Category: Penetration Testing

CraftCMS Zero-day – SSTI + XSS triggering RCE

CraftCMS allows users to upload files via its Asset field. But the storage feature known as volume within Craft CMS can be configured to point to any directory. This ability can be exploited to upload a twig template to the templates directory. By pointing a route to the uploaded malicious twig template, we get a successful Server Side Template Injection. Using filters, we can get out of the twig sandbox and get an Arbitrary Code Execution.

You don’t need

Many newcomers as well as professionals focusing on XSS seems to miss out one simple yet powerful thing: data URLs. While finding an XSS, hackers test the vulnerability with some hosted solution like or host their own files. But most of the time, you don’t need a hosted javascript file. You can simply use […]

Bypassing WAF in Misconfigured WordPress

Web Application Firewalls like CloudFlare are pretty good at protecting websites by tunnelling the traffic through their secure servers. But if the underlying IP address is leaked, such protection is usually bypassed and the attacker can directly target the application. IP Disclosure in WordPress WordPress stores the site url and home url in the database […]

Open Redirect in Flattr

This bug in Flattr was a low impact Open Redirect that allowed attacker to redirect the victim after authorizing Twitter. PoC Timeline Found vulnerability – 5th June, 2020 Made contact with Flattr – 5th June, 2020 Reported vulnerability – 9th June, 2020 Bug fixed – 11th June, 2020 Reference