How Hotel Wi-Fi Broke My Tailscale Peer Relay
How to setup Tailscale peer relays to listen on multiple ports.
Nick Frichette - Blog
Personal blog, focused on information security. AWS, Web apps, offensive techniques, and more.
Latest posts
Amplified exposure: How AWS flaws made Amplify IAM roles vulnerable to takeover
Public disclosure of a vulnerability in AWS Amplify which exposed IAM roles associated with Amplify projects to be assumed by anyone in the world.
Two Minor Cross-Tenant Vulnerabilities in AWS App Runner
Writeup for two minor cross-tenant vulnerabilities I found in AWS App Runner.
Using an Undocumented Amplify API to Leak AWS Account IDs
Writeup for a technique I found to leak an AWS account ID from an Amplify app.
A Look at AWS API Protocols
An introduction to AWS API protocols and how they work.
A Confused Deputy Vulnerability in AWS AppSync
Datadog: Technical analysis of a confused deputy vulnerability I found in AWS AppSync.
OpenSSL Punycode Vulnerabiliy (CVE-2022-3602)
Datadog: A technical analysis of the OpenSSL punycode vulnerability.
Revisiting Lambda Persistence
Revisiting and building on the original Lambda persistence technique.
XSS in the AWS Console
Writeup for a cross-site scripting bug I found in the AWS Console.
Intercept SSM Agent Communications
Research on post-exploitation techniques against SSM Agent abusing send-command and start-session.
Enumerate AWS API Permissions Without Logging to CloudTrail
Writeup for a bug I discovered in the AWS API that would allow you to enumerate certain permissions for a role without logging to CloudTrail.
Abusing AWS Connection Tracking
Tunnel out of restricted security groups by abusing connection tracking.
Abusing GitLab Runners
Some research I did on abusing GitLab Runners to steal information by emulating a runner's behavior.
CVE-2020-11108: How I Stumbled into a Pi-hole RCE+LPE
Writeup for CVE-2020-11108 covering how I found the vulnerability and how it can be exploited for fun/profit.
Escalating Deserialization Attacks (Python)
Demonstrating how to exploit deserialization attacks in Python 2/3
Intercept Linux CLI Tool Traffic
A guide on how to intercept Linux CLI tool traffic with Burp Suite
Bypass GuardDuty PenTest Alerts
A guide to bypass the GuardDuty PenTest Finding Type
Hijacking IAM Roles and Avoiding Detection
A guide on how to steal IAM role keys and use them without being detected
IDOR Attacks
An introduction to IDOR attacks
Security Headers: Content Security Policy
An in depth overview of the Content Security Policy header
Angular Universal: Some Insights
Some advice based on my experience with Angular Universal
OSCP Review
My thoughts and experiences with the OSCP