Blog

All blog posts from modzero.

PLAYGROUND

ROPing our way to RCE

February 7, 2025

From vulnerability to exploit - this post explores the journey of developing an ARM ROP chain to exploit a buffer overflow in uc-http. Dive into the process of reverse engineering, gadget hunting, and crafting a working exploit.
PLAYGROUND

Exploiting SSTI in a Modern Spring Boot Application (3.3.4)

January 8, 2025

Learn how to exploit Server-Side Template Injection (SSTI) in a Spring Boot application using the Thymeleaf templating engine. Special focus will be set on bypassing defenses in newer versions.
PLAYGROUND

Tutorial: How we learned to love the doc(umentation)

October 14, 2024

Just read documentation to get RCE?! Our colleague Theresa designed a tutorial guiding you through an OpenVPN exploit scenario — for you to try at home!
DISCLOSURE

Beyond the @ Symbol: Exploiting the Flexibility of Email Addresses For Offensive Purposes

June 7, 2024

We exploited an unauthenticated command injection within the spam filter appliance MailCleaner that can be triggered through a malicious email address.
DISCLOSURE

Multiple Vulnerabilities in Poly VoIP Products

December 29, 2023

We uncovered several vulnerabilities allowing an attacker in the network to take over a Poly VoIP device and turn it into a bug hidden in plain sight.
COMPANY

12th Anniversary

April 29, 2023

Today we celebrate our 12th anniversary.

1 of 3 Next ⟶