Hans-Martin Münch
@h0ng10.bsky.social
CEO at MOGWAI LABS, part time CTF player and bboy
Just published a blog post about a small vulnerability we analyzed (but not used) in a 2025 penetration test. Not sure if I'll continue sharing vulnerability analysis in the future, as AI takes away the fun.
@mogwailabs.bsky.social · 3mo agoLearn about the remote code execution vulnerability in CodeIgniter4 and try out our Dev-Container based test environment to follow along! #cve #vulnerability #php mogwailabs.de/en/blog/2026...
New security advisory: Generex RCCMDTray Remote OS Command Execution. mogwailabs.de/en/advisorie...
Generex RCCMDTray Remote OS Command Execution
mogwailabs.de
Ever thought your kitchen appliance could harbor a persistent threat? We reverse-engineered the Thermomix TM5 and uncovered vulnerabilities allowing arbitrary code execution, persistence, and secure boot bypass. Discover our step-by-step breakdown! www.synacktiv.com/en/publicati...
Let Me Cook You a Vulnerability: Exploiting the Thermomix TM5
Hardware Analysis The Thermomix TM5 is a multifunctional kitchen appliance composed of two key electronic boards: the power board, which handles the motor and heating functions, and the main board, w
synacktiv.com
We just added a new vulnerability to our "bug parade" page. If you are using 4D based applications, please ensure that you are on the latest patch level to avoid potential security risks. mogwailabs.de/en/advisorie...
4D Unauthenticated File Disclosure
mogwailabs.de
A quick-and-dirty late night blog post on discovering an nday variant in Zyxel NWA50AX Pro devices frycos.github.io/vulns4free/2...
Zyxel NWA50AX Pro - Discovery of an Nday Variant
Today was an eventful day thanks to many interesting blog posts, e.g. from my friends at watchTowr. So I thought, why not publish a small quick-and-dirty blog post myself about a story from last week?...
frycos.github.io
AppSec Ezine - 591st edition #AppSec #Security pathonproject.com/zb/?f5f861f4...
AppSec Ezine
pathonproject.com
AppSec Ezine - 589th edition #AppSec #Security pathonproject.com/zb/?33afd768...
AppSec Ezine
pathonproject.com
AppSec Ezine - 588th edition #AppSec #Security pathonproject.com/zb/?cb31cee2...
AppSec Ezine
pathonproject.com
OffensiveCon 25 videos are out. Thank you @offensivecon www.youtube.com/watch?v=goEb...
OffensiveCon25 - Cedric Halbronn and Jael Koh
YouTube video by OffensiveCon
youtube.com
Yes, we're beating a dead horse. But that horse still runs in corporate networks - and quietly gives attackers the keys to the kingdom. We're publishing what’s long been exploitable. Time to talk about it. #DSM #Ivanti code-white.com/blog/ivanti-...
CODE WHITE | Analyzing the Attack Surface of Ivanti's DSM
Ivanti's Desktop & Server Management (DSM) product is an old acquaintance that we have encountered in numerous red team and internal assessments. The main purpose of the product is the centralized dis...
code-white.com
AppSec Ezine - 586th edition #AppSec #Security pathonproject.com/zb/?65eb4ad1...
AppSec Ezine
pathonproject.com
From iframes and file reads to full RCE. 🔥 We found an HTML-to-PDF API allowing file reads and SSRF - then chained it into remote code execution via a Chromium 62 WebView exploit. 👉 Read the full write-up here: neodyme.io/en/blog/html...
HTML to PDF Renderer: A tale of local file access and shellcode execution
In a recent engagement, we found an HTML to PDF converter API endpoint that allowed us to list local directories and files on a remote server. One of the PDF files we created, revealed that the conver...
neodyme.io
A few quick notes on the Erlang OTP SSHd RCE (CVE-2025-32433) [1/3] 1. Cisco confirmed that their ConfD and NSO products are affected. The ConfD patch is planned for May. These often run on ports 830, 2022, and 2024 versus 22. sec.cloudapps.cisco.com/security/cen...
Cisco Security Advisory: Multiple Cisco Products Unauthenticated Remote Code Execution in Erlang/OTP SSH Server: April 2025
On April 16, 2025, a critical vulnerability in the Erlang/OTP SSH server was disclosed. This vulnerability could allow an unauthenticated, remote attacker to perform remote code execution (RCE) on an…
sec.cloudapps.cisco.com
The profile you need to create has been documented by the PortSwigger's support team 🔍 Scroll down to the end of the following thread and simply copy the provided config to /etc/apparmor.d/burpbrowser 💪 forum.portswigger.net/thread/burp-...
Good analysis of CVE-2025-30065 (Java Deserialization Vulnerability in Apache Parket). I would that (depending on the Java version) it possible to use a gadget that causes an outgoing JNDI call. attackerkb.com/topics/jAhVR...
CVE-2025-30065 | AttackerKB
Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code Users are recommended to u…
attackerkb.com
Our crew members @mwulftange.bsky.social & @frycos.bsky.social discovered & responsibly disclosed several new RCE gadgets that bypass #Veeam 's blacklist for CVE-2024-40711 & CVE-2025-23120 + further entry points after @sinsinology.bsky.social & @chudypb.bsky.social 's blog. Replace BinaryFormatter!
Private Key reuse for requesting https certificates is the new "outdated JavaScript libraries" for penetration testers. - Large number of services affected - Easy to find / verify - Hard to actually exploit Still nice research from the Truffle Security Team. www.youtube.com/watch?v=gyyt...
Millions Of Public Certificates Are Reusing Old Private Keys - Dylan Ayrey, Joseph Leon
YouTube video by OWASP Foundation
youtube.com
Happy to share my slides from BOOTSTRAP25. Unfortunately the bug discussed is still not patched in Linux 6.14.0 despite it being reported explicitly. Slides are in markdown but there's a PDF in "releases" too github.com/jduck/bs25-s...
GitHub - jduck/bs25-slides: Slides from "Musing from Decades of Linux Kernel Security Research" at BOOTSTRAP25
Slides from "Musing from Decades of Linux Kernel Security Research" at BOOTSTRAP25 - jduck/bs25-slides
github.com
Today, Wiz (Woogle?) released an advisory detailing an attack chain they’ve dubbed IngressNightmare, which, if left exposed and unpatched, can be exploited to achieve remote code execution by unauthenticated attackers. Read more at www.runzero.com/blog/ingress...
Our next meetup is a presentation from our friends at X41 D-Sec GmbH. Join us next Wednesday, March 26th, at 14:00 CDT for a presentation and discussion with Markus Vervier and Eric Sesterhenn on their audit of @mullvad.bsky.social. We can't wait for this one! RSVP at lu.ma/wreregye
Security Code Audit of Mullvad VPN · Zoom · Luma
Join us for a presentation and meetup with Markus Vervier and Eric Sesterhenn of X41 D-Sec GmbH around their company's audit of Mullvad VPN. Markus Vervier is…
lu.ma
Root cause analysis of Sitecore XM + XP remote code execution CVE-2025-27218 via @rapid7.com's pen testing team attackerkb.com/assessments/...
machang-r7's assessment of CVE-2025-27218 | AttackerKB
On January 6, 2025, Sitecore published a security bulletin, SC2024-002-624693 , for a critical unauthenticated remote code execution (RCE) vulnerability affect…
attackerkb.com
Finally had some time to put together a new blog post. It’s not groundbreaking, but it could still be interesting if you're into application security.
@mogwailabs.bsky.social · last yr.In our latest blog post, we dive into the hidden gems of the Java library c3p0 and explore how it can be leveraged in different exploitation scenarios. Happy reading! 😀 mogwailabs.de/en/blog/2025...
