iiinova — where your digital self keeps evolving

Lorenzo Leonardini

@pianka.it

Computer scientist, cybersecurity guy, wannabe musician You might know me as "pianka" CTF player with @aboutblankets 🔗 sec.leonardini.dev

Posts Replies Media

Lorenzo Leonardini @pianka.it · 25/04/2025

The only way I can (sometimes) recognize whether it's the original title or not, is by looking at the language of the text in the thumbnail. Which is very dumb. But the dumbest part is that you cannot disable automatic translations. Stop showing me stuff I don't want.

020

Lorenzo Leonardini @pianka.it · 28/02/2025

I struggled a bit in reaching a point where I found this post good enough to be published, hence why it took so long since my sneak peak. I also think I touched up the CSS a dozen times to "improve readability" (or at least try to) Hope you can find this as clear and as complete as I wanted :)

010

Lorenzo Leonardini @pianka.it · 28/02/2025

Took me a while, but here is the full article! If you want to see some weird URL parsing behavior, here you can find a lot of them :) sec.leonardini.dev/blog/playing... Disclaimer: no exploits nor vulnerabilities in this post, just some broken code

sec.leonardini.dev

Playing with Bun's URL parser

During the latest SECCON CTF quals, I had the pleasure of reading the custom implementation of Bun's URL parser, and I found some... weird behaviors... Join me in this wonderful journey.

182

Lorenzo Leonardini @pianka.it · 04/01/2025

Actually pretty interesting idea

010

Lorenzo Leonardini @pianka.it · 02/01/2025

Currenly playing around with Bun's URL parser, and I must say it's pretty fun. It's not vulnerable as it's never used raw, but expect a few GH issues and a blog post about it. Spoiling the least interesting quirk to keep you on your toes :) Hopefully I'm not ruining anybody's future challenge :')

The URL `http://a@b@c` is parsed to as username `a`, password `b` and hostname `c`

080

Lorenzo Leonardini @pianka.it · 28/12/2024

Adding to this: I know of `u.RawPath`, but I don't understand why anyone would want a path decoded like that

010

Lorenzo Leonardini @pianka.it · 28/12/2024

TIL that in Go this snippet produces `/foo/bar`, and... I feel like that's.. wrong..? The HTTP server router does not handle this as `/foo/bar`, and parsing this with Node returns `/foo%2fbar` (which is what I expected) Does anyone have any insight on this?

u, _ := url.Parse("http://localhost/foo%2fbar")
fmt.Println(u.Path)

220

Lorenzo Leonardini @pianka.it · 26/12/2024

That's how you keep the audience's attention!

020

Lorenzo Leonardini @pianka.it · 25/11/2024

I would agree, if I hadn't terrible experience with the teams app on Android, Windows, and Linux. Android is the best one, but it's still way to slow and buggy. The fact that clicking on a button on the *windows* app is that slow is really something... In gsuite "spaces" can have max 400 people

030

Lorenzo Leonardini @pianka.it · 25/11/2024

I'm not too sure what you mean with channels, I'm neither a big teams user nor a gsuite user, so I could be missing some features. Personally, even if sometimes it's confusing, I like having separate apps for each tool other than a unique slow bloated app full of unused features

110

Lorenzo Leonardini @pianka.it · 25/11/2024

Honestly, to me gsuite seems pretty nice, what do you think it lacks compared to Teams?

120

Lorenzo Leonardini @pianka.it · 22/11/2024

Yesterday my first PHP CVE was published: CVE-2024-11234. In some specific configurations, this vulnerability could allow for CRLF injection when using stream contexts. sec.leonardini.dev/blog/cve-202... Many thanks to @minimalblue.bsky.social for reviewing my original report

sec.leonardini.dev

CVE-2024-11234: Configuring a proxy in a PHP stream context might allow for CRLF injection in URIs 🐘

A vulnerability in PHP might allow an attacker to perform SSRF attacks when unsanitized user-controlled data is used in stream functions if a proxy is used.

0102

Reposted by Lorenzo Leonardini

Marco Squarcina @minimalblue.bsky.social · 21/11/2024

Sharing CVE-2024-11234 affecting PHP. This vulnerability could lead to CRLF injection when using Stream Contexts under certain conditions. Discovered and reported by @p1anka.bsky.social, I only reviewed the report some time ago! github.com/php/php-src/...

github.com

Configuring a proxy in a stream context might allow for CRLF injection in URIs

### Summary Configuring a proxy in a [stream context](https://www.php.net/manual/en/stream.contexts.php) might allow for CRLF injection in URIs, resulting in HTTP request smuggling attacks. #...

0101