Security research and vulnerability writeups

Explore Research

9 posts

Write Once, Shell Everywhere: Turning Arbitrary File Writes into RCE screenshot

Write Once, Shell Everywhere: Turning Arbitrary File Writes into RCE

Some of the most under-rated findings we come across during our bug bounty engagements look exactly like ...
KindaRails2Shell - Critical RCE in Rails via Active Storage screenshot

KindaRails2Shell - Critical RCE in Rails via Active Storage

Ruby on Rails runs a large slice of the modern web: GitHub, Shopify, Basecamp, and a very long tail of self-hosted products and open-source projects ...
Redirect Discrepancies to leak secrets in URLs screenshot

Redirect Discrepancies to leak secrets in URLs

Passing secrets around embedded directly in URLs is not today’s news. Session tokens, magic links, redemption codes, and user identifiers have ...
Stealing Salesforce OAuth Tokens using the WAF screenshot

Stealing Salesforce OAuth Tokens using the WAF

6 min read
Recently I was conducting a pentest on a Salesforce instance when I stumbled upon an XSS vulnerability. This writeup details that vulnerability and how ...
Scream at it until it Escalates - XSS to ATO via Server Size Errors Gadgets screenshot

Scream at it until it Escalates - XSS to ATO via Server Size Errors Gadgets

10 min read
Servers and Frameworks, just like us humans, have their own limitations in terms of how much data they can handle at once. Maybe you're are familiar with ...
Bypass trustedOrigins Protection leads to ATO screenshot

Bypass trustedOrigins Protection leads to ATO

9 min read
Like starting recon scripts from scratch from time to time just because we feel like it, I decided to do that for my blog and it's design in general ...
Kanboard - Spraying Malicious Tasks screenshot

Kanboard - Spraying Malicious Tasks

6 min read
Kanboard is a widely used Kanban project management software with over 10 million downloads on Docker Hub. Today we're going explore how I found ...
Stealing Credit Card Info with CSS screenshot

Stealing Credit Card Info with CSS

5 min read
In this writeup I'll walk you through how I used CSS Injection to steal users Credit Card Info via Post-Messages ...
CVE-2022-0478 Wordpress Event-Manager Plugin SQLI screenshot

CVE-2022-0478 Wordpress Event-Manager Plugin SQLI

3 min read
It's been a while since I posted something ... But I plan to bring new content into the blog and to get off on the right foot. We'll start with ...