I love contributing to a safer Cyber Security Ecosystem
through
Offensive Security Research

My Github

[ University ] We need to access to environment variable. @app.route('/', methods=['GET', 'POST']) def login(): if request.method == 'POST': username = request.form['username'] password = request.form['password'] try: response = requests.get(f"http://localhost:5000/api/users/{username}/auth") response.raise_for_status() conn = connect_db() cursor = conn.cursor() cursor.execute('SELECT * FROM use..

Serialization & DeserializationSerialization : 데이터 구조체나 Object 상태의 데이터를 다른 시스템 환경에서도 해석될 수 있도록 Byte Stream 상태로 변환하는 과정Deserialization : Byte Stream 상태의 데이터를 데이터 구조체나 Object로 변환하는 과정Phar (PHP Archive)Phar는 내부에 실행 가능한 PHP 코드를 모아놓은 아카이브 포맷을 뜻한다. Phar 파일은 아래 4가지의 구조로 이루어진다.StubManifestFile ContentsSiganutre (Optional)[ Stub ]Stub은 작은 형태의 코드를 담을 수 있는 공간이다. Stub의 마지막 명령어에는 반드시 _HALTCOMPILER()가 포함되어야 한..

[ Info ]Target : Nginx Proxy ManagerVersion : 2.9.19Category : Arbitrary Code Execution[ Build ]docker run -p 8080:80 -p 8081:81 jc21/nginx-proxy-manager:2.9.19[ Product Overview ]Nginx Proxy Manager which is based on NodeJS, is a open-source tool to simplify the management of Nginx's proxy, SSL, Access lists, and more. It lets user manage, control their site easier. For example, it provide the ..

Title Page

Vulnerable Product & VersionAll FireFox Users ( Services which use pdfjs-dist(SummaryPDF.js acts as a viewer to show a preview of a pdf file, which is made by Mozila.It has the ability to render fonts and CVE-2024-4367 vulnerabilitiy targets this part.The user can set the values of the PDF file's properties, and pdf.js applies them by executing JavaScript code.However, there is no validation of ..