Personal blog
Did you know you can easily search for commits that fix security issues on GitHub? Just search for commits with "Merge commit from fork" or "Merge pull request from GHSA". Why this works? When there is a security issue, some projects use GitHub Advisories to manage them. GitHub allows you to create private pull requests to fix the issue in private. However, when the pull request is merged, GitHub…
In this post I'm going to share how I exploited a bad implementation of OAuth2 to take over user accounts with a single click. Note This vulnerability was reported in a private bug bounty program, so I won't disclose the name of the company or details that could lead to its identification. Contents OAuth2 The state parameter The vulnerability From login CSRF to account takeover Exploitation…
This post details two cross-site scripting (XSS) vulnerabilities I discovered in django-impersonate , and django-gravatar2 . I'm writing about them together because they share the same vulnerability, and are similar in other aspects that I'll explain below. Contents Background django-impersonate The vulnerability Exploitation Proof of concept Mitigation Timeline django-gravatar2 The vulnerability…
This post details a Cross-Site Scripting (XSS) vulnerability I discovered in django-allauth , a popular Django package for authentication. This vulnerability affected the Facebook provider only, and it was fixed in version 0.63.6 on July 12, 2024. Background Before I found this vulnerability, I already reported another one to django-allauth, a login CSRF vulnerability in its SAML provider, which…
Advent of Code is a series of programming puzzles that are released every day in December up to Christmas. Each day, two puzzles are released, the puzzles consist of a story and a set of input data, and some examples of the expected output. Contents The start of a journey Embracing differences as your new friends My daily routine The right tools for the job Results and reflections Solutions The…
If you are a developer, chances are that you handle private code or production secrets. If someone has access to those, you may be in serious problems with your bosses and clients. I'll share with you some tips on how to secure your development environment from your computer to your terminal . Note In this post I'd recommend some tools, for their usage please check their respective documentation,…
Hi friend, today I'm going to tell you a little story. Some things may look familiar, or even you could feel related to some situations. I assure you, it's mere coincidence . A new experience This tale takes place in Ecuador. It was during the lockdown that some friends contacted me to help them with a security audit. They were forming a team (with special abilities?), and there was missing…
Last year I participated in the Devsu Codejam 2019 contest, which is about solving programming problems. The first place? A car 🚗. The contest was for all developers from Ecuador, this is the first time I have heard about this type of contests being organized in Ecuador, so it caught my attention (well, the car a little too). Devsu Codejam front page First, a little of background about myself. I…
If you work in a project with more than one file, probably you'll be changing files very frequently or search for a file that contains the code or text you are interested in. Or when you are new in a project, you want to know: How it's organized Where the current file is located What other files are around the file you are right now Where is the test of the current file Or if you are a C/Cpp…
When we write software, people tell us to write docs for it. But when we use software, we forgot to read their docs very often. A couple of days ago, I was struggling to remember what the format in /etc/passwd means. Immediately I search for it in Google and found a blog post about it. Then I stopped to ask myself: why are you searching this on Google and reading it from a blog post? This should…