Cloud Vulnerability Research at Google. Opinions are my own.
Joined May 2018
- Tweets125
- Following247
- Followers1.7K
- Likes434
scryh retweeted
This was a fun one to discover!
SQL syntax can be ambiguous, and MySQL anticipated this a long time ago. Other SQL dialects stuck to the spec, leading to SQL injection when the right stars align:
SQL Injection despite using prepared statements? 🧐
Turns out that SQL syntax can be ambiguous! Learn how this has led to vulnerabilities in several popular PostgreSQL client libraries:
sonarsource.com/blog/double-…
#appsec #security #vulnerability
scryh retweeted
What a year! We look back and summarize our security research highlights of 2024:
🪲 Vulnerabilities in Jenkins, SourceForge, Joomla, and much more
🎙️ 7 talks, including DEF CON and Hexacon
🏆 5 nominations and 1 award
sonarsource.com/blog/vulnera…
#research #vulnerability #appsec
scryh retweeted
Introducing InternetCTF! 🤯 Earn up to $10,000 for finding RCE vulnerabilities in open-source software AND creating Tsunami plugin patches. Make the internet safer and get rewarded! 🤑
For details on the program, see our latest blog post:
bughunters.google.com/blog/6…
scryh retweeted
CORS misconfigurations are definitely not good, but how bad can they get? 🧐
Our latest blog post discusses how an origin reflection issue detected by SonarQube leads to code execution in a real-world application:
sonarsource.com/blog/never-u…
#appsec #security #vulnerability
scryh retweeted
🧬🔬 I wrote about this finding a bit more extensively in my blog:
yaniv-git.github.io/2024/12/…
#mXSS #XSS
scryh retweeted
We’re finally live! You can now watch “Listen to the whispers: web timing attacks that actually work” on YouTube: youtube.com/watch?v=zOPjz-sP…
scryh retweeted
Recordings of the #HEXACON2024 talks have been uploaded to our YouTube channel 🎬
youtube.com/playlist?list=PL…
See you next year!
scryh retweeted
JS engine pwning, the old-school way!
For this year's Hacklu CTF, I wrote a challenge about exploiting a SpiderMonkey version from 2007. I'm usually not a pwner, but it was very fun to learn about all this stuff. Read the write-up here:
blog.pspaul.de/posts/ancient…
scryh retweeted
Absolutely stunning work from @pspaul95 on this CSS Injection - > text node exfil technique.
blog.pspaul.de/posts/bench-p…
A blog post with the technical details of my @hexacon_fr talk is now live. Thank you all for the positive feedback on the talk :)
From HTTP request to ROP chain in Node.js! 🔥
Our latest blog post explains how to turn a file write vulnerability in a Node.js application into RCE – even though the target's file system is read-only:
sonarsource.com/blog/why-cod…
scryh retweeted
Having trouble exploiting a file write vulnerability?
Don't miss our @hexacon_fr talk to learn more about unconventional attack surfaces that can turn a file write into code execution – even in hardened environments!
We'll follow up with a related blog post later.
#HEXACON2024
scryh retweeted
Join us at OWASP SF for our talk, "Sanitize Client-Side: Why Server-Side HTML Sanitization is Doomed to Fail" to discover why client-side sanitization is crucial for a secure web. Can't make it? Stay tuned for our upcoming blog post.
#OWASP #GlobalAppSecSanFran
scryh retweeted
You can find all the talks announced on the agenda: hexacon.fr/conference/agenda…
Again, a big thanks to the review committee for their contribution as well as everyone who took the time to submit a talk. 🙏
scryh retweeted
As promised, Exchange PowerShell research is getting published in a form of blog posts. Part 1/4 describes two RCEs: MultiValuedProperty internal deserialization + a chain with Command gadget.
In the 1st of a 4 part series, @chudyPB details his research into exploiting #Microsoft #Exchange after ProxyNotShell was patched. Today's post covers CVE-2023-21529: abuse of the allowed MultiValuedProperty class for RCE. Check it out at zerodayinitiative.com/blog/2…
scryh retweeted
A recording of our @WEareTROOPERS talk "From ASCII to UTF-16: Leveraging Encodings to Break Software" is now available!
The talk covers basic knowledge of character encodings and explains various vulnerability types and exploitation techniques:
youtube.com/watch?v=z-ug2dwc…
scryh retweeted
Here's my author writeup for htmlsandbox from SekaiCTF
blog.ankursundara.com/htmlsa…
- a parsing differential in streamed vs non-streamed HTML
scryh retweeted
Critical Roundcube XSS technical details: Desanitization, unsafe Content-Types, CSS exfiltration, and a Service Worker come together to persistently leak emails from a victim's browser.
Read about it here:
sonarsource.com/blog/governm…
(CVE-2024-42008, CVE-2024-42009, CVE-2024-42010)
Limited impact, but an interesting example of Client-Side Path Traversal :)
Firefly III CVE-2024-22075: When Bypassing Built-in Sanitization Might Backfire.
Check out our latest blog post to see how a Client-Side Path Traversal (CSPT) vulnerability can be used to control data that was assumed to be uncontrollable:
sonarsource.com/blog/front-e…
scryh retweeted
If you're at DEF CON and want to learn how request smuggling can be used on databases, come by track 1 at 2 pm today!
If you're not in Vegas, you can watch the live stream at dctv.defcon.org/ (23:00 CEST)
Join Paul Gerste of @Sonar_Research for a @defcon talk that explores smuggling attacks against database wire protocols! He will delve into the ongoing concern of SQL injections by demonstrating how attackers can inject entire (No)SQL statements into database connections.
