Recent content on Amal Murali
A while ago, I stumbled across this intriguing tweet from security researcher Vsevolod Kokorin (@slonser_). The three-line snippet was almost boring - create an image element, point the src at a user-controlled URL, drop it into the DOM. In the replies of the tweet, a Google security engineer confirmed it's a 0day. An actively exploited 0day? I had to dig deeper.
Google CTF releases some really cool challenges every year. This year was no exception. `onlyecho` was one of the relatively easier ones, but it ended up being a lot of fun to solve. I was intrigued by the challenge and decided to dive right in.
Cluelessly staring at a vague hint for hours, relentlessly going down multiple rabbit holes, the joy of finally finding a solution... what's not to love? After all, this is fairly similar to a regular day in information security. I decided to check out this year's puzzles.
The challenge was hosted at this URL. Upon visiting the link, I was greeted with a game. At first glance, it resembled the familiar Tetris game, but something was noticeably off. Instead of the usual four blocks per piece, this game featured five. Curious about the mechanics, I decided to inspect the source code.
A new RCE in Git caught my attention on a recent security feed, labeled CVE-2024-32002. Given Git’s ubiquity and the widespread use of the clone command, I was instantly intrigued. Could something as routine as cloning a repository really open the door to remote code execution? My curiosity was piqued, and I had to investigate. Plus, who doesn't want an excuse to break stuff in the name of…
Cluelessly staring at a vague hint for hours, relentlessly going down multiple rabbit holes, the joy of finally finding a solution... what's not to love? After all, this is fairly similar to a regular day in information security. I decided to check out this year's puzzles.
A tweet showing an RCE in ExifTool popped up on my feed; it looked interesting — maybe a little scary. But what good is an RCE on a demo video? I wanted more; I wanted it to pop my calculator.exe, to rm -rf my home directory; heck, it could even Rick Roll me. However, like with all things in life, there was no publicly-available proof-of-concept. So I decided to make my own.
Intigriti releases cool challenges every once in a while, and this was no exception. I love a good challenge. Every time I solve an Intigriti challenge, I learn something new. Motivated by that, I wanted to crack this one too. As usual, there were many dead-ends, moments of frustration and head-scratches. However, I’ll save your scalp from the scratching and walk you through this challenge. The…
This writeup has since won the H1–702 challenge. Read HackerOne blog here: https://www.hackerone.com/blog/H1-702-CTF-Winners-Announced When you open the challenge link, you’re presented with this: Instructions can be found on the web challenge site: http://159.203.178.9/ Open the link in your browser and you’re greeted with a normal-looking HTML page: Notes RPC CTF homepage It sounds like there is…
Challenge Description Cat Chat app popup Getting familiarized When you open the link, it redirects you to a chat room with a random UUID which is probably the chat room ID. Challenge homepage This looks like a chat application built with NodeJS where anyone can join and chat with each other. If you use /name bob , your display name gets changed to that. If you type /report , an admin will join the…
I currently work as Manager, Security Operations at Bugcrowd . Besides leading the team, I perform triage for numerous Bug Bounty Program, do security research, implement automation to streamline workflows, and work on other internal projects. Previously, I worked at Postman (they recently crossed 20M users 🚀) as a Senior Security Engineer, where I led several security engineering initiatives and…