Recent content in Home on eval.blog
There’s an unfixed gadget living in Flask Ninja. Its HttpBearer authenticator reads the credential from a header named by a plain, writable attribute, so a deserialization sink that calls its result, or config that hydrates the auth object from untrusted data, is enough to repoint it at an internal header and leak it.
Exploring prompt injection techniques to extract hidden system prompts from popular AI wrappers and chatbots.
Reported a Denial of Service (infinite loop) vulnerability in the zipp module, which also affects Python’s built-in zipfile module (part of the standard library).
Reported an OAuth token leak via open redirect in Harvest.
AppSec Village DEF CON 31 CTF^2 (developer) winning entry. Bypassed the encryption and mutation techniques of the Mutant Language.
How to use unit testing frameworks like xUnit for automated vulnerability scanning and exploit development.
Identified a vulnerability in PHP’s FILTER_VALIDATE_URL filter by discovering a bypass that allowed an invalid URL to be validated.
Reported a stored cross-site scripting vulnerability in CraftCMS that was assigned CVE-2021-27902.
SSTI in CraftCMS, part of a chain of multiple vulnerabilities leading to RCE.
Reported CVE-2021-27902 (XSS) and CVE-2021-27903 (SSTI) that can be chained together to gain Remote Code Execution in CraftCMS.
Reported a vulnerability in PHPMailer where a function could run unexpectedly while sending a mail leading to untrusted code execution.
Discovered a method to leak IP addresses in a misconfigured WordPress instance (useful when targets are behind a dns firewall like CloudFlare)
Why data URLs are a powerful alternative to hosted JavaScript files for XSS testing and payload delivery.
A practical guide to traditional and dynamic importing in Python, including importlib, relative imports, and best practices.
Publicly disclosed vulnerability reports that did not receive CVE identifiers.