Blog
Alle Einträge von modzero.
-
PLAYGROUND
ROPing our way to RCE
7. Februar 2025
From vulnerability to exploit - this post explores the journey of developing an ARM ROP chain to exploit a buffer overflow in uc-http. Dive into the process of reverse engineering, gadget hunting, and crafting a working exploit.
-
PLAYGROUND
Exploiting SSTI in a Modern Spring Boot Application (3.3.4)
8. Januar 2025
Learn how to exploit Server-Side Template Injection (SSTI) in a Spring Boot application using the Thymeleaf templating engine. Special focus will be set on bypassing defenses in newer versions.
-
PLAYGROUND
Tutorial: How we learned to love the doc(umentation)
14. Oktober 2024
Just read documentation to get RCE?! Our colleague Theresa designed a tutorial guiding you through an OpenVPN exploit scenario — for you to try at home!
-
DISCLOSURE
Beyond the @ Symbol: Exploiting the Flexibility of Email Addresses For Offensive Purposes
7. Juni 2024
We exploited an unauthenticated command injection within the spam filter appliance MailCleaner that can be triggered through a malicious email address.
-
DISCLOSURE
Multiple Vulnerabilities in Poly VoIP Products
29. Dezember 2023
We uncovered several vulnerabilities allowing an attacker in the network to take over a Poly VoIP device and turn it into a bug hidden in plain sight.
-
COMPANY
12th Anniversary
29. April 2023
Today we celebrate our 12th anniversary.
1 von 3
Vor ⟶
Alle Einträge von modzero.
-
PLAYGROUND
ROPing our way to RCE
7. Februar 2025
From vulnerability to exploit - this post explores the journey of developing an ARM ROP chain to exploit a buffer overflow in uc-http. Dive into the process of reverse engineering, gadget hunting, and crafting a working exploit.
-
PLAYGROUND
Exploiting SSTI in a Modern Spring Boot Application (3.3.4)
8. Januar 2025
Learn how to exploit Server-Side Template Injection (SSTI) in a Spring Boot application using the Thymeleaf templating engine. Special focus will be set on bypassing defenses in newer versions.
-
PLAYGROUND
Tutorial: How we learned to love the doc(umentation)
14. Oktober 2024
Just read documentation to get RCE?! Our colleague Theresa designed a tutorial guiding you through an OpenVPN exploit scenario — for you to try at home!
-
DISCLOSURE
Beyond the @ Symbol: Exploiting the Flexibility of Email Addresses For Offensive Purposes
7. Juni 2024
We exploited an unauthenticated command injection within the spam filter appliance MailCleaner that can be triggered through a malicious email address.
-
DISCLOSURE
Multiple Vulnerabilities in Poly VoIP Products
29. Dezember 2023
We uncovered several vulnerabilities allowing an attacker in the network to take over a Poly VoIP device and turn it into a bug hidden in plain sight.
-
COMPANY
12th Anniversary
29. April 2023
Today we celebrate our 12th anniversary.