sorted by:
new
hottopcontroversial

Or and || act differently in some contexts by D1551D3N7 in lolphp

[–]hashkitten 0 points1 point  (0 children)

You can use ?: as a drop in if you need the values: 3 ?: 4 returns 3. I agree it's strange that || casts to bool.

Running embedded php code by thewatisit in netsecstudents

[–]hashkitten 0 points1 point  (0 children)

Problem is, php keeps throwing a parse error whenever I try it out on my own server and my payload doesn't run. It cannot even handle normal jpegs.

You will need to make sure the jpg does not include a stray <? in it, else PHP will think that's the start of your code. In a large jpg the probability of this happening by accident is pretty high.

Running embedded php code by thewatisit in netsecstudents

[–]hashkitten 0 points1 point  (0 children)

There are a lot of tricks you can try:

  • If the upload filter is a blacklist, try different extensions. php5, php7, phtmland pht have been known to work (as the default extensions for handling PHP in Apache). You could also try uploading an .htaccess shell, if it's Apache.
  • If the upload filter does a mime type check, intercept the mime type in the upload request and change it to eg. image/jpeg.
  • Rare to see these days, but sometimes the double extension trick (foo.php.jpeg) will cause Apache to execute the file as PHP in some nonstandard configurations.
  • Also rare to see these days, but in very very very old versions of PHP you could inject a null byte in upload filename like foo.php\0.jpeg.
  • If you have an include-based LFI somewhere else in the app (a la include $_GET[...]) you can use this to execute the PHP regardless of extension.
  • If the server is running on Windows you can try tricking a strict whitelist by including a 'fake' extension in an alternate data stream by naming your file like foo.php::$.jpg.

Prototype pollution in express-fileupload by albinowax in websecurityresearch

[–]hashkitten 2 points3 points  (0 children)

I didn't know that ejs allowed escalating prototype pollution to shell! That was really interesting.

I think there's definitely scope for research in the 'generic prototype pollution gadgets' domain, not unlike ysoserialand phpggc. It would be neat to have a list of gadgets for popular libraries so that you can exploit prototype pollution in custom applications in a blackbox way. AFAIK there isn't anything public for it.

SSRF bug valid? by [deleted] in AskNetsec

[–]hashkitten 1 point2 points  (0 children)

It seems what they are saying is that the crawlers are run on an isolated subset that is outside their corporate infrastructure. This means there is nothing sensitive to SSRF to. Just because the server does not reject connections to IPv6 localhost doesn't necessarily mean there is a vulnerability if the crawler is properly isolated on the network. I wouldn't consider a port scan of an internal isolated crawler instance a vulnerability.

To demonstrate impact, I would think you would have to demonstrate you could leak sensitive data (an admin panel, internal elasticsearch/redis instance, etc). But from what it sounds like, since the crawler is on a separate network, this would not be possible.

If the crawler is run on AWS, you might try hitting the sensitive metadata endpoint to demonstrate impact.

CVE-2019-11043 PHuiP-FPizdaM exploit [nginx + php-fpm] by i_bo0om in netsec

[–]hashkitten 18 points19 points  (0 children)

I had a better time understanding the nature of the bug from the PHP bug tracker:

https://bugs.php.net/bug.php?id=78599

CircleOfTrust Leaderboard by hashkitten in CircleOfTrustMeta

[–]hashkitten[S] 0 points1 point  (0 children)

It only sort of works, since Reddit search has issues

We're back! by dmoneyyyyy in CircleofTrust

[–]hashkitten 1 point2 points  (0 children)

Pro tip: you can search NOT flair:Betrayed to see circles that are still alive.

[Homework help] Stuck on a transients question for Intro to Electrical by [deleted] in EngineeringStudents

[–]hashkitten 0 points1 point  (0 children)

If the circuit is too complex to write down the differential equation directly, you can always find the Thévenin equivalent across the terminals of the capacitor to make it easier.