hwat.sauce$ whoami && cat about.mdx
Muhammad Abdullah aka Hwat Sauce
❯_
Muhammad Abdullah aka Hwat Sauce
I work on application and system security, and I spend most of my own time on vulnerability research in the open-source infrastructure everyone else builds on. Self-taught, still learning in public, and happiest when something that was supposed to be safe turns out not to be.
The research side has produced CVEs and GitHub security advisories in Gitea, Wazuh, Apple's Containerization, Better Auth, Renovate and openapi-python-client, along with fixes merged into Caddy, go-redis and Wazuh, and an NSE script sent to Nmap. The bugs are rarely exotic: a permission check that runs after the handler has already answered the request, an argument that reaches a shell unescaped, a cutoff date that excuses a cross-repository check, a brute-force limiter that counts sequentially while the requests arrive in parallel. Most of them came out of reading code rather than throwing traffic at it. The current list lives on Contributions.
My background is offensive — CPTS, CRTA, the HackTheBox Pro Labs, and a long run of CTFs where I mostly play pwn and reverse engineering. That is where the rest of the work comes from too: Active Directory tooling (pathhound-mcp, ActiveDecoy, GPO-Audit), Android obfuscation internals, and AI red teaming. Anything I learn that is worth writing down ends up on the blog.
I'm based in Islāmābād, doing an MS in Information Security at NUST alongside the day job. Always up for working with people who like breaking the same things I do.
distributionType - [Renovate]organization - [Renovate]pull_request_review_comment (missing WithPullRequest) - [Gitea]ContainerizationOCI accepts unvalidated OCI descriptor digests, enabling path traversal in the local content store - [Apple Containerization]GET /api/v1/orgs: the read:organization check ran after the handler that answered the request - [Gitea]security.update_user - [Wazuh]@better-auth/stripe: Billing actions can target another customer's Stripe account - [Better Auth]@better-auth/passkey: Passkey verification does not enforce origin or user verification - [Better Auth].hprof) to extract sensitive data, assess risks, and generate forensic reports. It identifies credentials, tokens, and other artifacts using built-in heuristics, producing reports in JSON, HTML, and text formats. Ideal for security investigations, malware analysis, and incident response.muhammadabdullah8040@gmail.comn0tabdu11ah