3 min read
Mura/Masa CMS - SQL Injection CVE-2024-32640
A while back the illustrious team over at Project Discovery wrote about the discovery of an SQLi in Masa/Mura CMS . It's a good writeup, so go check it out for the technical…
tag
cyber
8 posts
1 min read
Department of Defense Researcher of the Month (Year)
I was recently awarded the DoD Researcher of the Month for July, 2023 . Between moving across the country and other hacking duties, I still had time to hammer away at a particular…
2 min read
CrushFTP DoS
I was doing a security review of CrushFTP , a multi platform FTP application, and I came across a DoS stemming from lack of validation of user input. Originally, I thought there…
2 min read
Golang Proof of Concept Exploit for CVE-2021-44077: PreAuth RCE in ManageEngine ServiceDesk Plus < 11306
Once again, I decided to rewrite an exploit in Golang. Once again, I did thirty seconds of searching to find if someone had already written this one in Golang. Once again, I did…
1 min read
The Incredibly Insecure Weather Station - Part 2
The weather station issues were given CVE 2022 35122 . I contacted the manufacturer in regards to these issues. They responded quickly. I wasn't expecting anything to be done…
2 min read
MotionEye Config Info Disclosure
This was given CVE 2022 25568. As mentioned in my previous posts here and here , I've done a little digging into the conditions that are required for the MotioneEye config file to…
1 min read
Sharpshooter, Python2.7, and Pip2 Installation
Newer versions of Linux may not come with any sort of Python 2 installed. I recently wanted to run Sharpshooter , which is a "payload creation framework for the retrieval and…
7 min read
Hacking MotionEye/MotionEyeOS
Getting Started with MotionEye MotionEye is an open source, web based GUI for the popular Motion CLI application found on Linux. I've known of the Motion command line app for…