Bhuwan Bhetwal's HandBook

Two Doors, One Lock: CVE-2026-71434 in Statamic

Oct 4, 20263 min read

When the Notification Email Trusts the Stranger: CVE-2026-71435 in Statamic

Oct 4, 20263 min read

An Endpoint That Answered the Wrong Question: CVE-2026-64664 in Statamic

Authorization bugs rarely look dramatic. There's no payload, no shell, no alert box. There's just an endpoint quietly answering a question it was never supposed to answer for the person asking. CVE-20

Oct 4, 20263 min read

The Log Said Skipping. The Disk Said Otherwise: CVE-2026-68924 in MobSF

Oct 4, 20264 min read

A CSRF Fix That Stopped Running: CVE-2026-68923 in MobSF

Oct 4, 20263 min read

Mobile Application Penetration Testing Setup In Linux

Download Genymotion with virtual box: https://www.genymotion.com/product-desktop/download/ Installing Genymotion1. You can see something like “genymotion-3.X.X-linux_x64.bin” in your Downloads directory.2. Open your terminal and navigate to your Down...

Dec 25, 20248 min read

Connecting android/emulator to your Burp suite via OpenVPN

This is a simple blog for connecting the Genymotion and the Burpsuite for Android Pentesing using OpenVPN. I use Genymotion (Google Pixel 3 — Android Version 9) and Kali Linux Let’s start the configuration. Make sure you save this two scripts. Githu...

Nov 16, 20242 min read

CSRF + POST Body Param Reflection = POST-Based XSS (A BrainFuck)

Hello again, This blog explains how i chained a CSRF and XSS on a POST request. So, lets get straight into it. One day i was hunting on a private program and i could see most of hacker’s were reporting CSRF. Almost 5 reports out of 10 were them. Lo...

Nov 8, 20244 min read

Breaking In: How RXSS and SQLi Can Lead to Full Account Takeover and Database Access

These vulnerabilities were Identified on one of the YesWeHack’s Private Program. I was hunting late night when i received an invitation from one of the Private Program. As they Were Interested on critical reports. I was looking for SQLi, Command Exec...

Nov 7, 20243 min read

Get your python 3.11.9 back on Linux

First of all, Select the required python version (Example: 3.11.9) https://www.python.org/ftp/python/3.11.9/ Now, Install all the required dependencies to compile and install Python 3.11.9 sudo apt install build-essential zlib1g-dev libncurses5-dev l...

Nov 7, 20241 min read

Adding Knoxnl (KNOXSS) to Burp

Open Burp > Extensions Install Piper Go to Piper > Context menu items Click on Add Button and Enter Name as “knoxnl” In the Add menu item dialog box, enter the Name as knoxnl and change the Can handle... drop down to HTTP requests only. Change b...

Nov 7, 20242 min read

Command Palette

Latest articles