My personal security blog
Before jumping into this article please take a look at the following Cloudflare ruleset and think for a while what is wrong with it? I set up above rules and thought they would work like the following: From the first glance it seems perfectly fine. Website administrator wants to challenge users opening the website to prevent bot traffic. Additionally he specifies a rule that blocks access to…
If you’re reading this blog post, it’s likely that you’re also doing bug bounty. Maybe you’re even doing it professionally as a daily job. That’s great, and I envy you, as I could never really get into the idea of becoming a full-time bug bounty hunter. Maybe my past experiences with it, such as hitting the triage wall or long response times, discouraged me from stepping up my bug hunting game.…
tl;dr This post is a summary of our security research work that started a year ago. Together with Franek , we’ve targeted LG enterprise TV operating system – WebOS Signage. As a result of our work, we’ve discovered multiple vulnerabilities where only two of them were published by LG. Those vulnerabilities resulted in a chained exploit that allowed remote attacker on the same network to execute…
Overview Cisco Smart Software Manager (or SSM), is an open-sourced solution from Cisco to manage and distribute license entitlements for all Cisco products in your local network. It connects to cloud based SSM which is linked with the on-prem instance via Virtual Account. A very brief diagram of the system can be found below:…
This is a short writeup of the lastest Yeswehack’s Dojo challenge. The challnege is all about bypassing the XSS filter and exfiltrating sensitive data. From the challenge description , we can read the following: This code runs a JavaScript code inside a script that craft a “secret” variable, Execute Javascript (XSS) and alert (popup) the value of the original variable secret, Alert (popup) the…
XSS challenges are a great way to learn cool tricks on how to exploit client side and circumvent browser’s security measures. This months Intigriti XSS challenge was made by @aszx87410 . The requirements for the solution were simple: It should work on the latest version of Chrome and FireFox. It should execute alert(document.domain). It should leverage a cross site scripting vulnerability on this…
Recently I decided to do a little cleanup in my computer stuff cabinet and found my old NAS (Network Attached Storage) that I’ve beed using some time ago. The device was a Thecus N299 - a basic model capable of running two 2,5” HDDs in a RAID matrix. As the support for this device ended in 2007 I was asking myself why I was keeping it around for so long. I booted up the NAS and checked if there…
TL;DR When an attacker gains access to publicly exposed and insecured OctoPrint panel he can execute commands on the host due to the way the application is designed. In order to secure your OctoPrint instances NEVER expose the host to the public access and if you have to, use VPN or other access control to secure it. The application One time when I was browsing github in a quest for finding an…
While doing research on one of the open source web applications I came across a Cross-Site Scripting trick that seems dumb but is actually useful in some situations. In this post I will describe such situation that is interesting enough and not so obvious to exploit. Vulnerable API As I mentioned the culprit of this post is a web application (for the greater good I cannot share any details about…
Recently whole cybersecurity community was shocked by a newly disclosed Microsoft Exchange pre-auth vulnerability aka Proxylogon . This security flaw when chained with another SSRF vulnerability allow unauthenticated RCE on almost any outdated Exchange server. This resulted in many companies compromised and malware using this exploit as an entry point to be observed in the wild. The client side…