Writeups

TL;DR: nonce leak via CSS exfiltration and ESI injection

TL;DR: Exfiltration through XS Leak via server-side redirects detection

TL;DR: RCE through polluting node execSync options and algorithm confusion

TL;DR: XSS via HTML entity double-parse and CSP bypass via PHP warning

TL;DR: SSRF by bypassing the https:// scheme filter through an XML parsing discrepancy

TL;DR: RCE via data: URI injection in import() and node permission bypass via inspector API

TL;DR: XSS via path traversal chained with arbitrary file write through PHP session upload progress

TL;DR: Stored XSS bypassing the CSP via a raw HTTP response endpoint, chained with a meta-refresh redirect to hijack the admin bot

TL;DR: Recovering Wi-Fi and browsing history from an iOS iTunes backup to identify a phishing infrastructure

TL;DR: Recovering credentials and files from an unencrypted shellinabox session in a network capture, then decrypting a LUKS container with the recovered passphrase