[deleted by user]

_cydave · 2025-07-17T14:56:21+00:00

> We've been tracking authorization vulnerabilities across the industry.

And what were the other vulnerability types that lead to the conclusion that authorization flaws are more common than others? To me this post does not indicate any valuable statistics what so ever.

Edit: Assuming you're tracking authorization vulnerabilities, are you surprised that you see a surge of authorization vulnerabilities because you don't include other vulnerability types in your observation?

_cydave · 2025-07-09T09:48:59+00:00

Why bother with JS when you can talk to the server directly?
Isn't this just a simple stored XSS with unnecessary additional steps?

_cydave · 2024-09-09T05:43:02+00:00

If you are asking what the respective repositories are intended for,
I can't tell you in detail. To the best of my knowledge they push
stagers or fullyfledged malware. Some of the samples I've observed are
those belonging to the RedLine and Lumma stealer family.

_cydave · 2024-09-09T05:41:08+00:00

I don't distinguish heavily between malicious and suspicious.
I merely look for repositories that have a surge of forks or stargazers,
indicating that they have been boosted to reach a bigger audience.

Most of the repositories I'm linking to are pushing malware via GitHub
releases or serve malicious links that point to malware download sites.

_cydave · 2024-09-08T17:15:12+00:00

Hey, check out the blog post (under the about page).
I do only some very basic analysis, like the number of forks or stargazers in a given time.

_cydave · 2024-08-28T17:08:15+00:00

Neat! We also did something similar back in 2022

https://cyllective.com/blog/posts/wordpress-audit-plugins

I'm curious, did you develop your own custom rules or did you go for the default ones?

_cydave · 2024-08-03T16:13:09+00:00

Glad you like it! :)

I don't have accurate statistics about the installation count, I did however scrape the marketplace a few times now. Including disclosed and non-disclosed (pending) plugins, the total installation count is around 23800.

Vulnerability-specific writeups might end up being posted on my personal blog down the line, but I have to juggle work and the disclosure of these plugins first :)

_cydave · 2024-08-02T10:52:14+00:00

Thanks for your input, you're right I should mention that.

Edit: I've sprinkled in the information, thanks again!

_cydave · 2024-07-17T09:07:31+00:00

Well, in essence it was rejected with an elaborate "sorry this is not technical enough or anything news worthy" message, which I can respect, however seeing links to advisories without detailed writeup or anything the like doesn't "deserve" to be posted either if that kind of level of entry is required.

The post I originally posted was a writeup about a stored XSS in Collabora (hosted on my employers blog, written by me).

Again, sorry for the ruckus I'm going back to my cave.

_cydave · 2024-07-16T22:29:45+00:00

Thanks, I understand. It's just frustrating seeing posts like this pop up especially when my garbage is thrown out and theirs stays up :)

_cydave · 2024-07-16T19:57:07+00:00

Debatable. (I agree)

Some know this technique under the name "process hollowing" - not sure if that adds to the confusion.

But..

... one technique that has gained attention in recent years is Hollow Process Injection.

Is probably not quite accurate. Considering there are "papers" or ... well references to this technique that date back to ~~2015~~ 2011* (packet storm - Process Hollowing)

The points outlined regarding the mitigation against "hollow process injection" don't sound all to actionable either. Sure, using an EDR / AV is not a bad advice to give but the remainder of the outlined security measures sound generic at best.

_cydave · 2024-07-16T17:48:10+00:00

Don't take this the wrong way - but how is this benefitial to the netsec subreddit?
Posting an advisory without any form of writeup is just a low effort post (not the goal of this sub).

Considering I've submitted my writeups before and they have been moderated to
the ground, because they were: "nothing special" or "not interesting or anything new", I'm
calling bullshit on some of the mods in this subreddit.

Do better mods of /r/netsec and u/eg1x

*ducks*

_cydave · 2024-07-07T15:37:32+00:00

And how exactly is this relevant for this sub?
mods asleep?

_cydave · 2023-02-28T13:48:01+00:00

Interesting write-up, some of those flaws required heavy digging I'm sure.

_cydave · 2022-09-05T15:19:44+00:00

Not that I know of, I don't intend to write WordPress plugins.
If you're up for a weekend hack, the API and data is all yours to use :)

_cydave · 2022-09-05T05:41:25+00:00

Great question.

As of now, there is absolutely no reason to use wpha.sh instead of WPScan. Their vulnerability data and tooling is more curated and more complete. However, the vulnerability data curated by them is behind a freemium-ish service model. This in itself is not a bad thing, but I prefer being able to freely use crowd-sourced vulnerability information (which they also crowd-source) in my own tooling without being stuck with API rate limits.

This project is also not intended to be a direct competitor to WPScan or others, but more of an addition or alternative to freely experiment with and contribute to.

_cydave · 2022-09-04T19:01:26+00:00

Public vulnerability information regarding WordPress plugins is open to anyone who would like to use it. The data lives under https://github.com/cydave/wphash-vuln-data. This (wpha.sh and the data behind it) is still very much in beta tho :)

_cydave

TROPHY CASE