Notes from
offensive security.
Writeups of disclosed bugs, reverse engineering notes, and the occasional experiment in automated recon. By Nick Mykhailyshyn.
# Latest postsview all →
Security
Plausible Analytics: Pre-Auth RCE, Cross-Tenant IDORs, and SSRF-to-RCE
Multiple critical vulnerabilities at Plausible Analytics: pre-auth Storybook RCE, registration bypass with cross-tenant IDORs and stored XSS, and SSO verification SSRF to PostgreSQL RCE.
Security
$15k - CSPT to full account takeover, then 2FA bypass via the prototype chain
A client-side path traversal in the front-end's URL builder turned into arbitrary PUT/DELETE on the API, then chained with an inherited-property lookup bug to bypass 2FA
Security
SSRF in Ghost CMS via oEmbed (CVE-2020-8134)
How Ghost's embed-anything input let an authenticated publisher pivot the server into cloud metadata endpoints - and what the fix actually changed.