Flomb Blog

In HTTP/1, the CONNECT method instructs a proxy to establish a TCP tunnel to a requested target.

Wiz recently discovered an unauthenticated remote code execution (RCE) vulnerability in the Ingress NGINX admission controller.

This is the story of how I found two vulnerabilities in the Tekton CI/CD Dashboard component that allow remote code execution and a potential node takeover if deployed in read/write mode as well as pre-authenticated access to the Kubernetes API server in…

I recently stumbled upon a great writeup which explained how it is possible to get a SSRF from SNI to hit the Azure VM Instance Metadata Service(IMDS).

The following write-ups detail a privilege escalation vulnerability in Databricks that I discovered during my time at a previous employer.

Simple, mostly security oriented, personal blog.