Amal Murali

CVE-2025-4664: Exploiting a Chrome 0day to Leak Session Tokens

Sun, 22 Jun 2025 18:06:38 +0530

A while ago, I stumbled across this intriguing tweet from security researcher Vsevolod Kokorin (@slonser_). The three-line snippet was almost boring - create an image element, point the src at a user-controlled URL, drop it into the DOM. In the replies of the tweet, a Google security engineer confirmed it’s a 0day. An actively exploited 0day? I had to dig deeper.

Fooling Parsers: Achieving Code Execution Using echo Command — Google CTF 2024 Writeup

Mon, 01 Jul 2024 00:09:38 +0530

Google CTF releases some really cool challenges every year. This year was no exception. onlyecho was one of the relatively easier ones, but it ended up being a lot of fun to solve. I was intrigued by the challenge and decided to dive right in.

This CTF is Still on IRC — IRCPuzzles 2024 Writeup

Tue, 25 Jun 2024 00:05:32 +0530

Cluelessly staring at a vague hint for hours, relentlessly going down multiple rabbit holes, the joy of finally finding a solution… what’s not to love? After all, this is fairly similar to a regular day in information security. I decided to check out this year’s puzzles.

Pwning Tetris: Exploiting a Weak RNG

Wed, 19 Jun 2024 23:44:00 +0530

The challenge was hosted at this URL. Upon visiting the link, I was greeted with a game. At first glance, it resembled the familiar Tetris game, but something was noticeably off. Instead of the usual four blocks per piece, this game featured five. Curious about the mechanics, I decided to inspect the source code.

Exploiting CVE-2024-32002: RCE via git clone

Sun, 19 May 2024 14:34:12 +0530

A new RCE in Git caught my attention on a recent security feed, labeled CVE-2024-32002. Given Git’s ubiquity and the widespread use of the clone command, I was instantly intrigued. Could something as routine as cloning a repository really open the door to remote code execution? My curiosity was piqued, and I had to investigate. Plus, who doesn’t want an excuse to break stuff in the name of research?

What a CTF on IRC looks like — IRCPuzzles AFPC 2022

Wed, 18 May 2022 00:00:00 +0530

An Image Speaks a Thousand RCEs: The Tale of Reversing an ExifTool CVE

Tue, 18 May 2021 12:00:00 +0530

A tweet showing an RCE in ExifTool popped up on my feed; it looked interesting — maybe a little scary. But what good is an RCE on a demo video? I wanted more; I wanted it to pop my calculator.exe, to rm -rf my home directory; heck, it could even Rick Roll me. However, like with all things in life, there was no publicly-available proof-of-concept. So I decided to make my own.

Solving Intigriti Challenge using… Content Injection!

Mon, 20 Apr 2020 12:00:00 +0530

Intigriti releases cool challenges every once in a while, and this was no exception.

I love a good challenge. Every time I solve an Intigriti challenge, I learn something new. Motivated by that, I wanted to crack this one too.

As usual, there were many dead-ends, moments of frustration and head-scratches. However, I’ll save your scalp from the scratching and walk you through this challenge.

The Challenge#

Right after the tweet, I opened up the challenge link:

h1–702 CTF — Web Challenge Write Up

Sun, 01 Jul 2018 12:00:00 +0530

This writeup has since won the H1–702 challenge. Read HackerOne blog here: https://www.hackerone.com/blog/H1-702-CTF-Winners-Announced

When you open the challenge link, you’re presented with this:

Instructions can be found on the web challenge site: http://159.203.178.9/

Open the link in your browser and you’re greeted with a normal-looking HTML page:

Notes RPC CTF homepage

It sounds like there is a secret endpoint somewhere that allows you to store notes. The title indicates that it has something to do with RPC.

Solving the Dog Problem — Google CTF 2018 Quals Write Up

Fri, 08 Jun 2018 12:00:00 +0530

Challenge Description#

Cat Chat app popup

Getting familiarized#

When you open the link, it redirects you to a chat room with a random UUID which is probably the chat room ID.

Challenge homepage

This looks like a chat application built with NodeJS where anyone can join and chat with each other.

If you use /name bob, your display name gets changed to that. If you type /report, an admin will join the room for a few seconds. If anyone mentions dog in the chat while admin is in the room, they will get banned. They won’t be able to send or receive messages in the chat room after that. So much hate for dogs :(

About

I lead the APAC Security Operations team at Bugcrowd, overseeing security triage and validation. I stay hands-on with the technical work, including zero-day response, and lead projects across the wider team in internal tooling, automation, and AI. I also work directly with customers and collaborate with Product and Engineering on the platform.

Previously, I was a Senior Security Engineer at Postman, where I led security engineering teams and the bug bounty program. I researched new vulnerability classes, found and fixed critical issues, and helped address SSRF at its root cause. I also mentored engineers and developed security tooling and training resources.