When WebSockets Lead to RCE in CurseForge
An unauthenticated local WebSocket server in the CurseForge launcher allowed any website to trigger remote code execution via attacker-controlled JVM arguments.
Elliott.diy
A personal site for experiments in cybersecurity, reverse engineering, and whatever breaks along the way.
Latest posts
Supershy: Remote Code Execution in a VPN Client
How I found a RCE vulnerability in a privacy VPN.
Lockbit Wallet Tracking
Scanned 62k Bitcoin addresses from the LockBit ransomware leak to see which wallets were funded. Here’s what I found.