Hack The Box - Reactor

Reactor is an 'easy' Linux CTF machine from Season 11 at Hack The Box platform. Few days ago I decided to check it. Below you'll find more details about it. Here we go...

Palo Alto PostAuth CLI memory corruption bug - Metasploit module

Few days ago I posted some notes about the bug found in January in Palo Alto VM. Today you'll find some details about a working poc for Metasploit created for this bug. Here we go...

Palo Alto PostAuth CLI memory corruption bug

Hi, it's been a while. Long story short: below you'll find few details about the postauth bug I found in Palo Alto CLI. Here we go...

The Hack Summit 2024 - Online presentation

This year (again) I had a pleasure to present few of the topics from my research during The Hack Summit Conference in Poland[1, 2, 3]. Last time we (mostly;)) talked about one preauth RCE bug I found in ConQuest DICOM server (1.5.0d). This year we talked about one of the way to automate bug hunting using Ghidra. Below you'll find more details about it. Here we go...

Postauth SQLi in Centreon 23.10-1.el8

Similar to previous notes about hunting bugs in Centreon few weeks ago I prepared a new lab to test 'current/latest' version of this webapp. Below you'll find the details. Here we go...

The Hack Summit 2023 - Online presentation

This year I had a pleasure to present few of the topics from my research during The Hack Summit Conference in Poland[1, 2, 3]. This time we (mostly;)) talked about one preauth RCE bug I found in ConQuest DICOM server (1.5.0d). Below you'll find more details about it. Here we go...

Monitoring SUFF - Part 2

During one night I decided to continue my tests with suff.py script described before. This time I decided to run it with FortiWeb VM (v7.4.0 build577) so below you'll find few notes about it. Here we go...

Monitoring SUFF

Few months ago we talked about Simple Universal Fortigate Fuzzer. Small script created in Python to mutate commands we'd like to send to Forti CLI. Today we'll check how to grab few "log details" for our future analysis. Here we go... 

Simple Universal Fortigate Fuzzer

Today we'll finish the topic started few months ago: Simple Universal Fortigate Fuzzer. Below youl'l find the details about it. Here we go...

Fuzzing Fortigate 7

Continuing my journey with the Mutiny Fuzzing Framework one of the apps I decided to test was a Fortigate 7.x VM (what I initially described during the last TheHackSummit conference). Below you'll find more details about it. Here we go... 

Protocols Mutiny

From time to time I'm posting here some of the bugs I found in the past during my (file format) fuzzing adventures. This time we'll (again) try to focus a bit more on the protocol fuzzing scenarios. To continue - we will use Mutiny Fuzzing Framework. Here we go...

Bruting FortiGates

After my previous adventures with FortiGate VM's I decided to check it again and finally finish some of the ideas I was talking about during the last The Hack Summit Conference (PL, 2022). One of them was to bypass FortiGate's "anti-bruteforce protection". Below you'll find the details about it. Here we go...

The Hack Summit 2022 - Online Presentation

Long time, no see. ;) During 2022 I had a pleasure to present few of the topics about my research during The Hack Summit Conference in Poland. Below you'll find more details about it. Here we go...

Crashing GNOME shell again

Last time we talked about a crash in GNOME based on AnyDesk. This time I found a similar bug using LibreOffice for Ubuntu. Below you'll find more details. Here we go...

ISC2 Poland Chapter 07.2022 - Online Presentation

Few weeks ago (07.07.2022) thanks to ISC2 Poland Chapter I had a pleasure to present one of the findings described on the blog. Below you'll find more details. Here we go...

The Hack Summit 2021 - Online Presentation

During 2021 I had a pleasure to present few of the topics about my research during The Hack Summit Conference in Poland. Below you'll find more details about it. Here we go...

Quick intro to log4j

During this week I had a pleasure to learn more about a 'popular' log4j vulnerability. I decided to take a quick note for few cases I found in the IPS logs. Here we go...

Postauth Chained RCE with Nagios IM

Some time ago I started searching for bugs in NagiosIX. Few days ago I decided to continue my "research" and that's how I landed with NagiosIM (2.0.0 afaik ;)). Below you'll find few notes about it. :) Here we go...

Pentesting Jenkins

Some time ago I started a small project called 'enlil'. As you already know - I'm using it during pentests and redteam projects. Below you'll find few notes about the test prepared for Jenkins. Here we go...

Postauth RCE for Ilias 5

Hi. This time we'll talk about one RCE bug I found during a reasearch for a pentest done 3 weeks ago. Webapp we'll try this time is called Ilias (tested: v5.0.3). Here we go..