Vulnerabilities

Kallithea <= 0.3.4 Incorrect access control and XSS

This vulnerability allows a normal user to modify the permissions of repositories that he normally shouldn’t have access to.

12-12-2018

2 MIN READ

Vulnerabilities

Gitea 1.4.0 Unauthenticated Remote Code Execution

This is part 1 of 3 about bugs inside Gitea

05-07-2018

5 MIN READ

Vulnerabilities

ManageEngine Exchange Reporter Plus Unauthenticated Remote Code Execution

How to create a Metasploit module in example?

28-06-2018

1 MIN READ

Vulnerabilities

GitBucket 4.23.1 Unauthenticated Remote Code Execution

GitBucket Unauthenticated Remote Code Execution working when server is installed on Windows and authenticated arbitrary file read working on every platform

21-05-2018

4 MIN READ

Vulnerabilities

Exploit/bypass PHP escapeshellarg/escapeshellcmd functions

I create this simple cheat sheet because of GitList 0.6 Unauthenticated RCE so you can easily understand how it works.

25-04-2018

5 MIN READ

Vulnerabilities

GPG Reaper - Steal GPG Private Keys

This POC demonstrates method for obtaining GPG private keys from gpg-agent memory under Windows. Normally this should be possible only within 10 minutes time frame (--default-cache-ttl value).

05-03-2018

1 MIN READ

Vulnerabilities

Pentest TeamCity Server using Metasploit

Obtain passwords from JetBrains IDE (like IntelliJ or PyCharm) and use those credentials inside TeamCity Continuous Integration Server

11-02-2018

1 MIN READ

Vulnerabilities

Burp WP - Find vulnerabilities in WordPress using Burp

If you have Burp Pro, issues will also appear inside Scanner tab. Interesting things will be highlighted.

22-01-2018

1 MIN READ