https://pizzapower.me a blog on security, homelabs, networking, etc. en-us Tue, 07 Jul 2026 00:00:00 GMT https://pizzapower.me/posts/hello-new-blog https://pizzapower.me/posts/hello-new-blog Tue, 07 Jul 2026 00:00:00 GMT The blog moved off Jekyll and GitHub Pages onto Next.js stack on Vercel site meta https://pizzapower.me/posts/uhf-iptv-review https://pizzapower.me/posts/uhf-iptv-review Thu, 18 Dec 2025 00:00:00 GMT I recently posted about getting IPTV up and running in Plex. Admittedly, it's a bit of a pain to do so and there are some drawbacks to it. I eventually stumbled upon this UHF app… IPTV Plex streaming DVR EPG M3U Home Server https://pizzapower.me/posts/beware-burp-suite-ai-explore-feature-using-malicious-commands https://pizzapower.me/posts/beware-burp-suite-ai-explore-feature-using-malicious-commands Wed, 19 Nov 2025 00:00:00 GMT I recently decided to try the explore with AI feature of Burp Suite after param miner discovered an issue I hadn't seen before. It proceeded through the process, then eventually… burp suite web application penetration testing AI LLM artifical intelligence https://pizzapower.me/posts/using-3-monitors-with-macbook-pro-m3-max-and-a-dock https://pizzapower.me/posts/using-3-monitors-with-macbook-pro-m3-max-and-a-dock Tue, 02 Sep 2025 00:00:00 GMT I was running my MacBook M3 Max connected to a Dell D6000 dock. After installing the DisplayLink software on the Mac, I was able to connect two monitors to the dock and one to the… https://pizzapower.me/posts/iptv-plex-epg-streaming-setup https://pizzapower.me/posts/iptv-plex-epg-streaming-setup Mon, 01 Sep 2025 00:00:00 GMT So, you want to stream IPTV in Plex. Here is how you can do it. Prerequisites At least a little bit of technical knowledge. You may want to use Docker or download and run a… IPTV Plex streaming DVR EPG M3U Home Server https://pizzapower.me/posts/building-a-new-home-server https://pizzapower.me/posts/building-a-new-home-server Sat, 12 Jul 2025 00:00:00 GMT I was bored, so I decided to build a new home server. I wasn't running into too many limitations with the previous incarnation, but the video card was a bit old (1080ti), and… server PC zfs home server https://pizzapower.me/posts/ubiquiti-udm-se-power-supply-fix https://pizzapower.me/posts/ubiquiti-udm-se-power-supply-fix Tue, 24 Jun 2025 00:00:00 GMT The UDM SE died with a dead power supply Ubiquiti won't sell you. Here's the ~$80 Mean Well replacement that brought it back to life. unifi routers homelab repair https://pizzapower.me/posts/ipad-pro-vs-manta-supernote-a5x2-vs-remarkable-paper-pro https://pizzapower.me/posts/ipad-pro-vs-manta-supernote-a5x2-vs-remarkable-paper-pro Fri, 16 May 2025 00:00:00 GMT Now with early 2026 updates. Note, I may get comission from some of these links: I'm a big paper note taker, and I go through a bunch of notebooks and pens a year. I mostly use it… eink tablets notes https://pizzapower.me/posts/building-a-custom-oob-server https://pizzapower.me/posts/building-a-custom-oob-server Sat, 10 May 2025 00:00:00 GMT If you're reading this, you've probably used Burp, and you're probably aware of Burp Collaborator, the out of band detection feature. Basically, it gives you a (sub)domain name… bug bounty burp interactsh oob blind xss ssrf https://pizzapower.me/posts/why-is-nessus-so-bad https://pizzapower.me/posts/why-is-nessus-so-bad Sat, 10 May 2025 00:00:00 GMT Nessus is neverendingly annoying. 1. Takes way too long to install and "initialize". 2. Can't open anything in a new tab. 3. Can't easily copy large lists of IPs (e.g. a… nessus vulnerability scanning https://pizzapower.me/posts/escalating-self-xss-for-riches https://pizzapower.me/posts/escalating-self-xss-for-riches Wed, 30 Apr 2025 00:00:00 GMT I have a bit of a love hate relationship with Self XSS. I find them somewhat regularly, and while I do think programs should pay a bounty for them (the lowest they offer), I’m… bug bounty xss hacking penetration testing https://pizzapower.me/posts/a-quick-look-at-yeswiki https://pizzapower.me/posts/a-quick-look-at-yeswiki Tue, 29 Apr 2025 00:00:00 GMT After I created TemplateSearch.io, I was testing it out by searching for random things and I came across several templates for YesWiki. So I Googled it to see exactly what it is… hacking bug bounty penetration testing web application cve pentesting research white box https://pizzapower.me/posts/funny-bug-bounty-reports-1 https://pizzapower.me/posts/funny-bug-bounty-reports-1 Mon, 28 Apr 2025 00:00:00 GMT This is the first part in my new series "Funny Bug Bounty Reports". These are not judged on their merits, technical abilities, or anything other than if they make me laugh. Today,… funnybbreports bug bounty penetration testing https://pizzapower.me/posts/behold-templatesearch.io https://pizzapower.me/posts/behold-templatesearch.io Wed, 09 Apr 2025 00:00:00 GMT I was tired of manually searching for the right Nuclei templates to use. The one existing site that lets you search them — while interestingly designed and certainly more stylish… hacking nuclei nuclei templates bug bounty pentesting https://pizzapower.me/posts/installing-tailscale-on-wifi-pineapple https://pizzapower.me/posts/installing-tailscale-on-wifi-pineapple Sat, 05 Apr 2025 00:00:00 GMT I went to install Tailscale on a Wifi Pineapple, and the normal pipe to bash (lol) script didn't work. I had to do it manually like this. YMMV attempt at your own risk . I'm… hacking wifi wireless penetration test pentesting https://pizzapower.me/posts/top-25-state-of-california-researcher https://pizzapower.me/posts/top-25-state-of-california-researcher Fri, 04 Apr 2025 00:00:00 GMT I received an email saying I'm a top 25 researcher in the California VDP from 2024. Not too bad from the thousands of reports they get, I'm sure. california hacking bug bounty vdp vulnerability disclosure https://pizzapower.me/posts/clickhouse-db-security https://pizzapower.me/posts/clickhouse-db-security Tue, 01 Apr 2025 00:00:00 GMT I recently ran across an application that allowed access to a ClickHouse DB for my user. The access was allowed, so that isn't an issue. However, when we as pentesters or bug… db clickhouse cybersecurity misconfigurations bug bounty clickhouse reverse shell penetration testing https://pizzapower.me/posts/bugcrowd-p1-warrior https://pizzapower.me/posts/bugcrowd-p1-warrior Mon, 17 Mar 2025 00:00:00 GMT The other day I received an email saying I was eligible for some swag for getting my 25th valid P1 submission on BugCrowd. I don't do too much BB hunting these days, and also not… bugcrowd bug bounty https://pizzapower.me/posts/remarkable-paper-pro-html-injection https://pizzapower.me/posts/remarkable-paper-pro-html-injection Thu, 06 Feb 2025 00:00:00 GMT That's in quotes, because this is seemingly a self HTML injection with little to no security impact, but it does allow for you to change your reMarkable's sleep screen in a… https://pizzapower.me/posts/mura-masa-cms-sql-injection-cve-2024-32640 https://pizzapower.me/posts/mura-masa-cms-sql-injection-cve-2024-32640 Wed, 13 Nov 2024 00:00:00 GMT A while back the illustrious team over at Project Discovery wrote about the discovery of an SQLi in Masa/Mura CMS . It's a good writeup, so go check it out for the technical… CVE cyber cybersecurity hacking masa mura python sqli bug bounty bugbounty https://pizzapower.me/posts/ios-16-7-8-jailbreak-on-iphone-x https://pizzapower.me/posts/ios-16-7-8-jailbreak-on-iphone-x Thu, 25 Jul 2024 00:00:00 GMT If you're a pentester or bug bounty hunter that is trying to do some iOS mobile application testing, half the battle is getting a phone properly jailbroken so you can proxy HTTP… cybersecurity hacking infosec ios 16.7.8 jailbreak iphone jailbreak linux mobile mobile application penetration testing offsec bug bounty jailbreak https://pizzapower.me/posts/hacking-ramadda-white-box-web-apps-and-bug-bounty-tips https://pizzapower.me/posts/hacking-ramadda-white-box-web-apps-and-bug-bounty-tips Fri, 20 Oct 2023 00:00:00 GMT Note: disregard any layout/content/formatting errors as this post was migrated from wordpress to jekyll As mentioned in a previous post, I was the July RotM for the DoD VDP… appsec cybersecurity debugging hacking infosec java rce white box xss aws bug bounty bugbounty CVE https://pizzapower.me/posts/department-of-defense-researcher-of-the-month-and-more https://pizzapower.me/posts/department-of-defense-researcher-of-the-month-and-more Fri, 18 Aug 2023 00:00:00 GMT I was recently awarded the DoD Researcher of the Month for July, 2023 . Between moving across the country and other hacking duties, I still had time to hammer away at a particular… cyber cybersecurity hacking infosec bug bounty https://pizzapower.me/posts/pymedusa-os-command-injection https://pizzapower.me/posts/pymedusa-os-command-injection Mon, 27 Mar 2023 00:00:00 GMT PyMedusa is a well known video library manager that many of us self hosted types may use to organize our libraries. I decided to give it a spin one day and found a classic OS… cybersecurity offsec OSCP OSWE self hosting certifications CVE offensive security python security https://pizzapower.me/posts/sql-injection-in-eufy-security-application https://pizzapower.me/posts/sql-injection-in-eufy-security-application Mon, 20 Feb 2023 00:00:00 GMT I found a textbook SQLi in the Eufy Security application. Don't mind the heavy use of red blocks to redact. The first, normal request. Everything looks fine. Notice the response… cybersecurity hacking iot sqli infosec security https://pizzapower.me/posts/self-hosted-security-part-taking-over-organizr-accounts https://pizzapower.me/posts/self-hosted-security-part-taking-over-organizr-accounts Wed, 25 Jan 2023 00:00:00 GMT Organizr is a self hosted application written in PHP that basically helps you self host other services at your home. It's nifty application with a surprisingly large amount of… cybersecurity hacking infosec self hosting bug bounty CVE offensive security https://pizzapower.me/posts/docker-compose-plex-jackett-sonarr-radarr-lidarr-prowlar-qbittorrent-and-pia https://pizzapower.me/posts/docker-compose-plex-jackett-sonarr-radarr-lidarr-prowlar-qbittorrent-and-pia Fri, 25 Nov 2022 00:00:00 GMT I updated this post to add in prowlarr support. But here is the updated docker compose.yml. version: '3.8' services: pms docker: container name: plex network mode: host hostname:… docker lidarr linux pia prowlarr qbittorrent radarr self hosting sonarr torrents https://pizzapower.me/posts/webmin-cve-2022-0824-rce-in-golang https://pizzapower.me/posts/webmin-cve-2022-0824-rce-in-golang Mon, 17 Oct 2022 00:00:00 GMT I've continued my quest to translate exploits into Golang. Here is an RCE in Webmin due to broken access controls. Please see the following links for more information.… CVE GOLANG hacking POC coding cybersecurity infosec offensive security offsec https://pizzapower.me/posts/guitar-pro-directory-traversal-and-filename-xss https://pizzapower.me/posts/guitar-pro-directory-traversal-and-filename-xss Tue, 11 Oct 2022 00:00:00 GMT These were given CVE 2022 43263 and CVE 2022 43264. I found these vulnerabilities in the latest version of Guitar Pro (1.10.2) on the iPad and iPhone. Neither one is that great of… cybersecurity directory traversal guitar pro hacking infosec xss offensive security offsec https://pizzapower.me/posts/crushftp-dos https://pizzapower.me/posts/crushftp-dos Fri, 30 Sep 2022 00:00:00 GMT I was doing a security review of CrushFTP , a multi platform FTP application, and I came across a DoS stemming from lack of validation of user input. Originally, I thought there… crushftp cyber dos hacking infosec offsec coding security