Recent content on robin verton - Software engineer, security engineer, security expert
The Claude Desktop app is slow as hell and takes multiple seconds to open. I prefer the CLI version of Claude, which is way faster. However, I also like using Raycast for quick access to apps and commands. Update: Since Ghostty 1.3.0, there is direct support for AppleScript, which makes it more robust to open new terminal windows and run commands. The script below has been updated to use…
AI is rushing deep into the tech world. I’m jumping between astonishment and having an existential crisis, at least for some parts of what I’m doing. I really love writing code, and doing it manually is a big part of it. It’s more than just a hobby for me: shaping ideas and bringing them to life by hand, creating something reusable (and sometimes useful), and sharing it with the world. From…
This cost me some time googling and fiddling around with my config, so here is a quick setup on how to get Go’s html/template format working with neovim. This template syntax is also used by Hugo (which I use for this page). First, install a formatter which is able to format Go’s template syntax: npm install --save-dev prettier prettier-plugin-go-template To tell prettier to use this…
I like to write all kind of documentation in Markdown. This is however not the preferred way how some clients want to have their documentation written in: they prefer a single, big document. For a current project, we use a nice project called Eisvogel which is a pandoc LaTeX template. Pandoc will merge all markdown files together and generate a PDF based on the eisvogel template. A simple make…
I’m currently developing a webservice in Go for a customer, where I need to write a lot of HTTP endpoints. Most of them have a very similar structure: Binding request data (path parameter, query parameter, body parameter) to a var Validate data Work with data, mostly CRUD Return response While the Echo framework already provides some useful helper to bind and plug in a validator, my function…
I’m currently developing a web application with the Phoenix framework, which makes use of .html.heex templates. Highlighting and Tailwind CSS works out of the box, however my Tailwind LSP was not working correctly in these templates. I had to fiddle a bit and search a lot of issues/comments, so here is a working LSP configuration for heex+tailwind: nvim_lsp.tailwindcss.setup{ filetypes = {…
I wanted to compile a binary which contains a whole Go web app and is deployed as a Lambda function to AWS. This function (or binary) should also have a cache from CloudFront in front of it. Using the newly introduced stale-while-revalidate support from CF, this app should be very fast without waiting for a cold start: Instead of waiting for a cold start, a cache entry is responded while a new…
Bootstraping Terraform and putting the state on S3 has a chicken-egg problem: How to manage the S3 bucket which holds the state file without it already existing? To do this, the statefile can be put local when initiating. Then an S3 bucket can be created and the state automatically migrated to S3. To view a video on how to do this, go here. Initialize with local state file terraform {…
I wrote a tool to log events and monitor (cron) jobs in your private tailscale network. The tool is called tevents and I wrote an introduction blog post in the new Tailscale.dev blog.
I am a huge fan of simplicity. While writing hntr, I wanted to create a powerful but easy to use tool to handle huge amounts of recon data (asset data used for security purposes). Most of the time I also use this little side-projects to play with (for me new) technologies, libs or tools. I tried a few Go ORM tools in the past which save some time, at least up to a certain degree.
In the last weeks I hacked together a tool to help me organize my (temporary) target and infrastructure data I gather during audits. All existing solutions were not quite dynamic like how I wanted it to be, so this was a good hobby project for my freetime. hntr (you guessed it, coming from ‘hunter’) allows to create little throwaway boxes which you can fill with data. You do not need to throw them…
After using ploi to deploy a Laravel app in the past I really enjoyed the simplicity of just using a git push to deploy my application to staging/production. Ploi configures your Github repository to use a webook to notify Ploi if a new commit was made. It then pulls the source and deploys it. While ploi does not (yet) offer to manage python/django applications, I found a few resources where this…
Summary: Under some conditions, it is possible to smuggle HTTP headers through a reverse proxy, even if it was explicitly unset before. This is possible in some cases due to HTTP header normalization and parser differentials. Because HTTP headers are commonly used as way to pass authentication data to the backend (for example in mutual TLS scenarios), this can lead to critical vulnerabilities.…
Some time ago I found a blind SQL injection on a bug bounty target. The web page was built with ASP.NET and had a big attack surface. After crawling through hundreds of pages and looking at endpoints, I found one accepting a parameter called something like table (next to a dozen other parameters). A simple manual test by inserting a few special characters showed up to be promising, as it resulted…
There is a simple trick Seb and me used in a few CTFs which it seems some CTFS players are not aware of – at least that’s what it looks like when looking at writeups. It’s a simple way of getting a reverse shell on challenges which use a forking server. Most of the time there are two kinds of pwnables: Binaries which read and write to stdin/stdout and are piped to network sockets with tools…
For a side project I am currently working on I was in the need of some interactive (JavaScript) widget. After reading a lot about Vue in the last time, I decided to give it a try. Turns out if you want to add Vue to an existing project and still keep the benefits of single file components, a hot-reloading server etc., you are leaving the common scenario of SPAs and have to work around a few…
This is the first crypto challenge I solved which was really interesting to work on. When entering the given URL from the challenge description, the following link is shown: http://35.198.133.163:1337/files/952bb2a215b032abe27d24296be099dc3334755c/?f=sample.gif Browsing to the /files folder also shows two other files: dont.gif and flag. Visiting the sample.gif url will show a sample.gif file.…
After I spent some time looking for a traveling notebook, I finally made a choice and bought an Acer Chromebook 14. It’s a beautiful, lightweight and minimal laptop. The tech specs (1.6GHz, 4GB RAM, 32GB ) are not that good, but sufficient for the things I’m planning to do with it. I made a very good deal and got a (nearly) untouched one for about 230€. After playing a bit with…
Joe, your intelligent conversation partner For the Joe challenge, you got access to a simple page which looked like a chat. Over a text box you were able to talk with Joe, an “intelligent” conversation partner/bot. Joe had a few functionalities: Print out Joe’s name Set a new name Some small talk stuff Report a bug to an admin The challenge description already told us to steal…
This was not a typical web challenge, apart from beeing accessible over the web. The aim was to successfully execute a tar command (and do something usefull with it). The returned code of executed tar command was then returned to the user. I always got a “tar returned 2”, meaning that the file I was trying to (un)tar was not found. Chars to travers or inject were all filtered. I tried…
The only accessible page for Share Point was a login form. After fiddling with the login, I noticed that you were able to login with some basic credentials like admin1111:password or admin11111:password. In the member area we had three possibilities: Upload a file View Files Shared Files Logout Firt I tried to upload some .php files, which did not work (only some extensions like .jpg or .txt were…
Exploitation was straight forward by abusing a format string vulnerability to overwrite .got. The strchr was called immediately after the printf call with our passed string as an argument, so it was only needed to overwrite this with the address of system.
Some days ago I started reading into Return Oriented Programming and had a lot of fun doing some VMs and exercises I found over the internet. ROP is a technique which allows attackers to execute code in the presence of defense mechanism like DEP/NX. I’m not explaining what ROP is and how it is done, because a lot of other people have done this already. Instead I want to share a solution I…
After the proof of concept code for CVE-2016-5195 (DirtyCow) was released, the game was on to ‘weaponize’ this PoC to a full local root privilege escalation. Because this bug was not that complicated, I began working on a simple modified version which is able to spawn a root shell. My initial idea was something like this: Get the size of a SUID binary and make a backup. Overwrite this…
webanalyze is a (Go) port of wappalyzer, a browser extension to display technologies used on websites. To use this in a performant way to test hundreds of hosts simultaneously I rewrote this project in Go. It’s not as accurate as the extension because of the missing javascript executing, but most of apps are found correctly. webanalze can be used as a standalone tool (e.g. to generate a JSON…
It’s been a long time I’m working on this and I’m happy to announce my new project: pentrack.io. PenTrack is a server platform to track found issues during a security audit. Categorize and classify your issues, document them and invite your customer so they can flag issues as fixed. There is a lot of more, so if you are interested I suggest you to take a look at it and register…
While setting up a remote backup storage I did a fatal mistake. I needed some seconds to understand what I had done wrong, but after hitting arrow-up a few times to see my command history I got it: I removed all of my images. Damn. I already had a backup of most of my images on an external drive, but there were lately added some new images, so not everything was backed up.
Firebase, the scalable real-time backend Developing client-only applications with JavaScript and services like Firebase offer a nice way to “build apps without managing servers”. However, sometimes it’s not a bad idea to have some controlling server between your client and your data storage. When recently browsing over firebase.com and looking at one of their code examples to get…
DPscan.py to DrupalScan Recently I was in the need of a simple “drupal security scanner” which enumerates all modules of a drupal project so I can do a source code audit on them. The only thing I could found for this were some you-have-to-be-a-member sites and a script called WPscan.py. Because the author’s site of the script was not accessible I decided to write an own little…
Some days ago during a pentest I found a critical sql injection vulnerability which gave me access to the user database. Most of the time finding this kind of vulnerability and extracting some data from the database is enough as an proof of concept, but in this particular pentest I needed to gain access to the backend administration. Sadly there was no way to insert data into the user table so it…
Some months ago (16th of Sep.) I found a security issue on an EPLUS service page, which allows you to send as much SMS as you want to their customers (only numbers from the EPLUS group are affected) with a special message. During my tests I found that the only limit you are faced with in sending SMS is the bandwidth of your connection/their server. The SMS is send by a service hotline number and…
Some weeks ago I wrote a little tool to support me when analysing webpages. The python tool recursive crawls all links from a page, collects the GET-Parameter and filters out the FORM-Data. Simple! The actual crawling- and parsing-method is located in the LinkCrawler.py which makes use of the BeautifulSoup library. You can easily include it in your own scripts: links = LinkCrawler.LinkCrawler(url,…
The idea I recently found a security issue in myBloggie. Injeting malicious code into the SQL-statement was quite simple, the only thing you had to do is to bypass the URL-validation regex by submitting a real url merged with an injection string: // [...] functions.php - line 750-762 function validate_url($url) { if ( ! preg_match('#^http\\:\\/\\/[a-z0-9\-]+\.([a-z0-9\-]+\.)?[a-z]+#i', $url,…
Information Software: myBloggie 2.1.6 Severity: High Author: Robin Verton Date: Jun. 12 2011 Vendor: http://mybloggie.mywebland.com/ Software Description “myBloggie is considered one of the most simple, user-friendliest yet packed with features Weblog system available to date.” Issue details myBloggie 2.1.6 is - again - prone to a SQL-Injection vulnerability in the trackback function.…
Robin Verton Horionstr. 45 53177 Bonn GERMANY Contact: hello at robinverton.de
advisories ServiceNow <= ‘Jakarta’ Patch 8 privilege escalation Trovebox - Authentication Bypass, SQLi, SSRF Kaltura - Remote Code Execution and Cross-Site Scripting myBloggie 2.1.6 SQL Injection Affiliate Network Pro v7.2 SQL Injections, Arbitrary code Codegrrl Protection.PHP Unspecified Code Execution Vulnerability PHP-Fusion <= 6.00.206 Multiple Vulnerabilities dotproject <= 2.0.1…
I really like Uses pages on other peoples websites to see how other people work. This is my current setup (2026). Terminal A big part of my work happens in the terminal. I use the ghostty with the font Berkeley Mono. I’m testing fish shell for some time now. I dont have my dotfiles public currently. IDE I’m coding almost daily. My preferred editor is neovim. I’m used to vim…