4 min read
Escalating Self-XSS for Riches
I have a bit of a love hate relationship with Self XSS. I find them somewhat regularly, and while I do think programs should pay a bounty for them (the lowest they offer), I’m…
tag
hacking
26 posts
2 min read
A Very Brief Look at YesWiki
After I created TemplateSearch.io, I was testing it out by searching for random things and I came across several templates for YesWiki. So I Googled it to see exactly what it is…
1 min read
Behold! TemplateSearch.io
I was tired of manually searching for the right Nuclei templates to use. The one existing site that lets you search them — while interestingly designed and certainly more stylish…
2 min read
Installing Tailscale on a Wifi Pineapple
I went to install Tailscale on a Wifi Pineapple, and the normal pipe to bash (lol) script didn't work. I had to do it manually like this. YMMV attempt at your own risk . I'm…
1 min read
California Top 25 Researcher 2024
I received an email saying I'm a top 25 researcher in the California VDP from 2024. Not too bad from the thousands of reports they get, I'm sure.
3 min read
Mura/Masa CMS - SQL Injection CVE-2024-32640
A while back the illustrious team over at Project Discovery wrote about the discovery of an SQLi in Masa/Mura CMS . It's a good writeup, so go check it out for the technical…
3 min read
iOS 16.7.8 Jailbreak on iPhone X
If you're a pentester or bug bounty hunter that is trying to do some iOS mobile application testing, half the battle is getting a phone properly jailbroken so you can proxy HTTP…
4 min read
Hacking RAMADDA, White Box Web Apps, and Bug Bounty Tips
Note: disregard any layout/content/formatting errors as this post was migrated from wordpress to jekyll As mentioned in a previous post, I was the July RotM for the DoD VDP…
1 min read
Department of Defense Researcher of the Month (Year)
I was recently awarded the DoD Researcher of the Month for July, 2023 . Between moving across the country and other hacking duties, I still had time to hammer away at a particular…
1 min read
SQL Injection in Eufy Security Application
I found a textbook SQLi in the Eufy Security application. Don't mind the heavy use of red blocks to redact. The first, normal request. Everything looks fine. Notice the response…
1 min read
Self-Hosted Security Part ? - Poor Rate Limiting in Organizr
Organizr is a self hosted application written in PHP that basically helps you self host other services at your home. It's nifty application with a surprisingly large amount of…
3 min read
Webmin CVE-2022-0824 RCE in Golang
I've continued my quest to translate exploits into Golang. Here is an RCE in Webmin due to broken access controls. Please see the following links for more information.…
1 min read
Guitar Pro Directory Traversal and Filename XSS
These were given CVE 2022 43263 and CVE 2022 43264. I found these vulnerabilities in the latest version of Guitar Pro (1.10.2) on the iPad and iPhone. Neither one is that great of…
2 min read
CrushFTP DoS
I was doing a security review of CrushFTP , a multi platform FTP application, and I came across a DoS stemming from lack of validation of user input. Originally, I thought there…
2 min read
Golang Proof of Concept Exploit for CVE-2021-44077: PreAuth RCE in ManageEngine ServiceDesk Plus < 11306
Once again, I decided to rewrite an exploit in Golang. Once again, I did thirty seconds of searching to find if someone had already written this one in Golang. Once again, I did…
1 min read
A Quick AWS Lambda Reverse Shell
Let's say you're doing a pentest, and you run across access to AWS Lambda. I recently learned you can get a persistent shell (for 15 minutes, at least) via Lambda, which seemed…
1 min read
The Incredibly Insecure Weather Station - Part 2
The weather station issues were given CVE 2022 35122 . I contacted the manufacturer in regards to these issues. They responded quickly. I wasn't expecting anything to be done…
2 min read
The Incredibly Insecure Weather Station
This was given CVE 2022 35122. I recently purchased the ECOWITT GW1102 Home Weather Station . It's exactly what it sounds like a mini weather station for your house. It has all…
2 min read
MotionEye Config Info Disclosure
This was given CVE 2022 25568. As mentioned in my previous posts here and here , I've done a little digging into the conditions that are required for the MotioneEye config file to…
1 min read
Update: Hacking MotionEye - CVE-2021-44255
I was given CVE 2021 44255 for this authenticated RCE via a malicious tasks (python pickle) file. So that's fun. Even though it is authenticated, the default username is admin and…
1 min read
Sharpshooter, Python2.7, and Pip2 Installation
Newer versions of Linux may not come with any sort of Python 2 installed. I recently wanted to run Sharpshooter , which is a "payload creation framework for the retrieval and…
1 min read
Learning Go By Writing a POC for Gitlab CVE-2021-22205
I've been wanting to learn Go, and I learn by doing, so I decided to write a POC for CVE 2021 22205, which is fairly straightforward RCE in Gitlab that dropped a few weeks ago. My…
7 min read
Hacking MotionEye/MotionEyeOS
Getting Started with MotionEye MotionEye is an open source, web based GUI for the popular Motion CLI application found on Linux. I've known of the Motion command line app for…
1 min read
CVE-2021-35959 Stored XSS in Folder Contents on Plone 5-5.2.4
I've been testing some new Python based CMSs and CMS like software. I've heard of Plone before, but I never had a chance to check it out until now. I was a couple of days into my…
3 min read
Arbitrary Code Execution in Manuskript < 0.12
A pull request has been submitted to remove this functionality and to depricate the old pickled settings, which is a wise security decision. Edit: This vulnerability has been…
1 min read
Malicious qBittorrent Search Plugin: Feature or Bug?
TLDR: Read the code before you install random qbittorent plug ins. qBittorrent has a feature that allows you to install a search plugin to search for torrents on your favorite…