Exploiting Monstra CMS 3.0.4

Last time when I tried HackTheBox CTF I found that one of the machines has Monstra CMS installed. Because I found that few bugs are already publicly disclosed for that CMS[1,2,3] I decided that it will be a good idea to do another "quick autopsy"... Here we go.

Nineveh: v0.3 - CTF

Lately I had a chance to check 'new' CTF from VulnHub, described as a part of HackTheBox Lab. Below you will find few notes about it. Thanks to Yas3r - this time we will try Nineveh: v0.3.
Let's go.

Exploiting CyberArk 10.2.1.603

Some time ago I found few bugs in CyberArk (version 10.2.1.603). I think that because all of them are 'for logged-in users only' - maybe you will find it useful. ;) Few details below...

Csharp: VulnJson - CTF

Below you will find some notes from Csharp: VulnJson - another nice CTF hosted by VulnHub. This time we will try to exploit SQL injection via JSON. Let's do it...

Fiddler Bug - case 01

One day I started Fiddler in a different way than usual. Below you will find few notes about it... ;]

billu b0x - CTF

When I was waiting for the results from john from the last post I decided to run another VM with new CTF box. This time I tried "billu: b0x" - machine prepared by Manish Kishan Tanwar. I started from...

Crashing Photoshop CS3

Last time when I was fuzzing I had a pleasure to find few bugs in one IBM product... This time you will find few similar bugs but for Adobe Photoshop CS3. Portable version is available somewhere online, so let's get to the details...

De-ICE: S1.140 - CTF

In the middle of time I was playing another cool CTF hosted by VulnHub. This time I decided to try De-ICE: S1.140 prepared for the series called ... De-ICE ;] Here we go...

WriteAV / NullPtrDeref for IBM Lotus Notes 8.5

Below you will find few new files from my 'small fuzzing session(s)'. Some older cases you can also find here but below we will present the crash of IBM Lotus Notes 8.5.3. Here we go...

Make free the VLC

Few weeks ago (after some small talk about the VLC bugs I found in the past) I was asked to 'check' the "new version" of VLC (3.0.1). As far as I'm concern there is already version 3.0.2, so I think it's a good time to drop few notes about the results of one month of fuzzing. Here we go...