Security researcher focusing on web security, ICS/OT security, firmware reverse engineering, and responsible disclosure in government and corporate systems.
scroll to explore ↓About
D6fault is an American security researcher known for identifying and responsibly disclosing cybersecurity vulnerabilities in government and corporate systems.
He began his practical training on TryHackMe at age 13, completing 300+ rooms and developing hands-on expertise across penetration testing and web application security. By 14, he had reported security issues affecting U.S. government entities — including the Department of Defense, Department of Education, Department of Health and Human Services, the Department of Energy, and the Department of Justice.
His work focuses on web security, ICS/OT security, firmware reverse engineering, vulnerability discovery, and ethical disclosure through responsible reporting.
Research
Stored cross-site scripting in the "Set" field type's Display template option. User-supplied input is processed by an unsafe function and rendered with Vue's v-html directive without sanitization, allowing an authenticated attacker with specific permissions to inject JavaScript into other users' browsers.
By leveraging the createSite endpoint, an authenticated attacker can trick the HAXcms backend into sending requests to and reading responses from arbitrary internal services or unintended local resources, enabling data exfiltration.
Unauthenticated OS command injection (CWE-78) in the formSystemCheck handler at POST /apply.cgi. The ipv4_ping parameter is passed unsanitized into a shell command via vsprintf and system(), allowing a remote attacker to execute arbitrary commands as root.
Improper session management where authentication tokens remain valid after logout. When a user logs out, their session is not properly terminated, allowing session hijacking and unauthorized access to private site outlines and settings.