Tessera
Folgen

Flomb

@fl0mb.bsky.social

https://blog.flomb.net https://x.com/flomb_

6 Posts90 Follower1025 Folgt
Flomb@fl0mb.bsky.social · 6mo ago

Incredibly excited to share that my research 'Playing with HTTP/2 CONNECT' made the final @portswigger.net Top 10 Web Hacking Techniques of 2025! A huge thank you to everyone who voted. It’s a privilege to be featured alongside such talented researchers. portswigger.net/research/top...

Top 10 web hacking techniques of 2025

Welcome to the Top 10 Web Hacking Techniques of 2025, the 19th edition of our annual community-powered effort to identify the most innovative must-read web security research published in the last year

portswigger.net

codewhitesec.bsky.social@codewhitesec.bsky.social · 6mo ago

You like technical deep dives into binary exploitation and crazy heap wizardry? Then you'll like our blog post about unauth'ed RCE in NetSupport Manager aka CVE-2025-34164 & CVE-2025-34165 code-white.com/blog/2026-01...

CODE WHITE | Unauthenticated RCE in NetSupport Manager - A Technical Deep Dive

NetSupport Manager is a remote control and support software that we find surprisingly often utilized in sensitive *Operational Technology (OT)* environments, such as production plant networks. Besides...

code-white.com

Jorian@jorianwoltjer.com · last yr.

Just pushed a new frontend for my site, and a new post! This one's about an tricky file write vulnerability on Windows in OBS. By crafting an image with very specific pixels, we can plant a backdoor on your PC all from an attacker's site by misconfiguring: jorianwoltjer.com/blog/p/resea...

OBS WebSocket to RCE | Jorian Woltjer

Disabling password authentication of your OBS WebSocket server can have devastating consequences. We'll attack from the browser to construct an RCE payload on Windows formed from the pixels of an imag...

jorianwoltjer.com

codewhitesec.bsky.social@codewhitesec.bsky.social · last yr.

Yes, we're beating a dead horse. But that horse still runs in corporate networks - and quietly gives attackers the keys to the kingdom. We're publishing what’s long been exploitable. Time to talk about it. #DSM #Ivanti code-white.com/blog/ivanti-...

CODE WHITE | Analyzing the Attack Surface of Ivanti's DSM

Ivanti's Desktop & Server Management (DSM) product is an old acquaintance that we have encountered in numerous red team and internal assessments. The main purpose of the product is the centralized dis...

code-white.com