@Y4er_ChaBug

Happy!

Y4er.com
Joined November 2019
  • Tweets147
  • Following383
  • Followers4.6K
27Media
Cookieless DuoDrop: IIS Auth Bypass & App Pool Privesc in ASP .NET Framework (CVE-2023-36899) soroush.me/blog/2023/08/cook… #Appsec #bugbountytips
6
176
4
422
68,470
It's TGIF and we have a new blog post by our team member, @testanull Microsoft Exchange Powershell Remoting Deserialization leading to RCE (CVE-2023-21707) Thanks to all the other team members for reviewing it as well. starlabs.sg/blog/2023/04-mic…

Microsoft Exchange Powershell Remoting Deserialization leading to RCE (CVE-2023-21707)

Introduction While analyzing CVE-2022-41082, also known as ProxyNotShell, we discovered this vulnerability which we have detailed in this blog. However, for a comprehensive understanding, we highly...

starlabs.sg
2
65
4
188
41,296
testbnull.medium.com/ph%C3%A…

Phân tích lỗ hổng SharePoint Webpart Property Traversal (CVE-2022–38053, CVE-2023–21742…

Sau khi kỳ p2o Vancouver 2023 kết thúc, tôi được yêu cầu tiếp tục nghiên cứu một số CVE của SharePoint: CVE-2023–21742 và CVE-2023–21717

testbnull.medium.com
1
45
1
129
24,260
Even though JMX exploitation is well understood, @mwulftange and @qtc_de found new universal exploitation techniques & one of them allows to gain instant Remote Code Execution using TemplatesImpl (which is now implemented in #beanshooter) codewhitesec.blogspot.com/20…

CODE WHITE | Blog: JMX Exploitation Revisited

codewhitesec.blogspot.com
73
5
167
39,106
Last year the GitHub Security Lab run a team assessment of the DataHub platform. Highly recommend to do team assessments from time to time! Here is what we found github.blog/2023-03-03-githu…

GitHub Security Lab audited DataHub: Here's what they found

The GitHub Security Lab audited DataHub, an open source metadata platform, and discovered several vulnerabilities in the platform's authentication and authorization modules. These vulnerabilities...

github.blog
2
18
53
13,809
Usually I don't do #FF #FollowFriday but I wanna thank all people I learnt a lot from in 2022. This list is incomplete. @mwulftange @matthias_kaiser @steventseeley @Sonar_Research @chudyPB @Y4er_ChaBug @FlashbackPwn @infosec_au @testanull @pyn3rd @pwntester And @codewhitesec
8
9
45
15,766
My blog post "Pre-Auth RCE with CodeQL in Under 20 Minutes" frycos.github.io/vulns4free/…

Pre-Auth RCE with CodeQL in Under 20 Minutes

This write-up won’t be an intense discussion on security code review techniques this time. We’ll simply let do all the hard work by a third party: CodeQL.

frycos.github.io
3
86
1
231
Here is the detailed analysis blog CVE-2022-43781. Hope you like it :D petrusviet.medium.com/cve-20…

CVE-2022–43781 Bitbucket command injection

There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center.

petrusviet.medium.com
2
34
3
82
A New Exploit Method for #CVE20213560 PolicyKit PE published from @ykco_z noahblog.360.cn/a-new-exploi…
1
48
1
106
frycos.github.io/vulns4free/… I wrote it...hopefully not too confusing but full of security code audit methods. Enjoy.

Security Code Audit - For Fun and Fails

Recently, I asked the Twitter community if anyone would be interested in a blog post about “failed” security code audit attempts. A lot of you seemed to like this idea, so here it is. I was somehow...

frycos.github.io
frycos@frycos16 May 2022
Is anyone also interested in me blogging about "failed" code audit attempts, e.g. only getting high-privileged auth'd RCE in a product? I could instead explain the methodological paths up to hitting the dead ends in more detail.
18
72
6
188
As promised, Here is the detail and a part of PoC about the OAM Pre-Auth RCE (CVE-2021-35587) It may require more work to get fully functional PoC, Have fun with it! cc @peterjson testbnull.medium.com/oracle-…

Oracle Access Manager Pre-Auth RCE (CVE-2021–35587 Analysis)

As you may know, Oracle Access Manager (OAM) is a popular SSO product used by many big corp such as Oracle, VMware, Huawei, Qualcomm, …

testbnull.medium.com
10
202
6
431
the fanciful allure and utility of syscalls - hatRiot.github.io/blog/2021/…
4
7
An illustrator in #China re-created a famous Japanese painting The Great Wave off #Kanagawa. If Katsushika Hokusai, the original author is still alive today, he would also be very concerned about #JapanNuclearWater.
10,108
10,579
4,183
49,709
Load more