Affan Ali (muslimfrompk) — BlogSecurity write-ups: AI red teaming, bug bounty, and web/API security.https://affanali.dev/LFI + Unsafe YAML Deserialization leads to RCEhttps://affanali.dev/blog/lfi-yaml-deserialization-rce-thm/https://affanali.dev/blog/lfi-yaml-deserialization-rce-thm/A TryHackMe Industrial Intrusion CTF 2025 write-up: chaining a blacklist-bypass LFI with an unsafe PyYAML loader to read source code and get remote code execution.Fri, 04 Jul 2025 00:00:00 GMTremote-code-executionctf-writeupinsecure-deserializationthmmigratedMy first P1 vulnerability | Hacking Adobe Experience Manager CMS Dispatcher through CVE-2016–0957https://affanali.dev/blog/first-p1-adobe-dispatcher-bypass/https://affanali.dev/blog/first-p1-adobe-dispatcher-bypass/How I bypassed an Adobe Experience Manager Dispatcher with CVE-2016-0957 to list a site's internal content directories, and what happened to the report.Thu, 06 Jul 2023 00:00:00 GMTbug-bountycms-hackingbug-bounty-writeupadobe-experience-managerfirst-bugmigratedMy First Bug | Account takeover through OTP bypasshttps://affanali.dev/blog/first-bug-otp-bypass-account-takeover/https://affanali.dev/blog/first-bug-otp-bypass-account-takeover/My first ever bug and write-up: an OTP field with no rate limiting let me brute-force the code and take over an account on my ISP's website.Fri, 30 Jun 2023 00:00:00 GMTotp-bypassfind-your-first-bughackingbug-bountyaccount-takeovermigrated