The Curious Engineer

All blogs / Security

ian carroll

ian.sh

I'm the founder of Seats.aero, a site for discovering flights with points and miles. Outside of work, I do security research on bug bounties, transportation, and other interesting areas.

SecurityWeb development

’22’23’24’25’26
Posts
10 from 13 Nov 2022 to 1 Jul 2026
Posting
now and then (2 in the last year)
Kind
personal blog

2026 2

  1. Backstage access: an unauthenticated SQL injection in Front Gate Tickets
  2. Driving in China as a tourist

2025 2

  1. Would you like an IDOR with that? Leaking 64 million McDonald’s job applications
  2. Hacking Formula 1: Accessing Max Verstappen's passport and PII through FIA bugs

2024 1

  1. Bypassing airport security via SQL injection

2022 1

  1. Security concerns with the e-Tugra certificate authority

Undated 4

  1. Exploiting Redash instances with CVE-2021-41192
  2. Introducing CookieMonster: a tool for breaking stateless authentication
  3. Exploiting outdated Apache Airflow instances in bug bounties
  4. How MarkMonitor left >60,000 domains for the taking