SYSTEM INFILTRATED.
REMMY9
/\_/\ ( o.o ) > ^ <
I'm Remmy9. I dissect systems, break logic, and find vulnerabilities before the bad actors do.
Latest Writeups
View AllJavaScript Dissected: P2 - Engine Fundamentals
Deep-dive into how V8, SpiderMonkey, and JavaScriptCore parse, compile, and optimize JavaScript. Covers bytecode disassembly, DFS tree traversal and the visitor pattern, sea-of-nodes IR, Smi tagging and pointer compression, inline cache data structures, hidden class transition trees, deoptimization frame reconstruction, and where every pipeline stage is exploitable. Second in the JavaScript Internals series.
JavaScript Dissected: P1 - Trees!
Learn how JavaScript engines turn source code into Abstract Syntax Trees, why ASTs are the foundation of security tooling like Semgrep and CodeQL, and how parser differentials enable WAF bypasses. First in the JavaScript Internals series.
Bypassing WAF, 403, and OTP to Exploit SQL Injection
Bypassing WAF, 403 Forbidden, and OTP restrictions to exploit a blind SQL injection on a VDP program.
My Therapist Said Tiny Problems Don’t Matter. These Vulnerability Chains Proved Me Wrong.
Chaining multiple low-severity IDORs, broken access control, and token exhaustion into a data exfiltration chain.
From alert(origin) to ATO, an XSS Story
How a simple XSS discovery escalated to full account takeover through response manipulation and creative payload crafting.
403 Forbidden? No Problem, Here’s a POST XSS
Bypassing 403 forbidden restrictions to deliver a POST-based XSS payload that led to a Bugcrowd bounty.