Posts on hesec.de

A blog post about my experience on CWEE and the massive goshs v2.0.0 update

A blog post about replacing my Sophos UTM with an OPNsense firewall

IPW Systems Metazo had an unauthenticated SSTI that was leading to RCE in it.

This blog post tells the weird story on how I unexpectedly attended the training for Advanced Windows Exploitation (OSEE) in London

This blog post will give an insight into the world of becoming an Offensive Security Exploit Developer and concluding the journey to OSCE³

Kardex MLOG has an insecure path join, which allows to include files locally or from a remote smb server.

In this blog post I want to test the new ChatGPT AI and see if I can design a ctf challenge written in golang aided by the AI.

This blog post will give an insight into the world of becoming an Offensive Security Web Expert and how it did compare to OSEP

In this post I will explain when CSRF can be a serious issue.

This blog post will describe my adventure with the german armed forces and how I earned more than just a lousy T-Shirt.

This blog post will give an insight into the world of becoming an Offensive Security Experienced Penetration Tester as I have experienced it

In this article I will show how you use `Gophish`, `Caddy` and `Maddy` with webhook to setup a complex phishing framework situation

In this blog post I will use a third-party library called parcello to embed static files into my project.

In this blog post I will add a few new features to our beloved *goshs*.

In this blog post I will pickup the progress of the previous post and I will try to achieve some kind of code quality by splitting up the code and outsourcing the handler into an own *"class"*.

In this blog post I will describe how I replicated python's `SimpleHTTPServer` functionality in go using **only** the standard libraries.

The Secure File Transfer Solution Qiata by Secudos suffers from two vulnerabilities.

INNEO Startup Tools has a path traversal vulnerablility in versions up to 2018 M040 (13.0.70.3804).