0day.click

Of course I took a peek at the Claude Code source 🙈.

Given my interest in SCM and CI systems I was a little keen to see how this is done at Mozilla as part of their bug bounty program.

I was staring at this part of the code for way too long already: module Jobs class ConfirmSnsSubscription < ::Jobs::Base sidekiq_options retry: false def execute(args) return unless raw = args[:raw].presence return unless json = ar…

Discourse offers the possibility to install themes from remote Git repositories.

While attendig WarCon in 2016 greg and I sat together in .mario’s talk My Sweet Innocence Exposed - Eleven Reasons why we will all miss you, “e”, his rants about MSIE reminded us of the fact that we both had the task of finding a Mosaic 0day still on our…

I’ve gotten a couple of questions about exploitation for the recent RCE in Git.

Summary mspaint.exe does not properly verify Dib data from the clipboard.

With the release of Ruby on Rails 4.2 the so called Web Console was introduced.

Original gist #!

Original gist GitHub RCE by Environment variable injection Bug Bounty writeup Disclaimer: I'll keep this really short but I hope you'll get the key points.

Original gist This turns https://www.sec-consult.com/files/20120626-0_zend_framework_xxe_injection.txt into a Remote Command Execution: NOTE: It relies on the PHP expect module being loaded (see http://de.php.net/manual/en/book.expect.php) joern@vbox-1:…