https://xclow3n.com/ Original vulnerability research by Rajat Raghav (xclow3n): HTTP request smuggling, cache poisoning, parser differentials, and authored CTF challenges. en https://xclow3n.com/post/smuggling-shouldnt-exist-anymore/ https://xclow3n.com/post/smuggling-shouldnt-exist-anymore/ Thu, 01 Oct 2026 00:00:00 GMT A victim asked for /account and got the attacker's marker back, on a backend socket the proxy believed was clean. Ten products reuse a connection where the previous request is not finished, and reuse is not the defect. Turning it off takes the crossings to zero in all four families and leaves the defect where it was. Four mechanisms, with wire traces, origin logs and a control for each. HTTP Request Smuggling Connection Reuse Desync HTTP/2 HTTP/3 https://xclow3n.com/post/ssrf-pipeline/ https://xclow3n.com/post/ssrf-pipeline/ Sat, 01 Aug 2026 00:00:00 GMT A pinned comparison of fourteen URL parsers, fifteen bug families indexed by pipeline stage, and a differential oracle covering sixteen validators and five clients across eight languages. Includes 1855 wire-backed verdicts, unchecked cells, and mechanisms that did not reach a shipped product. SSRF URL Parsing Parser Differential HTTP/2 DNS Tooling https://xclow3n.com/post/the-validator-can-lie/ https://xclow3n.com/post/the-validator-can-lie/ Sat, 01 Aug 2026 00:00:00 GMT A URL validator can approve one representation while the client sends another. This audit covers thirteen language stacks, twelve bug families, and product cases including changedetection.io reaching IMDS, GitLab discarding its DNS pin, and Mealie approving A while the fetcher dialled AAAA. SSRF URL Parsing Parser Differential HTTP/2 DNS https://xclow3n.com/post/ai-vuln-research/ https://xclow3n.com/post/ai-vuln-research/ Sun, 01 Mar 2026 00:00:00 GMT Results from testing four AI-assisted vulnerability-research workflows over one week, including 14 confirmed bugs in one target and one approach that produced no reportable findings. AI Vulnerability Research SAML HTTP Smuggling Security https://xclow3n.com/post/breaking-pingora/ https://xclow3n.com/post/breaking-pingora/ Sun, 01 Mar 2026 00:00:00 GMT Three HTTP request-smuggling bugs and one cache-poisoning vulnerability in Cloudflare's Pingora reverse proxy, including root causes, proofs of concept, fixes, and disclosure notes. HTTP Smuggling Cache Poisoning Cloudflare Pingora CVE https://xclow3n.com/post/encodecept/ https://xclow3n.com/post/encodecept/ Fri, 01 Nov 2024 00:00:00 GMT Intended solution for EncoDecept challenge from Hack the Box University CTF 2024 involving Web Cache Deception, encoding differential attacks, and ORM leak exploitation. CTF Web Cache Deception XSS ORM Leak Rails https://xclow3n.com/post/intergalactic-bounty/ https://xclow3n.com/post/intergalactic-bounty/ Fri, 01 Nov 2024 00:00:00 GMT Exploiting Nodemailer parser discrepancies, bypassing HTML sanitization with MXSS, and achieving RCE through prototype pollution file overwrite in this HTB University CTF 2024 challenge. CTF Web Nodemailer MXSS Prototype Pollution RCE https://xclow3n.com/post/nodemailer-parser-discrepancy/ https://xclow3n.com/post/nodemailer-parser-discrepancy/ Fri, 01 Nov 2024 00:00:00 GMT Discovering two email parsing issues in Nodemailer that could lead to email misrouting. The first was patched in v6.9.16, and the second was finally patched in v7.0.7 after I reported it as a security advisory. Security Research Nodemailer Email Parser RFC 5322 GHSA-mm7p-fcc7-pg87 https://xclow3n.com/post/sanitize-html-bypass-mxss/ https://xclow3n.com/post/sanitize-html-bypass-mxss/ Fri, 01 Nov 2024 00:00:00 GMT Discovering how Mutation XSS (MXSS) can bypass the sanitize-html library due to differences between htmlparser2 and browser HTML parsers, allowing XSS attacks through style and math elements. Security Research MXSS XSS HTML Sanitization htmlparser2