@XeEaton

Security researcher, reverse engineer, application developer.

 USA
eaton-works.com/
Joined February 2010
  • Tweets645
  • Following186
  • Followers1.7K
61Media
AI is definitely becoming more life (or loaf) like. 😅 (yes, this is a real response)
3
191
Happy Monday! "Tata to your OTP" is what you might say after you check out today's security disclosure involving @Tatanexarc! There was a vulnerability where they were sending back your OTP in the login API response, making account takeover easy. Check it out 👇
Tata nexarc - Account Takeover Vulnerability

ALT Tata nexarc - Account Takeover Vulnerability

1
2
378
eaton-works.com/2026/08/24/t…

Tata’s B2B platform returned OTPs in API responses

Tata’s nexarc platform had a vulnerability where OTPs could be decrypted from API responses, making it easy to take over any account.

eaton-works.com
2
169
My next automotive hack is here! This time I set my sights on @ETBIndia and their My Eicher fleet management platform. This is another example of how insecure APIs can be used to compromise an entire platform and gain control over hundreds of thousands of vehicles.
Volvo/Eicher Motors hacked! - Uncovering hidden admin APIs - Taking over any fleet account & vehicle - View real-time vehicle locations and instrument clusters - ID cards and sensitive info exposed

ALT Volvo/Eicher Motors hacked! - Uncovering hidden admin APIs - Taking over any fleet account & vehicle - View real-time vehicle locations and instrument clusters - ID cards and sensitive info exposed

1
2
5
419
eaton-works.com/2026/07/27/m…

Exploiting Volvo/Eicher’s fleet management platform to gain control over all users and vehicles

VE Commercial Vehicles’ My Eicher platform had a critical vulnerability that let you take over anyone’s account and gain control over their vehicle fleets.

eaton-works.com
178
Oh @postmarkapp, what has happened to your customer service? My ticket that I pleaded multiple times for urgency in has not received any updates for 1 week now. This is quite disappointing!
1
502
A fancy, high-tech AI coal mine security camera network powered by plaintext passwords. What could go wrong? Check out today's vulnerability disclosure 👇
1
2
391
eaton-works.com/2026/07/08/c…

Inside an AI coal mine security camera network powered by plaintext passwords

Coal India’s intelligent CCTV platform developed by DeepSight AI Labs and Accenture had plaintext passwords and no API authentication.

eaton-works.com
2
166
My latest vulnerability disclosure impacts 2 wildly different Johnson & Johnson web apps! Read all about it 👇
Johnson & Johnson web apps hacked! - Campus Recruiting/Career Fair - Internal Audit Management System

ALT Johnson & Johnson web apps hacked! - Campus Recruiting/Career Fair - Internal Audit Management System

1
3
410
more replies
The second is more serious. The internal Audit Tracking Management System had a vulnerability that also made it possible to bypass the SSO. Once inside, you could view sensitive audit information for J&J and their associated companies.
1
177
All the details: eaton-works.com/2026/06/24/j…

Exploiting vulnerabilities in Johnson & Johnson web apps

Campus Recruiting vulnerability exposed student information, and Audit Tracking Management System vulnerability exposed confidential internal audit data.

eaton-works.com
1
116
I recently found a vulnerability in an "Agentic AI Call Center". Saying that out loud will always make me chuckle a bit. 😂 Among other things, I could access the recordings of more than 315k calls between the AI agents and delinquent loan customers. Full writeup another day.
This is a screenshot comprised of 3 sections. The left-side is a list of more than 315k phone call recordings, and the right-side is the transcript of one of them.

ALT This is a screenshot comprised of 3 sections. The left-side is a list of more than 315k phone call recordings, and the right-side is the transcript of one of them.

2
6
643
Today I have open sourced my Xbox 360 XL storage patches that raise the limits from 2 TB to 16 TB. This was one of the most complex projects I have worked on in recent years, and now you can see how it all works! fatxplorer.eaton-works.com/2…
7
102
1
685
27,616
GitHub link: github.com/EatonZ/Xbox-360-P…

GitHub - EatonZ/Xbox-360-Patch-Collection: This is a collection of PowerPC assembly patches I have...

This is a collection of PowerPC assembly patches I have made for the Xbox 360 operating system over the years. - EatonZ/Xbox-360-Patch-Collection

github.com
1
2
45
1,966
@Grimdoomer This may help you iron out a few edge case bugs in your ongoing project!
35
1,662
And here I thought 16 TB was going to be plenty for everyone 😅 Cool stuff!
Ryan M@GrimdoomerMar 9
Fatx is dead exfat is eternal. Exfat support for HDD + USB devices, LBA48 support, DVD drive can be replaced with a second HDD (auto detect on boot), UDMA 5/6. Still need to finish some edge cases and run some real perf tests but oblivion is loading 6.5 seconds faster on average
3
9
87
4,803
📣 New hack announcement! This time, a tech college: @skcetofficial To hack into the admission system, you didn't need an advanced hacking tool. You didn't need to phish a teacher. All you needed was Google Chrome. Read the full writeup 👇
A college admission system hacked! - Forgotten API authentication - 4,110 students (+ parents) exposed - Aadhaar cards, grades, medical info, and more - A cookie is all it took 🍪

ALT A college admission system hacked! - Forgotten API authentication - 4,110 students (+ parents) exposed - Aadhaar cards, grades, medical info, and more - A cookie is all it took 🍪

2
2
443
eaton-works.com/2026/03/09/s…

Using cookies to hack into a tech college’s admission system

The Sri Krishna College of Engineering and Technology (SKCET) in India made elementary mistakes in web app security.

eaton-works.com
1
232
My first disclosure in the healthcare industry has arrived! Ever wondered what it would be like to gain administrative access to a major pharmacy? You’re about to find out. Full control over everything, even the ability to order prescription drugs for free. Check it out! 👇
Hacking a pharmacy! - Super admin account creation - Access to all customer orders/info - Remove prescription requirements - Order anything for free - Add Rick Roll video to homepage

ALT Hacking a pharmacy! - Super admin account creation - Access to all customer orders/info - Remove prescription requirements - Order anything for free - Add Rick Roll video to homepage

1
1
3
423
eaton-works.com/2026/02/13/d…

Hacking a pharmacy to get free prescription drugs and more

Super admin exploit on Dava India Pharmacy’s website gave complete control over everything.

eaton-works.com
1
262
Load more