All posts in Computer Security

I really enjoy finding and exploiting critical findings. Following the below process helps me finding bugs consistently. 📚 Study Vulnerability Classes Familiarize yourself with different attacks, know when they apply, and understand their mitigations. This is key for three reasons: You increase your probabilities of finding good bugs. If you’re not aware of XXE, you would likely…

I’ve wondered this for a while (especially when it comes to the private sector job market). Few Interesting Findings From Analyzing Data: ~1% of Global LinkedIn computer security related profiles mention memory corruption terms ( 22K/1.950M) ~1% of US LinkedIn computer security profiles mention memory corruption terms (11K/909K) ~501 Researches have submitted Memory Corruption bugs…

So you want to be a white hat hacker? Computer Security is a fascinating field and can be quite rewarding. The work you do will protect people’s privacy, prevent fraud , and can even save people’s lives when working on critical systems. Having a college degree isn’t necessary. What’s more important is training yourself to…

There’s an interesting quote that said the ability to take finer measurements allows leaps in the advances of science. Looking back at when I started to reverse engineer as a kid, it’s cool to see how I may approach problems differently as I learned new techniques. Uncovering Structure of Target Binary Detecting Decryption vs CompressionIf…

TLDR; TPEditor v1.96 does not perform bound checking when copying “boot page” (.sta) file content to memory. The finding can be exploited to gain arbitrary code execution upon file opening. Greetz to @mufinnnnnnn who paired up with me on the review. It was a highly collaborative effort to discover and exploit the bug. [ZDI Link] This…

Recently my CVE-2021-29084 went public [ZDI Link]. We thought it would be fun to share my disclosure notes. TLDR; The Synology DS418play NAS contained an unauthenticated accessible endpoint vulnerable to HTTP header injection. Due to nginx’s configuration, the X-Accel-Redirect header can be used download files which are shared via SMB. Note the finding requires knowledge…

Disclaimer: If you have access to your Bitwarden Vault items, it’s best to make a copy of all vault items ASAP. Create a new Bitwarden account without logging out of the old account, SAVE A COPY OF THE NEW ACCOUNT’S MASTER PASSWORD, and then copy vault items into the new account manually. Tampering with Bitwarden is NOT recommended,…

The use of BinaryFormatter in .NET applications often leads to Remote Code Execution quite easily. See https://github.com/pwntester/ysoserial.net for example gadgets. When testing the TypeConfuseDelegate payload in your own project, a couple of exceptions may be thrown: ‘Object must implement IConvertible’ – This occurs when the appropriate deserialization types can not be found. Check to ensure…

Fedora uses SELinux’s Multi Category Security to restrict VMs from accessing other VMs backing disks. Each VM is assigned a randomized category number when starting. When accessing a VM disk file from another running VM, such as by sharing a directory, an error similar to the following is logged by systemd: audit[26742]: AVC avc: denied…