to the authentication domain Open
ClickHouse/ClickHouse Make equal ClickHouseVersion objects hash equal so set and dict lookups dedupe them Open
ClickHouse/ClickHouse Honor glob excludes and not_exists_ok in praktika path traversal for job digests Open

GitHub statistics for 0xABCD01 Top languages by repository

Contribution streak

A snake eating its way through the contribution graph

Tools

Repository What it does
test-amnesty Compares an edited pytest file against the original and catches tests that were weakened to pass.
cachelint Predicts which Dockerfile layer busts the build cache and suggests a faster order.
codex-skills Workflow prompts for Codex CLI. Each one pins exact commands so the model cannot skip a step.
cloud-file-manager Self-hosted file manager with encryption at rest, per-file permissions, and access logs.
crystal-cavern Puzzle game written in C++17 and compiled to WebAssembly, no runtime dependencies. Play it.

An animated signal line with two heartbeat spikes, a bright pulse travelling along it

Currently

  • Building reproductions for Drupal 11.4.x advisories, one repository per release.
  • Auditing fresh open-source releases. Five reports are sitting with vendors and maintainers right now.
  • Turning the parts of pentesting I repeat by hand into small tools.

An animated constellation: stars twinkle while a line draws itself between them, and a shooting star crosses now and then

Contact

  • X: @VortexXzy
  • Bug reports and questions: open an issue on the relevant repository.

Three layered waves in sage, lavender, and gold drifting past each other

Pinned Loading

  1. CVE-2026-41089 CVE-2026-41089 Public

    Netlogon and CLDAP vulnerability research with a proof of concept.

    Python 234 67

  2. codex-skills codex-skills Public

    Workflow prompts for Codex CLI covering fixes, tests, refactors, and reviews.

    5

  3. cachelint cachelint Public

    Predict Docker build-cache invalidation and suggest a faster layer order.

    Python 2 1

  4. CVE-2026-48866 CVE-2026-48866 Public

    Gravity Forms path-traversal research with a proof of concept and disclosure notes.

    Python 2

  5. test-amnesty test-amnesty Public

    Detect weakened pytest tests with repeatable evidence.

    Python 2

  6. drupal-11.4.9-vuln-lab drupal-11.4.9-vuln-lab Public

    Reproducible lab for three Drupal core advisories affecting 11.4.9 (fixed in 11.4.10): SA-CORE-2026-014 RCE in field_ui, SA-CORE-2026-015 stored XSS in link, SA-CORE-2026-016 stored XSS in navigation

    PHP 1