Rubicon: PhaaS
Rubicon — inside a device-code phishing kit How we found Rubicon, what the panel does, Org Takeover / PRT / tunnels / Keyword Listener, the PIN + SSTI chain, IOCs. How it started While browsing Shodan
0SPwn Blogs
Hi, I'm Jay. A 17, Security Consultant (Pentester), Contracted OffSec Web App Trainer @hackthebox_eu & BSIDES 2023 Speaker @BSidesCymru.
Latest articles
PCAP Analysis of a compromised WordPress application.
Reconstructing a WordPress Compromise Using TShark Summary This investigation reconstructs a WordPress compromise using nothing more than a PCAP and TShark. Rather than answering the challenge questio
How CVE-2022-24785 MomentJS Path Traversal Works: Detailed Exploit Guide
CVE-2022-24785 Description Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a u...
Basic Firmware Reverse Engineering
Hello everyone, today we will be covering something a little different. We will be taking a look at how to reverse engineer firmware which we can then backdoor (I will not be covering backdooring a firmware as I do not have a lab setup however if you...
Recon, Vulnerable Code Assessment, Exploit Automation, Bypasses & Patching all one. (Python, PHP)
Hello everyone, hope you are all well! Today we will be continuing our Python Hacking Series, this time however we will not be covering basics but actually utilising some of our knowledge to construct an exploit! What will be covered? Recon Vulnera...
0-Day Hunting (Chaining Bugs/Methodology)
Introduction to 0-Day Hunting/chaining vulnerabilities Hello everyone, I wanted to write a blog on how I go around my method of thinking for finding zero-days. I have found a few zero-days in the past. I haven't written a blog about them yet though m...
Bypassing PHP strcmp()
Introduction to Bypassing PHP strcmp() What will be covered today? What is strcmp() Buggy Code review Bypassing strcmp() Fixing the bug(s) What is PHP strcmp()? str = String & cmp = Compare str+cmp=strcmp() The strcmp() function compares two stri...
IDN Homograph Attacks/Prevention
Introduction to IDN Homograph Attacks What will be covered today? What is an IDN Homograph Attack? Example of IDN Homograph Attack Reversing a Phishing Email Source Preventing IDN Homograph Attacks Different phishing Attacks/Methods What is an IDN ...