Case Study: How a Single `operationName` Parameter Opened the Door to Internal AI Infrastructure

This is an anonymized case study from a bug bounty engagement this year — the company name, domain, and internal hostnames have been redacted or replaced with placeholder values.

Below you'll find more details about it. Here we go...

WatchGuard BruteForce

Some time ago I wrote a post and a small script to run a brute force attack against FortiGate appliances. (Link to that post you can find here). This time I decided to check if similar bug is present in latest WatchGuard appliance (FireboxV, version 12.12). Below you'll find the details and poc code to test it in your own LAB. Below you'll find more details about it. Here we go...

Building BHADGUI: Automating BloodHound Data Collection for AD Attack Paths

When you're doing Active Directory pentesting on a tight schedule, running SharpHound manually and then clicking through BloodHound's UI gets old fast. BHADGUI started as a simple wrapper and evolved into something more useful.

Living Long Doing Pentests

Some time ago, I was searching online for information about vulnerabilities in popular networking devices. One of the links I came across concerned the CVE-2025-0116 vulnerability related to the handling of the LLDP (Link Layer Discovery Protocol) by Palo Alto devices." Intrigued by the description, I decided to check how it looks on my own device in a home lab environment. Below you'll find some details about it. Here w go...

Palo Alto PostAuth CLI memory corruption bug - Metasploit module

Few days ago I posted some notes about the bug found in January in Palo Alto VM. Today you'll find some details about a working poc for Metasploit created for this bug. Here we go...

WatchGuard 12.11 (Firebox) PostAuth CLI memory corruption bug

In one of the latest pentests projects I had a pleasure to play a bit with latest WatchGuard. Below you'll find some details about it. Here we go...

Palo Alto PostAuth CLI memory corruption bug

Hi, it's been a while. Long story short: below you'll find few details about the postauth bug I found in Palo Alto CLI. Here we go...

Hack The Box - Instant

Few days ago I had a pleasure to check one of the Hack The Box 'Season 6' machine called Instant. Few details about it you will find below. Here we go...

Automating Network Pentests with Metasploit and Ruby

This time we'll continue the journey started in previous post to create a small 'semi-automated' tool to perform some 'basic' network pentests. For this case we'll focus (mostly;)) on CVE-2021-20039 for SonicWall SMA. Here we go...

Reading Nmap Log In Ruby

From time to time during pentests we're using nmap to scan the target host(s). Today we'll try to read nmap's log using Ruby. Below you'll find few details about it. Here we go...

Postauth SQLi in Centreon 23.10-1.el8

Similar to previous notes about hunting bugs in Centreon few weeks ago I prepared a new lab to test 'current/latest' version of this webapp. Below you'll find the details. Here we go...

Postauth SQLi in AdvantechWeb/SCADA 9.1.5U

During some internal pentests performed few weeks ago I found an SQL injection (postauth) bug in "latest" AdvantechWeb/SCADA (9.1.5U). Below you'll find more details about it. Here we go...

Healthy PostAuth RCE in FortiADC 7.4.0

Few weeks ago when I was playing a bit with Fortigate machines I decided to check FortiADC VM (downloaded here). After a while I found an interesting "feature" that can be used to achieve ('limited' AFAIK ;)) postauth RCE. Below you'll find few notes about it. Here we go...

The Hack Summit 2023 - Online presentation

This year I had a pleasure to present few of the topics from my research during The Hack Summit Conference in Poland[1, 2, 3]. This time we (mostly;)) talked about one preauth RCE bug I found in ConQuest DICOM server (1.5.0d). Below you'll find more details about it. Here we go...

Monitoring SUFF - Part 2

During one night I decided to continue my tests with suff.py script described before. This time I decided to run it with FortiWeb VM (v7.4.0 build577) so below you'll find few notes about it. Here we go...

Monitoring SUFF

Few months ago we talked about Simple Universal Fortigate Fuzzer. Small script created in Python to mutate commands we'd like to send to Forti CLI. Today we'll check how to grab few "log details" for our future analysis. Here we go... 

Windows Embedded Eternally Blue

Few weeks ago I was asked to help a bit with exploitation of MS17_010 for one of the hosts found in the pentest project scope. Below you'll find more details about it. Here we go...

Simple Universal Fortigate Fuzzer

Today we'll finish the topic started few months ago: Simple Universal Fortigate Fuzzer. Below youl'l find the details about it. Here we go...

Fuzzing Fortigate 7

Continuing my journey with the Mutiny Fuzzing Framework one of the apps I decided to test was a Fortigate 7.x VM (what I initially described during the last TheHackSummit conference). Below you'll find more details about it. Here we go... 

Protocols Mutiny

From time to time I'm posting here some of the bugs I found in the past during my (file format) fuzzing adventures. This time we'll (again) try to focus a bit more on the protocol fuzzing scenarios. To continue - we will use Mutiny Fuzzing Framework. Here we go...