From SSRF discovery to RCE exploitation in 32 iterations. XBOW systematically analyzed TiTiler's expression parser, discovered Python execution through error patterns, then crafted payloads using subclass traversal to achieve command execution. Complete analysis: bit.ly/46XzOiA

XBOW – Beyond the Bands: Exploiting TiTiler’s Expression Parser for Remote Code Execution

A methodical analysis of TiTiler's API endpoints and its expression parser, leading to arbitrary Python code execution on the server.

bit.ly

Where do the Ads in Trackmania come from? In-game ads and reverse engineering tips in this mini-post from Jordan www.atredis.com/blog/2025/5/...

A Peek into an In-Game Ad Client — Atredis Partners

A little bit ago I re-installed the racing game Trackmania, and I noticed I got product ads displayed at me in-game alongside the racetrack. Where were those coming from?

atredis.com

My blog post on some vulns in GFI MailEssentials frycos.github.io/vulns4free/2...

We recently discovered a local privilege escalation in Kolide; it impacts Kolide >= 1.5.3, < 1.12.3 on Windows machines. Check out our full disclosure here

advisories/ATREDIS-2025-0001.md at master · atredispartners/advisories

Atredis Partners Security Advisories. Contribute to atredispartners/advisories development by creating an account on GitHub.

buff.ly

We've just released Shadow Repeater, for AI-enhanced manual testing. Simply use Burp Repeater as you normally would, and behind the scenes Shadow Repeater will learn from your attacks, try payload permutations, and report any discoveries via Organizer. portswigger.net/research/sha...

The results are in! We're proud to announce the Top 10 Web Hacking Techniques of 2024! portswigger.net/research/top...

Top 10 web hacking techniques of 2024

Welcome to the Top 10 Web Hacking Techniques of 2024, the 18th edition of our annual community-powered effort to identify the most innovative must-read web security research published in the last year

portswigger.net

New blog post with @shubs.io: We found a vulnerability in Subaru where an attacker, with just a license plate, could retrieve the full location history, unlock, and start vehicles remotely. Full post here: samcurry.net/hacking-subaru

Hacking Subaru: Tracking and Controlling Cars via the STARLINK Admin Panel

On November 20, 2024, Shubham Shah and I discovered a security vulnerability in Subaru’s STARLINK admin panel that gave us unrestricted access to all vehicles and customer accounts in the United State...

samcurry.net

In the Miami airport. Oohh… Aahhh.

github.com/kolide/launc... Cool bug found by @droner.bsky.social

Kolide Agent Privilege Escalation (Windows, Versions >= 1.5.3, < 1.12.3)

An implementation bug in the Kolide Agent (known as `launcher`) allows for local privilege escalation to the SYSTEM user on Windows 10 and 11. Impacted versions include versions >= 1.5.3 and the fi...

github.com

I just wrote a new blog post! This is how I (ab)used a jailed file write bug in Tomcat/Spring. Enjoy! Remote Code Execution with Spring Properties :: srcincite.io/blog/2024/11...

My latest blog post is live! nastystereo.com/security/cro... Read how to send a cross-site POST without including a Content-Type header (without CORS). It even works with navigator.sendBeacon

I've just rewritten ActiveScan++ in Java to lay the foundation for some major enhancements. It's not in the BApp store yet but if you'd like to take it for a spin you can grab it here: github.com/albinowax/Ac...

if you don't know who your friend group's game server person is, you might be the game server person

Anthony B@tehstriker.bsky.social · 2y ago

Shoutout to @tailscale.com. As the "game server guy" in my friend group, it has sure made things a lot easier to get us all connected in game without punching holes in my FW. #quake #ut2k4

Earlier this year, Assetnote's Security Research team discovered a vulnerability in Sitecore XP (CVE-2024-46938) that can lead to pre-authentication RCE. Order of operations bugs are one of my favorite types of bugs :) Write up and exploit script here: assetnote.io/resources/re...

As a welcome gift, here is a Black Friday discount of 50% OFF for my online platform! mr.un1k0d3r.online/training/blu... You’ll get access to both the training and the coding class for 50% OFF. This offer ends on Sunday. #redteam #pentest #blackfriday

Added the "safe" OR-based payloads to my SQL injection cheatsheet: tib3rius.com/sqli#sa... Video explanation here if you missed it: youtu.be/EpCA4HF-aUM Still looking for an MSSQL one or a more reliable SQLite one, if anyone wants to help out. 👀

Tomorrow, 10am, BinaryFormatter dies.

2023's top exploited vulnerabilities -- via the Five Eyes cybersecurity agencies www.cisa.gov/news-events/...

Starter packs are useful, but they are hard to find 🔍 Here's five of them, all related to infosec and cyber 🎁

Bluehat talks are up www.youtube.com/playlist?lis...

For the new folks, Bsky felt alive for me after following 200+ people which I found by looking for “starter packs” like the one I link here. Make sure you complete your profile with image/description, post, be generous with likes so people know you are reading their posts. bsky.app/profile/matt...

Shatter 🅅 𓅃⭐@shatter.bsky.social · 2y ago

Reminder that this is Bluesky and not Xitter. Dont expect 50 million inpressions per day because nothing is driving traffic to you except followers and reskeets.