HomiGrotas
$ whoami security researcher — web appsec, binary exploitation, Android security $ ls ~/homigrotas.github.io research/ learning/ # (writeups & deep dives)
01 ~/research
Adversarial case studies — real targets, real bugs, real impact. All findings were responsibly disclosed.
web
-
01
2025-08-01
Wedding Website using Google APIs — Firestore Misconfigurationhigh
A friend's wedding website leaned on Firebase for auth and storage. Proper auth — but improperly scoped Fir...
-
02
2024-11-04
University Student Union — IDOR & Client-Side Price Tamperinghigh
A casual trip to the student union's website turned into two findings: an IDOR exposing full student PII by...
-
03
2024-11-04
Full Account Takeover via Enumeration & Missing Rate Limitingcritical
Two chained flaws on a communication company's customer portal — an observable response discrepancy let any...
open source
-
01
2026-08-11
Redash — RestrictedPython Sandbox Escape in the Python Query Runnerhigh
A RestrictedPython sandbox escape in Redash's Python query runner: calling execute_query with result_type='...
-
02
2024-12-21
Redash — Mass Assignment in the Visualization APIlow
A deep dive into Redash's Visualization API: a mass-assignment primitive on SQLAlchemy models that could se...
02 ~/learning
From the lab notebook — technical deep dives and build-along tutorials.
-
01
2026-08-11
Tracing TCP Connections with eBPF: A kprobe Deep-Divelab
Build a real-time TCP connection monitor with eBPF and BCC — kprobes, kretprobes, perf buffers, and why thi...
-
02
2026-07-10
Stack Buffer Overflow & Control Flow Hijackinglab
End-to-end exploitation of a classic stack buffer overflow on 32-bit x86 — from the stack layout and prolog...
-
03
2026-06-17
Developing Linux Kernel Modules: From Source to Signed Loadlab
A hands-on introduction to Linux Loadable Kernel Modules (LKMs) — building, signing for Secure Boot, and ve...