Security research and writeups from my blog - real examples of how I find (and fix) vulnerabilities.
A pwn challenge combining a format string bug and a buffer overflow - chained into a stack leak, libc leak, and a full ROP chain to bypass the stack canary, NX, and PIE and pop a shell.
Read on blog →
A chained GitHub Actions vulnerability: heredoc injection, LD_PRELOAD hijacking, and artifact poisoning combined to escalate privileges and extract repository secrets.
Read on blog →
How the lowest-privilege role in Ghost CMS can inject malicious JavaScript and escalate all the way to a full Owner account takeover.
Read on blog →
The follow-up: the same Vue flaw chained into a full Superadmin account takeover in Statamic CMS - with working proof-of-concept exploits.
Read on blog →
Multiple stored XSS vulnerabilities in the Statamic CMS control panel, caused by a missing v-pre directive across several Vue.js components.
Read on blog →
Writeup for an HTB box rated "Insane", chaining five independent services - Apache, Gogs, Memcached, a custom Minecraft dashboard, and RabbitMQ - into a single privilege escalation path to root.
Read on blog →