Clik here to view.
Pentesting Multi-user and Android Enterprise apps
We were recently asked to assess the security of a well known BYOD solution that uses Android Enterprise management to create a separate working environment on the employee’s owned device. In this...
View ArticlePrimeFaces CVE-2017-1000486 exploit – old but good!
Hi! I published on my GitHub repository an exploit for PrimeFaces CVE-2017-1000486 based on an existent one created by pimps (the original one is here). CVE-2017-1000486 is a RCE issue in many...
View ArticleAndroid OkHttp3 4.2+ certificate pinning bypass for Frida and Brida
Hi! I just added to Brida a small Frida script to bypass SSL/TLS certificate pinning on OkHttp3 4.2+ of Android, developed with my colleague Piergiovanni. You can use the script with the GitHub...
View ArticleiOS 13 certificate pinning bypass for Frida and Brida
Hi! I just added to Brida a small Frida script to bypass SSL/TLS certificate pinning on iOS 13 devices. The script is a modification of the iOS 12 certificate pinning bypass of machoreverser, based on...
View ArticleClik here to view.
LetMeHID! Red Teaming with P4wnP1 A.L.O.A.
Hi! Today I’m publishing a little tool I created some months ago. In these days I’m publishing a lot of things but obviously I’m not coding all day and night! As many of you, I’ve been stuck at home...
View ArticleClik here to view.
My ysoserial fork
Hi! During the years many people ask to me the code I used to generate payloads of Java Deserialization Scanner. These payloads are generated with a customized version of Chris Frohoff ‘s ysoserial,...
View ArticleJava Deserialization Scanner 0.6 is out!
Hi! I just released version 0.6 of Java Deserialization Scanner! The first improvement is the addition of URLDNS gadget, that is an active check that detects Java deserialization on the backend...
View ArticleCVE-2020-2771 – Heap-based buffer overflow in Solaris whodo and w commands
A difficult to exploit heap-based buffer overflow in setuid root whodo and w binaries distributed with Solaris allows local users to corrupt memory and potentially execute arbitrary code in order to...
View ArticleCVE-2020-2851 – Stack-based buffer overflow in CDE libDtSvc
A difficult to exploit stack-based buffer overflow in the _DtCreateDtDirs() function in the Common Desktop Environment version distributed with Oracle Solaris 10 1/13 (Update 11) and earlier may allow...
View ArticleClik here to view.
CVE-2020-2944 – Local privilege escalation via CDE sdtcm_convert
Since I moved from Solaris 11 to audit Solaris 10, my weekend project has become much more fun… As you already know if you are a reader of this blog, at the beginning of November I started auditing...
View ArticleClik here to view.
Brida 0.4 is out!
After quite a lot of hours of work, Brida 0.4 is finally out! Brida 0.4 should have been presented at Hack In Paris 2020 but, due to the postponement of the conference for the COVID-19 global...
View ArticleCVE-2020-7247 exploit: LPE and RCE in OpenBSD’s OpenSMTPD
I’ve written an exploit for the local privilege escalation and remote command execution vulnerability in OpenBSD’s OpenSMTPD recently reported by Qualys as CVE-2020-7247: “smtp_mailaddr in...
View ArticleClik here to view.
CVE-2019-12180 – ReadyAPI & SoapUI command execution via malicous project file
In early 2019, I had to pentest a couple of SOAP WebServices of a client and, as usual, I requested them some example requests as a baseline for my analysis. The client suggested to use a SoapUI /...
View ArticleClik here to view.
OK Google: bypass the authentication!
During a recent assessment of a voice application we found a very intriguing vulnerability that, besides being a lot of fun to exploit, demonstrates how the complexity of modern applications, built on...
View ArticleCVE-2020-7799 – FusionAuth “Apache Freemarker” Code Execution
@Mediaservice.net Security Advisory #2020-03 (last updated on 2020-01-27) Title: FusionAuth command execution via Apache Freemarker Template Application: FusionAuth 1.10 and lower Platforms: Tested on...
View ArticleClik here to view.
CVE-2020-2696 – Local privilege escalation via CDE dtsession
During my recent audit of Oracle Solaris, undertaken as a weekend project, I inevitably had to review the Common Desktop Environment shipped with Solaris 10. CDE has a huge attack surface of legacy...
View ArticleCVE-2020-2656 – Low impact information disclosure via Solaris xlock
A low impact information disclosure vulnerability in the setuid root xlock binary distributed with Solaris may allow local users to read partial contents of sensitive files. Due to the fact that...
View ArticleClik here to view.
CVE-2019-3010 – Local privilege escalation on Solaris 11.x via xscreensaver
As previously mentioned, INFILTRATE left me with the will to hack stuff and enjoy it like it was 1999. That’s why I decided to take a closer look at Solaris 11.4 and search for potential...
View ArticleClik here to view.
Remote Desktop tunneling tips & tricks
During a recent pentest, we got access with weak credentials to a Windows machine via Remote Desktop connection, a pretty common scenario. The firewall between us and the target network, however, was...
View ArticleClik here to view.
Graph’s not dead
Facebook has recently disabled the usual way of performing Graph searches, which worked by crafting URLs in the correct format. This strongly limited the capacity of researchers, journalists and...
View Article
