Collaborate Disseminate
For context; I have a web application that allows users to upload a PDF file from which the web app extracts certain information by parsing it. The app then sends this information to another server for further processing.
The web app is ba… Continue reading Vulnerabilities in Receiving User-Submitted PDF Files Through HTTP(S)
I’m attempting to scaffold out a development training project, and am looking for some kind of service that provides an api that I can POST a chunk of code to (in whatever language specified), and return the results or errors of running th… Continue reading Is there a service that provides an api for running user-provided code in a variety of languages?
I am working on a challenge that involves getting code execution on a Ruby application hosted on Nginx. One of the ruby controllers seems to have been using unsanitized user input as part of the send() method which leads to arbitrary code … Continue reading Command substitution for code execution via Ruby’s send() method
Go and Java have "compile time constants", and JavaScript will soon get a feature that allows "Distinguishing strings from a trusted developer from strings that may be attacker controlled" via isTemplateObject.
These al… Continue reading Attack on a string created by a developer
A piece of malware detects signatures of the sandbox an AV solution tries to use to fingerprint malicious behavior and pretends to be innocent. Once in the real OS environment, it then downloads executable data encoded as image data and de… Continue reading Why don’t computers enforce immutable address spaces for execution?
I know it’s possible to embed phar archives into jpeg images but is it also possible to do so with PNG images? I am testing a php application that securely checks if an image is a valid PNG image however it calls vulnerable filesystem func… Continue reading Is it possible to embed a phar archive into a PNG image?
In my environment, I use Kaspersky for Windows Server and I have scans enabled in my environment to perform throughout the day. I’ve come across a potential exploit; CMD:HEUR:Win32.Generic and it points to the path where powershell.exe is … Continue reading Infected or Other Object Detected [closed]
Is it possible to gain code execution on a machine through access to CIFS service? And if so, how? In my case, I have a valid Kerberos TGS to CIFS service running on a host and I am able to copy and download files. I want to get a shell au… Continue reading How to gain code execution through access to CIFS service on Windows?
For a toy CLI application I’m writing, I’d like to store a string with an user defined command that will be executed periodically (like shell -c <command_string>).
I have seen other applications do this, for example in fzf you can se… Continue reading CLI application running user defined command periodically
When I look up a site on wayback machine, I click through a couple of links on the site, and then instead of loading the page, it downloads a file called "default.exe".
Since I was expecting a page to load, not an .exe to downloa… Continue reading Wayback machine downloading a file called default.exe?