Recent content on Flomb Blog
In HTTP/1, the CONNECT method instructs a proxy to establish a TCP tunnel to a requested target. Once the tunnel is up, the proxy blindly forwards raw traffic in both directions. This mechanism is most commonly used to tunnel TLS traffic through forwarding proxies. 
 While digging through the HTTP/2 specification ( RFC 9113 ), I noticed it also features the CONNECT method but with a slight…
Wiz recently discovered an unauthenticated remote code execution (RCE) vulnerability in the Ingress NGINX admission controller. I found the exploit chain particularly intriguing and decided to recreate it for a deeper understanding. 
 I want to thank my employer CODE WHITE for the permission to publish this post. As part of our Security Intelligence Service, we identified, exploited, and…
This is the story of how I found two vulnerabilities in the Tekton CI/CD Dashboard component that allow remote code execution and a potential node takeover if deployed in read/write mode as well as pre-authenticated access to the Kubernetes API server in all modes. 
 Both vulnerabilities were treated as intended and are thus still exploitable. The documentation was changed and the default mode…
I recently stumbled upon a great writeup which explained how it is possible to get a SSRF from SNI to hit the Azure VM Instance Metadata Service(IMDS) . Inspired, I started scanning for this behaviour within a bug bounty scope . Not finding a single target, I proceeded to scan for the more “generic” finding of SNI based SSRF which yielded some interesting results. 
 To be honest, I…
The following write-ups detail a privilege escalation vulnerability in Databricks that I discovered during my time at a previous employer. Due to contractual obligations, the post only contains links to external resources. For political reasons, there are three versions of the same write-up with varying degrees of detail. 
 
 Securing Databricks cluster init scripts 
 Securing…
Simple, mostly security oriented, personal blog. 
 
 
 
 
 
 
 @flomb_ 
 
 
 
 
 
 
 @fl0mb.bsky.social 
 
 
 
 
 
 
 
 
 RSS