Vulnerabilities
Kallithea <= 0.3.4 Incorrect access control and XSS
This vulnerability allows a normal user to modify the permissions of repositories that he normally shouldn’t have access to.
12-12-2018
2 MIN READ
Vulnerabilities
Gitea 1.4.0 Unauthenticated Remote Code Execution
This is part 1 of 3 about bugs inside Gitea
05-07-2018
5 MIN READ
Vulnerabilities
ManageEngine Exchange Reporter Plus Unauthenticated Remote Code Execution
How to create a Metasploit module in example?
28-06-2018
1 MIN READ
Vulnerabilities
GitBucket 4.23.1 Unauthenticated Remote Code Execution
GitBucket Unauthenticated Remote Code Execution working when server is installed on Windows and authenticated arbitrary file read working on every platform
21-05-2018
4 MIN READ
Vulnerabilities
Exploit/bypass PHP escapeshellarg/escapeshellcmd functions
I create this simple cheat sheet because of GitList 0.6 Unauthenticated RCE so you can easily understand how it works.
25-04-2018
5 MIN READ
Vulnerabilities
GPG Reaper - Steal GPG Private Keys
This POC demonstrates method for obtaining GPG private keys from gpg-agent memory under Windows. Normally this should be possible only within 10 minutes time frame (--default-cache-ttl value).
05-03-2018
1 MIN READ
Vulnerabilities
Pentest TeamCity Server using Metasploit
Obtain passwords from JetBrains IDE (like IntelliJ or PyCharm) and use those credentials inside TeamCity Continuous Integration Server
11-02-2018
1 MIN READ
Vulnerabilities
Burp WP - Find vulnerabilities in WordPress using Burp
If you have Burp Pro, issues will also appear inside Scanner tab. Interesting things will be highlighted.
22-01-2018
1 MIN READ
From 0 to pentesting hero
Clickjacking
How to convince the user to delete his account on the website without his consent?
17-04-2019
3 MIN READ