Application Security

CVE-2022-41622 - F5 BIG-IP iControl SOAP CSRF and REST flaws Vulnerability

CVE-2022-41622 - F5 BIG-IP and BIG-IQ CSRF leads to RCE Vulnerability

CVE-2022-42948 - Cobalt Strike 4.7.2 fixes RCE left by the 4.7.1 patch Vulnerability

Set Up an Android Hacking Lab for $0 - TrustedSec Byte

CVE-2022-42889 - Apache Commons Text RCE via string interpolation Vulnerability

CVE-2022-41040 - Exchange ProxyNotShell mitigations bypassed repeatedly Vulnerability

CVE-2022-41352 - Zimbra RCE via cpio in Amavis Vulnerability

CVE-2022-41040 - Exchange zero-days exploited before a patch existed Vulnerability

CVE-2022-39197 - Cobalt Strike 4.7.1 fixes XSS via Beacon username Vulnerability

CVE-2022-2992 - GitLab RCE via GitHub import, again Vulnerability

NSA released a guide on Securing the Software Supply Chain Byte

Black Hat USA 2022 and DEF CON 30 Byte

CVE-2022-30333 - unrar symlink check bypass gives pre-auth RCE on Zimbra Vulnerability

CVE-2022-26138 - Hardcoded account in Questions For Confluence app Vulnerability

Gitlab Project Import RCE Analysis (CVE-2022-2185) Byte

CVE-2021-43138 - IBM Business Automation Workflow RCE Vulnerability

CVE-2022-26134 - Confluence unauthenticated OGNL injection RCE Vulnerability

Offensive Security Web Expert 6 min read

Note: OSWE is one of three certifications required for OSCE3 (along with OSED and OSEP), which replaced the original OSCE in 2020. I passed the Offensive Security Web Expert exam in July 2020. Now, I …

SANS Holiday Hack Challenge 2017 Solution 25 min read

Letters to Santa app contains a reference to a development system in a HTML comment section. <!-- Development version --> <a href="http://dev.northpolechristmastown.com" …

The 2015 SANS Holiday Hack Challenge - Solution 15 min read

Which commands are sent across the Gnome’s command-and-control channel? EXEC:iwconfig in packet 363 EXEC:cat /tmp/iwlistscan.txt in packet 573 What image appears in the photo the Gnome sent across …