afine

If you're looking for good guys ready and able to hack you, you don’t need to look any further. We professionally find vulnerabilities before the bad guys do.

[afine @afinePL]

The race window is two syscalls: readlink() records the output path, then open() re-resolves the symlink. Swap the symlink between those calls - sed reads from the attacker file, and writes to the victim file.

Full breakdown:
https://t.co/rCXN68h8cz

[afine @afinePL]

CVE-2026-5958: GNU sed 4.1e through 4.9 has a TOCTOU race condition. Run sed -i --follow-symlinks, and an attacker swapping a symlink between readlink() and open() causes sed to read from one file and write to another.

[afine @afinePL]

Our researcher logged into an MDM console as a user with zero UI permissions and walked out with developer access to every managed phone in the fleet. Two GETs. CVE-2025-1415 + CVE-2025-1416 in Proget MDM.

https://t.co/UAoBA4jzGy

[afine @afinePL]

Most pentest scopes skip the kiosk. It is a $16 billion industry processing payments and PII on machines in public lobbies. If your kiosks are on the corporate network and not in your test scope, that is the gap.

Full writeup: https://t.co/cz2tRSod0n

[afine @afinePL]

We broke out of a bank lobby kiosk and ran a network scan. No segmentation. AD server, payment gateway, customer database - all reachable. Full internal access from a device anyone can walk up to.

[afine @afinePL]

Three CVEs in KioWare (CVE-2024-3459, CVE-2024-3460, CVE-2024-3461), plus a vendor patch bypass. The chain: brute-force the PIN, escape through a PDF viewer, escalate to SYSTEM. A $3 USB device starts it.

[afine @afinePL]

Full walkthrough - firmware extraction with binwalk, reverse engineering in Ghidra, QEMU emulation, GDB fork debugging, confirmed overflow:

https://t.co/3uM9pmU0LA

[afine @afinePL]

On MIPS, the NOP instruction is 0x00000000. Four null bytes.

The overflow goes through sprintf. Null bytes terminate the copy. Standard NOP sleds are dead on arrival.

[afine @afinePL]

He had to build a GDB reconnection workflow:

- Set gdbserver to listen
- Fire the HTTP request
- Catch the forked CGI process before it exits
- Re-attach on every single request

[afine @afinePL]

Our researcher pulled firmware off a consumer MIPS router, emulated it in QEMU, and found a pre-auth stack buffer overflow in the login handler.

No canary. No NX. No PIE. Just kernel ASLR.

CVE is pending. Here is what the full chain looked like.

[afine @afinePL]

The hardest part was not finding the bug. It was debugging it.

The router runs CGI binaries - the HTTP server forks a new process per request. Process handles the request and exits. Your GDB session dies with it.

[afine @afinePL]

Four CVEs. Three attack chains. Each reaches the underlying Windows host through a different path.

https://t.co/5aKigDr2LA

Part 3 soon: what happens when a compromised kiosk sits on a corporate network.

[afine @afinePL]

Our researcher opened Notepad on a locked kiosk, clicked File > Open, and was looking at the entire Windows filesystem.

No exploit. No special tools. A file dialog.

CVE-2024-3460 in KioWare for Windows.

[afine @afinePL]

To deliver the payload we needed a trusted domain. The bank’s URL filter blocked our VPS.

What got through: OWASP Juice Shop. XSS in an intentionally vulnerable security training app with a high-reputation domain.

[afine @afinePL]

Someone is sending fake invoices to German companies using our name, logo, and VAT number.

The invoice: "GDPR/DSGVO Technical Compliance Audit" - 5,000 EUR - "pay immediately."

If you received one: don't pay. Report to local police. Forward to [email protected].

[afine @afinePL]

For a full breakdown of a problem-solution approach, go there:
https://t.co/MbwQaBtenf

[afine @afinePL]

Our research team pointed at line 8 in a file and said "this is the payload." Line 8 looked empty.
It wasn't. 4,312 invisible Unicode characters - a full credential stealer that no editor, linter, or code review tool can display. That's GlassWorm.

[afine @afinePL]

The problem: every wave uses new package names, new extension IDs, new infrastructure. Signature-based detection is always one wave behind. So we built a scanner that detects the encoding technique itself.
Open source. Offline. pip install glassworm-hunter
https://t.co/Obnwai6zli