GHSA-435m-gr6q-2fg6 — Joplin Server Unauthenticated Account Takeover Infinit3i This is a vulnerability I found and reported in Joplin Server, the self-hosted sync backend behind the Joplin no...

An IIS web app passes user JavaScript directly to d8.exe (V8 12.2.0); a type-confusion bug in Harmony Set methods yields arbitrary read/write, then WASM JIT shellcode delivers the shell. From there, a vulnerable kernel driver lets you read the LSTAR MSR to defeat kASLR, stack-pivot into a ROP chain that flips a PTE bit to bypass SMEP, and run token-stealing shellcode to land SYSTEM.

GHSA-p347-7m45-694r — Huginn LocalFileAgent Arbitrary File Read Infinit3i & p80n-sec This is a vulnerability I reported (alongside p80n-sec) in Huginn, the self-hosted automation platform...

GHSA-8p88-j43q-rrp9 — Jellystat Backup-Restore SQL Injection to RCE Infinit3i This is a second SQL-injection-to-RCE bug I found in Jellystat, and it’s a sibling to GHSA-gjqm-fhgh-rrgv. Same e...

GHSA-gjqm-fhgh-rrgv — Jellystat SQL Injection to RCE Infinit3i This is another one I found and reported. Jellystat is a self-hosted statistics dashboard for Jellyfin, and it turns out three o...

An anonymous SMB share leaks a custom .NET monitoring app whose Web.config hardcodes the sqlsvc MSSQL password. MSSQL on port 6520 exposes a linked server pointing at an unresolvable host; abusing default AD DNS write rights to inject an A record + a use_link trigger coerces the SQL service to authenticate to the attacker, where Responder captures a second account's password in cleartext — logging straight into WinRM for the user flag.

A custom Windows key-licensing service leaks its own load address via a format string bug, then a stack buffer overflow with a ROP chain makes memory executable for a msfvenom reverse shell; a third-party kernel driver with an unguarded IOCTL completes the escalation by writing the SYSTEM process token over the current process's token pointer.

Luke is a medium FreeBSD box driven entirely by enumeration and credential reuse. Anonymous FTP and a directory-listing on the web root leak config files, a Node.js/Express API authorizes on a client-supplied username and leaks every user's plaintext password through an IDOR, and the harvested credentials unlock the host's management panel. This post covers recon through the user flag.

An IIS parts-catalog app processes .shtml files through Server-Side Includes regardless of Content-Type, leaking the ASP.NET machineKey from web.config. RC4 keystream reuse on a staging encrypt oracle decrypts the ViewStateUserKey; a TextFormattingRunProperties ViewState gadget exfills an SSH private key. An AES-CBC padding oracle on the internal staging app then forges a command-injection payload that runs as SYSTEM.

A public GitWeb instance leaks the full source of a Ruby on Rails blog, revealing Rails 5.2.2.1 — vulnerable to CVE-2020-8165. The app caches your username in Redis and deserializes it with Marshal.load, so a crafted serialized object stored as a username executes a shell command on the next page load, giving code execution as bill and the user flag.

Overview This lab demonstrates a reflected XSS vulnerability where a WAF blocks most HTML tags and event-handler attributes — but the allowlist is finite and enumerable. The intended bypass uses a...

Ethereal is a deeply layered Insane Windows box: FTP anonymous login leaks a Password Safe vault whose cracked master password opens an ASP.NET command-injection form; from there, egress-filtered to two SSL ports, the chain pivots through a shortcut automation trap to jorge and then through a self-signed MSI AppLocker bypass to rupal.

Overview This lab demonstrates a reflected DOM-based XSS vulnerability where the server reflects user input inside a JSON response, and client-side JavaScript passes that JSON to eval() — executin...

An ASP.NET product-search page is SQL-injectable, and MSSQL's xp_dirtree is abused to coerce the SQL service account into authenticating to an attacker SMB share — capturing and cracking a NetNTLM hash for user stacy, whose credentials log straight into WinRM as a local administrator for the user flag.

Overview This lab demonstrates a stored DOM-based XSS vulnerability where a custom JavaScript sanitiser uses String.replace() with a plain string argument — replacing only the first occurrence of ...

Tentacle is a Hard Linux box built around a Kerberos realm. A Squid proxy with an authentication bypass pivots into an internal network running a vulnerable OpenSMTPD (CVE-2020-7247) for the foothold; a plaintext msmtp password becomes a Kerberos ticket for the user shell; a squid-group-writable directory rsynced by a root cron plants a .k5login for the admin account; and an admin-group-readable krb5.keytab grants kadmin to mint a root principal and ksu to root — recon through root.

Lab PortSwigger Web Security Academy — DOM XSS in AngularJS expression with angle brackets and double quotes HTML-encoded Difficulty: Practitioner CWE: CWE-79 (Cross-Site Scripting) Sub-class: Cl...

A web server hands out a downloadable Docker image whose discarded layers still hold a deleted SQLite database and source code; recovering a cracked admin hash and a hardcoded invite code unlocks a demo site whose profile form is blind Jinja2 SSTI, giving code execution as www-data — and a plaintext Passbolt config password reused for SSH lands the user flag as eddie.

PortSwigger’s DOM XSS in document.write sink using source location.search inside a select element lab demonstrates a case of DOM-based Cross-Site Scripting where the injection context is the inner ...

YPuffy is a Medium OpenBSD box where an anonymous LDAP bind leaks a user's NT hash, which pass-the-hashes into Samba to grab an unencrypted PuTTY key and SSH in. Root comes from a doas rule that lets the user run ssh-keygen as the SSH certificate authority owner, forging a root login certificate — this post covers recon through root.