https://castilho.sh/ Security research, writeups, and experiments. en Fri, 07 Aug 2026 00:00:00 GMT https://ethiack.com/info-hub/research/write-once-shell-everywhere-arbitrary-file-writes-into-rce https://ethiack.com/info-hub/research/write-once-shell-everywhere-arbitrary-file-writes-into-rce Fri, 07 Aug 2026 00:00:00 GMT Some of the most under-rated findings we come across during our bug bounty engagements look exactly like ... Defcon Node Workers Ethiack Rails https://ethiack.com/info-hub/research/kindarails2shell-how-a-matlab-file-reads-your-secrets-and-pops-a-shell-on-ruby-on-rails https://ethiack.com/info-hub/research/kindarails2shell-how-a-matlab-file-reads-your-secrets-and-pops-a-shell-on-ruby-on-rails Fri, 31 Jul 2026 00:00:00 GMT Ruby on Rails runs a large slice of the modern web: GitHub, Shopify, Basecamp, and a very long tail of self-hosted products and open-source projects ... Rails MATLAB Ethiack https://ethiack.com/info-hub/research/abusing-redirect-discrepancies-to-leak-secrets-in-urls https://ethiack.com/info-hub/research/abusing-redirect-discrepancies-to-leak-secrets-in-urls Mon, 18 May 2026 00:00:00 GMT Passing secrets around embedded directly in URLs is not today’s news. Session tokens, magic links, redemption codes, and user identifiers have ... XSS Ethiack Browser https://castilho.sh/salesforce-oauth-ato https://castilho.sh/salesforce-oauth-ato Mon, 01 Dec 2025 00:00:00 GMT Recently I was conducting a pentest on a Salesforce instance when I stumbled upon an XSS vulnerability. This writeup details that vulnerability and how ... XSS WAF OAuth https://castilho.sh/scream-until-escalates https://castilho.sh/scream-until-escalates Sat, 01 Mar 2025 00:00:00 GMT Servers and Frameworks, just like us humans, have their own limitations in terms of how much data they can handle at once. Maybe you're are familiar with ... XSS Server Errors https://castilho.sh/better-auth https://castilho.sh/better-auth Mon, 24 Feb 2025 00:00:00 GMT Like starting recon scripts from scratch from time to time just because we feel like it, I decided to do that for my blog and it's design in general ... Open Redirect Business Logic https://castilho.sh/kanboard https://castilho.sh/kanboard Fri, 02 Jun 2023 00:00:00 GMT Kanboard is a widely used Kanban project management software with over 10 million downloads on Docker Hub. Today we're going explore how I found ... Open Redirect Business Logic https://castilho.sh/css-injection-credit-card https://castilho.sh/css-injection-credit-card Tue, 01 Mar 2022 00:00:00 GMT In this writeup I'll walk you through how I used CSS Injection to steal users Credit Card Info via Post-Messages ... Web Sockets CSS Injection https://castilho.sh/cve-2022-0478 https://castilho.sh/cve-2022-0478 Wed, 02 Feb 2022 00:00:00 GMT It's been a while since I posted something ... But I plan to bring new content into the blog and to get off on the right foot. We'll start with ... SQL Injection Business Logic