robin verton - Software engineer, security engineer, security expert

The Claude Desktop app is slow as hell and takes multiple seconds to open.

AI is rushing deep into the tech world.

This cost me some time googling and fiddling around with my config, so here is a quick setup on how to get Go’s html/template format working with neovim.

I like to write all kind of documentation in Markdown.

I’m currently developing a webservice in Go for a customer, where I need to write a lot of HTTP endpoints.

I’m currently developing a web application with the Phoenix framework, which makes use of .html.heex templates.

I wanted to compile a binary which contains a whole Go web app and is deployed as a Lambda function to AWS.

Bootstraping Terraform and putting the state on S3 has a chicken-egg problem: How to manage the S3 bucket which holds the state file without it already existing?

I wrote a tool to log events and monitor (cron) jobs in your private tailscale network.

I am a huge fan of simplicity.

In the last weeks I hacked together a tool to help me organize my (temporary) target and infrastructure data I gather during audits.

After using ploi to deploy a Laravel app in the past I really enjoyed the simplicity of just using a git push to deploy my application to staging/production.

Summary: Under some conditions, it is possible to smuggle HTTP headers through a reverse proxy, even if it was explicitly unset before.

Some time ago I found a blind SQL injection on a bug bounty target.

There is a simple trick Seb and me used in a few CTFs which it seems some CTFS players are not aware of – at least that’s what it looks like when looking at writeups.

For a side project I am currently working on I was in the need of some interactive (JavaScript) widget.

This is the first crypto challenge I solved which was really interesting to work on.

After I spent some time looking for a traveling notebook, I finally made a choice and bought an Acer Chromebook 14.

Joe, your intelligent conversation partner For the Joe challenge, you got access to a simple page which looked like a chat.

The only accessible page for Share Point was a login form.

This was not a typical web challenge, apart from beeing accessible over the web.

Exploitation was straight forward by abusing a format string vulnerability to overwrite .got.

Some days ago I started reading into Return Oriented Programming and had a lot of fun doing some VMs and exercises I found over the internet.

After the proof of concept code for CVE-2016-5195 (DirtyCow) was released, the game was on to ‘weaponize’ this PoC to a full local root privilege escalation.

webanalyze is a (Go) port of wappalyzer, a browser extension to display technologies used on websites.

It’s been a long time I’m working on this and I’m happy to announce my new project: pentrack.io.

While setting up a remote backup storage I did a fatal mistake.

Firebase, the scalable real-time backend Developing client-only applications with JavaScript and services like Firebase offer a nice way to “build apps without managing servers”.

DPscan.py to DrupalScan Recently I was in the need of a simple “drupal security scanner” which enumerates all modules of a drupal project so I can do a source code audit on them.

Some days ago during a pentest I found a critical sql injection vulnerability which gave me access to the user database.

Some months ago (16th of Sep.)

Some weeks ago I wrote a little tool to support me when analysing webpages.

The idea I recently found a security issue in myBloggie.

Information Software: myBloggie 2.1.6 Severity: High Author: Robin Verton Date: Jun. 12 2011 Vendor: http://mybloggie.mywebland.com/ Software Description “myBloggie is considered one of the most simple, user-friendliest yet packed with features Weblog sys…