Python GUI from AI

After a while I decided to look back again at the Python's GUI in Tkinter. Below you'll find few notes about it. Here we go...

Postauth SQLi in Centreon 23.10-1.el8

Similar to previous notes about hunting bugs in Centreon few weeks ago I prepared a new lab to test 'current/latest' version of this webapp. Below you'll find the details. Here we go...

Bruting FortiGates

After my previous adventures with FortiGate VM's I decided to check it again and finally finish some of the ideas I was talking about during the last The Hack Summit Conference (PL, 2022). One of them was to bypass FortiGate's "anti-bruteforce protection". Below you'll find the details about it. Here we go...

Postauth SQL injection in ZoneMinder 1.34.25

Few weeks ago I was looking for some (web) apps related to RTSP. Somehow I landed in TurnKeyLinux page where I found a VM with ZoneMinder (1.34.25).  Below you will find the details about the (postauth SQLi) bug I was able to spot. Here we go...

ISC2 Poland Chapter 07.2022 - Online Presentation

Few weeks ago (07.07.2022) thanks to ISC2 Poland Chapter I had a pleasure to present one of the findings described on the blog. Below you'll find more details. Here we go...

Postauth XSS bugs in Juniper 12.x

Last time we talked about XSS bugs in Junos Space 21.x. This time we'll talk a bit about few XSS bugs I found in Juniper 12.x. Here we go... 

Another one SAST to bytes

During one of the last evenings I decided to read and learn more about static source code review. In the past I had a pleasure to create (more or less) 'automated' tools to do it. This time I decided to not to start "from the beginning" but instead of: to learn more about SAST and SonarQube scanning scenarios. Here we go...

Postauth Chained RCE with Nagios IM

Some time ago I started searching for bugs in NagiosIX. Few days ago I decided to continue my "research" and that's how I landed with NagiosIM (2.0.0 afaik ;)). Below you'll find few notes about it. :) Here we go...

Pentesting Jenkins

Some time ago I started a small project called 'enlil'. As you already know - I'm using it during pentests and redteam projects. Below you'll find few notes about the test prepared for Jenkins. Here we go...

JS dropper static analysis

From time to time I'm checking Bazaar website to download some samples and try to analyse them in my 'local Lab'. This time I decided to download a file tagged as 'dropper'. Below you'll find the details. Here we go...

Postauth RCE for Ilias 5

Hi. This time we'll talk about one RCE bug I found during a reasearch for a pentest done 3 weeks ago. Webapp we'll try this time is called Ilias (tested: v5.0.3). Here we go..

Enlil.py - example module

Hi :) last time we talked about wooper.py and enlil.py projects I started some time ago. Since last few weeks I was wondering "what if" we'll combine results from both "proof-of-concepts". Below you'll find few notes about it. Here we go...

Enlil - Unfinished Sympathy

Hi :) This time I decided to check one of my old codes (called enlil). Few details you'll find below. Here we go...

Wooper.py - first results

Hi ;) Today we'll continue last post about "wooper.py updates". Below you'll find quick results for first scan of Wordpress plugin called WPide(2.5). Here we go...

Wooper.py - Reborn

Hi :) I decided to rewrite wooper.py script presented some time ago in the blog. Below you'll find few initial details and a friendly skeleton ;). Here we go...

Custom scan with Burp

 Hi, today I prepared a short video for creating custom scans with Burp Proxy. Here we go...

Simple GUI with Tkinter: Alinoe

Last Friday I decided to build a small tool for CTFs. This time I tried to use Tkinter. Below you'll find few notes about it. Here we go...

Creating your first CTF VM

It's always a pleasure to play another new VM found on VulnHub. I was wondering how can I prepare a similar "CTF VM" by myself. Below you'll find few notes about it. Here we go...

Basic Pentest Lab with Docker

Few days ago I started reading some "new" materials I found about Docker. That's how I decided to write few notes about it. Here we go...

Postauth RCE in Nagios 5.7.2

Last time when I was checking NagiosXI is described here[1, 2, 3] so you could already get some 'basic introduction' to the topic. Below you will find new more details - this time for (again) 'latest' version (5.7.2). Here we go...