back
user profile
pentestercrab
2,279karma·284submissions·August 11, 2015
recent activity (284 total)
comment
Extra context can be found in tweets by @_markel___[1]. [1] https://twitter.com/_markel___/status/1262697756805795841 …
comment
On the topic of case and unicode, it's also important to remember that, somewhat surprisingly, the number of characters can change when a change in case occurs: $ irb
>> puts RUBY_VER…
2 pts
comment
A great video on exploiting .NET deserialization was presented at Insomni'hack 2018 and can be found on YouTube[1]. [1] https://www.youtube.com/watch?v=eDfGpu3iE4Q …
2 pts
comment
The same gadget chain can alsobe used to exploit YAML.load [0] with the following: --- !ruby/object:Gem::Requirement
requirements:
!ruby/object:Gem::DependencyList
spec…
comment
This brought back memories of CAP theorem[1] and Zooko's triangle[2], but this time with flavors. [1] https://en.wikipedia.org/wiki/CAP_theorem [2] https://en.wik…
comment
Follow up thread here[0] that discussed how Facebook's "Advanced Matching for Web" works. [0] https://twitter.com/thezedwards/status/1204965655482527744 …
comment
More information on desynchronization attacks that can allow request smuggling can be found on the Portswigger blog[0]. [0] https://portswigger.net/research/http-desync-attacks-re…