scryh

Cloud Vulnerability Research at Google. Opinions are my own.

[pspaul @pspaul95]

This was a fun one to discover!
SQL syntax can be ambiguous, and MySQL anticipated this a long time ago. Other SQL dialects stuck to the spec, leading to SQL injection when the right stars align:

[Sonar Research @Sonar_Research]

What a year! We look back and summarize our security research highlights of 2024:

🪲 Vulnerabilities in Jenkins, SourceForge, Joomla, and much more
🎙️ 7 talks, including DEF CON and Hexacon
🏆 5 nominations and 1 award

https://t.co/EYfGfOn9ni

#research #vulnerability #appsec

[Google VRP (Google Bug Hunters) @GoogleVRP]

Introducing InternetCTF! 🤯 Earn up to $10,000 for finding RCE vulnerabilities in open-source software AND creating Tsunami plugin patches. Make the internet safer and get rewarded! 🤑

For details on the program, see our latest blog post:

https://t.co/kKqWjJTBO3

[Sonar Research @Sonar_Research]

CORS misconfigurations are definitely not good, but how bad can they get? 🧐

Our latest blog post discusses how an origin reflection issue detected by SonarQube leads to code execution in a real-world application:

https://t.co/XfL853VqM0

#appsec #security #vulnerability

[Yaniv Nizry @YNizry]

🧬🔬 I wrote about this finding a bit more extensively in my blog:
https://t.co/3CeEnbSutq

#mXSS #XSS

[James Kettle @albinowax]

We’re finally live! You can now watch “Listen to the whispers: web timing attacks that actually work” on YouTube: https://t.co/x9HO9KUWS0

[Hexacon @hexacon_fr]

Recordings of the #HEXACON2024 talks have been uploaded to our YouTube channel 🎬

https://t.co/JAquA5BJea

See you next year!

[pspaul @pspaul95]

JS engine pwning, the old-school way!

For this year's Hacklu CTF, I wrote a challenge about exploiting a SpiderMonkey version from 2007. I'm usually not a pwner, but it was very fun to learn about all this stuff. Read the write-up here:

https://t.co/f3VBJxkSSK

[Justin Gardner @Rhynorater]

Absolutely stunning work from @pspaul95 on this CSS Injection - > text node exfil technique.
https://t.co/UYPfAZWhk7

[scryh @scryh_]

@frycos @hexacon_fr Thank you :)

[scryh @scryh_]

A blog post with the technical details of my @hexacon_fr talk is now live. Thank you all for the positive feedback on the talk :)

[Sonar Research @Sonar_Research]

From HTTP request to ROP chain in Node.js! 🔥

Our latest blog post explains how to turn a file write vulnerability in a Node.js application into RCE – even though the target's file system is read-only:

https://t.co/Yw89oZhv32

[scryh @scryh_]

@0xTh3Mag1c1an @snyff @hexacon_fr Thanks :)

[scryh @scryh_]

@kmkz_security @hexacon_fr Thank you!

[scryh @scryh_]

@SinSinology Thank you very much! 🙏

[Sonar Research @Sonar_Research]

Having trouble exploiting a file write vulnerability?

Don't miss our @hexacon_fr talk to learn more about unconventional attack surfaces that can turn a file write into code execution – even in hardened environments!

We'll follow up with a related blog post later.

#HEXACON2024

[Sonar Research @Sonar_Research]

Join us at OWASP SF for our talk, "Sanitize Client-Side: Why Server-Side HTML Sanitization is Doomed to Fail" to discover why client-side sanitization is crucial for a secure web. Can't make it? Stay tuned for our upcoming blog post.

#OWASP #GlobalAppSecSanFran

[Hexacon @hexacon_fr]

You can find all the talks announced on the agenda: https://t.co/u4aKeGa7ac

Again, a big thanks to the review committee for their contribution as well as everyone who took the time to submit a talk. 🙏

[Piotr Bazydło @chudyPB]

As promised, Exchange PowerShell research is getting published in a form of blog posts. Part 1/4 describes two RCEs: MultiValuedProperty internal deserialization + a chain with Command gadget.

[Sonar Research @Sonar_Research]

A recording of our @WEareTROOPERS talk "From ASCII to UTF-16: Leveraging Encodings to Break Software" is now available!

The talk covers basic knowledge of character encodings and explains various vulnerability types and exploitation techniques:

https://t.co/NPzyqoxU6w

[Hexacon @hexacon_fr]

"Exploiting File Writes in Hardened Environments - From HTTP Request to ROP Chain in Node.js" 📝

by Stefan Schiller (@scryh_)