iiinova — where your digital self keeps evolving

Reposted by shubs

Sam Curry @zlz.bsky.social · 23/01/2025

New blog post with @shubs.io: We found a vulnerability in Subaru where an attacker, with just a license plate, could retrieve the full location history, unlock, and start vehicles remotely. Full post here: samcurry.net/hacking-subaru

samcurry.net

Hacking Subaru: Tracking and Controlling Cars via the STARLINK Admin Panel

On November 20, 2024, Shubham Shah and I discovered a security vulnerability in Subaru’s STARLINK admin panel that gave us unrestricted access to all vehicles and customer accounts in the United State...

57330

Reposted by shubs

Michael Stepankin @artsploit.com · 22/01/2025

Last year, I committed to uncovering critical vulnerabilities in Maven repositories. Now it’s time to share the findings: RCE in Sonatype Nexus, Cache Poisoning in JFrog Artifactory, and more! github.blog/security/vul...

12916

Reposted by shubs

modzero @modzero.bsky.social · 10/01/2025

We broke something: in a recent pentest on a hardened target, we were able to achieve unauthenticated Remote Code Execution (RCE) via Server-Side Template Injection (SSTI) in a Spring Boot application We wrote it down for you to try at home: modzero.com/en/blog/spri...

modzero.com

Exploiting SSTI in a Modern Spring Boot Application (3.3.4)

1195

shubs @shubs.io · 22/12/2024

damn! that sucks :(

010

Reposted by shubs

Louis Nyffenegger @snyff.pentesterlab.com · 18/12/2024

I put together a VERY limited (for now) list of web hackers in a Starter pack: go.bsky.app/9uay4Ad A lot of people are missing (I will try to add more as I find them) but make sure you follow people already in the list!

33114

Reposted by shubs

Caitlin Condon @catc0n.bsky.social · 18/12/2024

Rapid7 analysis of Apache #Struts 2 CVE-2024-53677 here via research lead Ryan Emmons — highlights: * No, this isn't really being successfully exploited in the wild * Payloads need to be customized to the target * The 'fixed' version *does not* remediate the vuln attackerkb.com/assessments/...

attackerkb.com

remmons-r7's assessment of CVE-2024-53677 | AttackerKB

CVE-2024-53677 is a flawed upload logic vulnerability in Apache Struts 2. The vulnerability permits an attacker to override internal file upload variables in a…

22211

Reposted by shubs

Assetnote @assetnote.io · 19/12/2024

Last month, our Security Research team discovered and disclosed a critical pre-authentication RCE in CraftCMS (CVE-2024-56145). You can read our blog post on the issue here: assetnote.io/resources/re... #attacksurfacemanagement

095

shubs @shubs.io · 12/12/2024

We recently focused on CVE-2024-8534, a vulnerability that can cause DoS or memory corruption, pre-auth on Citrix NetScaler. You can read our research and analysis here: www.assetnote.io/resources/re...

assetnote.io

Citrix Denial of Service: Analysis of CVE-2024-8534

An analysis of CVE-2024-8534, a memory safety vulnerability leading to memory corruption and Denial of Service in NetScaler ADC and Gateway.

052

Reposted by shubs

Luke Jahnke @nastystereo.com · 10/12/2024

My latest blog post is live! Check your Ruby on Rails applications for the use of params[:_json] nastystereo.com/security/rai...

13314

shubs @shubs.io · 07/12/2024

This is really great research by @ryotak.net - I appreciated that he covered some of his experiments along the way, and how he landed on a finely tuned way of finding a 12-char hash collision with a command injection payload at the end. flatt.tech/research/pos...

flatt.tech

Compromising OpenWrt Supply Chain via Truncated SHA-256 Collision and Command Injection

Introduction Hello, I’m RyotaK (@ryotkak ), a security engineer at Flatt Security Inc. A few days ago, I was upgrading my home lab network, and I decided to upgrade the OpenWrt on my router.1 After ac...

1185

shubs @shubs.io · 29/11/2024

Hey, depending on the scale of your organisation, you may be able to manage with some open source tooling, but maintaining this system, speed, reliability and scale, as well as gaining unique security research based on your attack surface will be difficult. Feel free to DM if you want to chat more.

110

Reposted by shubs

Luke Jahnke @nastystereo.com · 27/11/2024

My latest blog post is live! nastystereo.com/security/cro... Read how to send a cross-site POST without including a Content-Type header (without CORS). It even works with navigator.sendBeacon

37829

shubs @shubs.io · 27/11/2024

This is amazing. I’ve been in this scenario several times where the good old days of dropping a JSP file is not possible.

1110

Reposted by shubs

James Kettle @jameskettle.com · 23/11/2024

The "bug bounty hunters and content creators" starter pack is now up to 60 users! Follow this to get instantly connected to the bug bounty community & let me know if I've missed you off! go.bsky.app/GD7hKPX

go.bsky.app

Bug bounty hunters & content creators

Join the conversation

198722

Reposted by shubs

Bitquark @bitquark.io · 25/11/2024

I've just updated Shortscan to support reading a list of URLs to scan from a file (and included a minor bugfix). Feedback welcome! The latest version is v0.9.2 and can be found on Github: github.com/bitquark/sho...

github.com

GitHub - bitquark/shortscan: An IIS short filename enumeration tool

An IIS short filename enumeration tool. Contribute to bitquark/shortscan development by creating an account on GitHub.

4368

shubs @shubs.io · 23/11/2024

queued up tonight but just missed out, if anyone is selling tickets, looking for two tickets to ccc #38c3

052

shubs @shubs.io · 22/11/2024

Hey, would love to be added :)

140

shubs @shubs.io · 22/11/2024

Earlier this year, Assetnote's Security Research team discovered a vulnerability in Sitecore XP (CVE-2024-46938) that can lead to pre-authentication RCE. Order of operations bugs are one of my favorite types of bugs :) Write up and exploit script here: assetnote.io/resources/re...

15023