Writeups

The Blog

Technique, methodology, and research notes from authorized offensive engagements.

/
Showing 12 of 12 writeups
Open WebUI SSRF - Redirect-Based Validation Bypass (CVE-2026-45401)
Vulnerability ResearchAug 01, 2026·5 min read

Open WebUI SSRF - Redirect-Based Validation Bypass (CVE-2026-45401)

SSRF in Open WebUI's web fetch: validate_url checks the original hostname but the loader follows redirects, letting any authenticated user reach in...

#SSRF#Open WebUI#Redirect Bypass#CWE-918#Cloud Metadata#Python
Read writeup →
Open WebUI - Unauthenticated RAG Configuration Disclosure (CVE-2026-45397)
Vulnerability ResearchMay 10, 2026·5 min read

Open WebUI - Unauthenticated RAG Configuration Disclosure (CVE-2026-45397)

A single unauthenticated GET to /api/v1/retrieval/ leaks Open WebUI's full RAG pipeline config — chunk sizes, templates, embedding and reranking mo...

#Open WebUI#Information Disclosure#CWE-306#RAG#FastAPI#Python#CVE-2026-45397#Nuclei
Read writeup →
CTF - Time is but a Window
Binary ExploitationJan 15, 2024·6 min read

CTF - Time is but a Window

Writeup of the Time is but a Window binary exploitation CTF challenge

#Pwn#Checksec#1-byte BufferOverflow#Ret2win#Ghidra#Not Stripped#Python#Dynamically Linked#Disassemble
Read writeup →
CTF - A Guilded Lily
Binary ExploitationJan 13, 2024·15 min read

CTF - A Guilded Lily

Writeup of the A Guilded Lily binary exploitation CTF challenge

#Pwn#Checksec#Write()#Ret2syscall#Ghidra#Scanf()#Not Stripped#Statically Linked#Python#Disassemble
Read writeup →
CTF - My Friend, A Loathsome Worm
Binary ExploitationJan 01, 2024·8 min read

CTF - My Friend, A Loathsome Worm

Writeup of the My Friend, A Loathsome Worm binary exploitation CTF challenge

#Pwn#Checksec#Ghidra#Not Stripped#Scanf()#Python#Disassemble#Dynamically Linked
Read writeup →
HTB - Sau
HTB MachinesDec 31, 2023·6 min read

HTB - Sau

Walkthrough of the Sau machine from Hack The Box

#Nmap#SSRF#Request Baskets#CVE-2023-27163#Maltrail#Sudoers#Systemctl#GTFOBins#Less
Read writeup →
HTB - Space Pirate: Going Deeper
Binary ExploitationDec 22, 2023·14 min read

HTB - Space Pirate: Going Deeper

Walkthrough of the Space Pirate: Going Deeper binary exploitation challenge from Hack The Box

#Pwn#1-byte BOF#NX#RELRO#Ghidra#GDB-Peda#Non-Stripped#Strcmp
Read writeup →
HTB - Cybermonday
HTB MachinesDec 05, 2023·34 min read

HTB - Cybermonday

Walkthrough of the Cybermonday machine from Hack The Box

#Nmap#php#laravel#off-by-slash#Nginx#gitdumper#source-code#mass-assignment#jwt#jwks#jwt-tool#jwt-algorithm-confusion#SSRF#redis#Deserialization#phpggc#docker#pivot#chisel#docker-registry#snyk#directory-traversal#docker-compose#docker-apparmor
Read writeup →
HTB - Pilgrimage
HTB MachinesNov 25, 2023·11 min read

HTB - Pilgrimage

Walkthrough of the Pilgrimage machine from Hack The Box

#Nmap#Binwalk#Magick#.git#LFI#gitdumper#sqlite#CVE-2022-44268#CVE-2022-4510
Read writeup →
HTB - Broker
HTB MachinesNov 09, 2023·6 min read

HTB - Broker

Walkthrough of the Broker machine from Hack The Box

#Nmap#ActiveMQ#CVE-2023-46604#Sudoers#Basic-Auth#Deserialization#Nginx
Read writeup →
HTB - Topology
HTB MachinesNov 04, 2023·10 min read

HTB - Topology

Walkthrough of the Topology machine from Hack The Box

#Nmap#LaTeX#Gnuplot#ffuf#htpasswd#Vhost#SetUID#Pspy
Read writeup →
Oracle Content Management (CMS) - One Click Account Takeover
Vulnerability ResearchAug 20, 2023·7 min read

Oracle Content Management (CMS) - One Click Account Takeover

A CORS misconfiguration in Oracle Content Management leads to massive CSRF which can turn into one-click account takeover

#CORS#Oracle#Oracle Cloud#Content Management#Regex#Account Takeover#CWE-942#CWE-346#Nuclei
Read writeup →