iiinova — where your digital self keeps evolving

Reposted by shubs

Sam Curry @zlz.bsky.social · 23/01/2025

New blog post with @shubs.io: We found a vulnerability in Subaru where an attacker, with just a license plate, could retrieve the full location history, unlock, and start vehicles remotely. Full post here: samcurry.net/hacking-subaru

samcurry.net

Hacking Subaru: Tracking and Controlling Cars via the STARLINK Admin Panel

On November 20, 2024, Shubham Shah and I discovered a security vulnerability in Subaru’s STARLINK admin panel that gave us unrestricted access to all vehicles and customer accounts in the United State...

57330

Reposted by shubs

Michael Stepankin @artsploit.com · 22/01/2025

Last year, I committed to uncovering critical vulnerabilities in Maven repositories. Now it’s time to share the findings: RCE in Sonatype Nexus, Cache Poisoning in JFrog Artifactory, and more! github.blog/security/vul...

12916

Reposted by shubs

modzero @modzero.bsky.social · 10/01/2025

We broke something: in a recent pentest on a hardened target, we were able to achieve unauthenticated Remote Code Execution (RCE) via Server-Side Template Injection (SSTI) in a Spring Boot application We wrote it down for you to try at home: modzero.com/en/blog/spri...

modzero.com

Exploiting SSTI in a Modern Spring Boot Application (3.3.4)

1195

Reposted by shubs

Louis Nyffenegger @snyff.pentesterlab.com · 18/12/2024

I put together a VERY limited (for now) list of web hackers in a Starter pack: go.bsky.app/9uay4Ad A lot of people are missing (I will try to add more as I find them) but make sure you follow people already in the list!

33114

Reposted by shubs

Caitlin Condon @catc0n.bsky.social · 18/12/2024

Rapid7 analysis of Apache #Struts 2 CVE-2024-53677 here via research lead Ryan Emmons — highlights: * No, this isn't really being successfully exploited in the wild * Payloads need to be customized to the target * The 'fixed' version *does not* remediate the vuln attackerkb.com/assessments/...

attackerkb.com

remmons-r7's assessment of CVE-2024-53677 | AttackerKB

CVE-2024-53677 is a flawed upload logic vulnerability in Apache Struts 2. The vulnerability permits an attacker to override internal file upload variables in a…

22211

Reposted by shubs

Assetnote @assetnote.io · 19/12/2024

Last month, our Security Research team discovered and disclosed a critical pre-authentication RCE in CraftCMS (CVE-2024-56145). You can read our blog post on the issue here: assetnote.io/resources/re... #attacksurfacemanagement

095

shubs @shubs.io · 12/12/2024

We recently focused on CVE-2024-8534, a vulnerability that can cause DoS or memory corruption, pre-auth on Citrix NetScaler. You can read our research and analysis here: www.assetnote.io/resources/re...

assetnote.io

Citrix Denial of Service: Analysis of CVE-2024-8534

An analysis of CVE-2024-8534, a memory safety vulnerability leading to memory corruption and Denial of Service in NetScaler ADC and Gateway.

052

Reposted by shubs

Luke Jahnke @nastystereo.com · 10/12/2024

My latest blog post is live! Check your Ruby on Rails applications for the use of params[:_json] nastystereo.com/security/rai...

13314

shubs @shubs.io · 07/12/2024

This is really great research by @ryotak.net - I appreciated that he covered some of his experiments along the way, and how he landed on a finely tuned way of finding a 12-char hash collision with a command injection payload at the end. flatt.tech/research/pos...

flatt.tech

Compromising OpenWrt Supply Chain via Truncated SHA-256 Collision and Command Injection

Introduction Hello, I’m RyotaK (@ryotkak ), a security engineer at Flatt Security Inc. A few days ago, I was upgrading my home lab network, and I decided to upgrade the OpenWrt on my router.1 After ac...

1185

Reposted by shubs

Luke Jahnke @nastystereo.com · 27/11/2024

My latest blog post is live! nastystereo.com/security/cro... Read how to send a cross-site POST without including a Content-Type header (without CORS). It even works with navigator.sendBeacon

37829

shubs @shubs.io · 27/11/2024

This is amazing. I’ve been in this scenario several times where the good old days of dropping a JSP file is not possible.

1110

Reposted by shubs

James Kettle @jameskettle.com · 23/11/2024

The "bug bounty hunters and content creators" starter pack is now up to 60 users! Follow this to get instantly connected to the bug bounty community & let me know if I've missed you off! go.bsky.app/GD7hKPX

go.bsky.app

Bug bounty hunters & content creators

Join the conversation

198622

Reposted by shubs

Bitquark @bitquark.io · 25/11/2024

I've just updated Shortscan to support reading a list of URLs to scan from a file (and included a minor bugfix). Feedback welcome! The latest version is v0.9.2 and can be found on Github: github.com/bitquark/sho...

github.com

GitHub - bitquark/shortscan: An IIS short filename enumeration tool

An IIS short filename enumeration tool. Contribute to bitquark/shortscan development by creating an account on GitHub.

4368

shubs @shubs.io · 23/11/2024

queued up tonight but just missed out, if anyone is selling tickets, looking for two tickets to ccc #38c3

052

shubs @shubs.io · 22/11/2024

Earlier this year, Assetnote's Security Research team discovered a vulnerability in Sitecore XP (CVE-2024-46938) that can lead to pre-authentication RCE. Order of operations bugs are one of my favorite types of bugs :) Write up and exploit script here: assetnote.io/resources/re...

15023