Pentester turned AppSec Engineer.
I find security bugs in web apps and APIs, then help the teams who own them fix the root cause. Seven years of pentesting, now leading AppSec in-house. The interesting ones get written up here.
Hotanya Ragtah · Senior AppSec Engineer · New Zealand
- Now
- Senior AppSec Engineer7 years in security
- Disclosures
- 7 findings disclosed2 CVEs issued, 2 pending
- Talks
- 4 conference talksOWASP NZ Day, AppSec Days India
- Certified
- BSCP · CDP · AI-RTACAPen · CNPen · CCSP-AWS
Stored XSS via SVG Uploads in Backdrop CMS
Two ways to get JavaScript past the SVG upload check in Backdrop CMS, one with a tab character and one with an SVG animate element. Both lead to stored XSS, fixed in 1.35.2 and 1.34.6.
Palo Alto Networks Firewall Configs Exposed in Public S3 Buckets
Public S3 buckets on a Palo Alto Networks AWS account held firewall configs, internal IPs and bootstrap files with admin password hashes. Getting them closed took more than nine months.
guide · jan 2025Automating Portainer-Hosted TeslaMate Backups to Google Drive
rclone, a small shell script and a cron job, adapted for running TeslaMate under Portainer.
advisory · jan 2025Self-XSS in Stirling-PDF's Merge Feature
Unsanitised PDF file names were rendered straight into the result page, so HTML and JavaScript in a file name got executed.
disclosure · oct 2024Command Injection in the es-hangul GitHub Actions Workflow
An unsanitised workflow input interpolated straight into a shell step, allowing arbitrary commands to run in the workflow.
Got an application that needs a second pair of eyes?
Happy to talk about security reviews, speaking, or research collaborations.