Category Archives: Misc.

Chaining Multiple Vulnerabilities to Gain Admin Access

In April of this year I participated in a private program on HackerOne that was vulnerable to a series of IDOR that led to a complete takeover of an application. Unfortunately because this is a private program, I cannot disclose the name or company related information per their request. However I wanted to share the details on how I escalated my basic privileges from a regular “customer” account to an admin user. Continue reading

Exploiting ImageMagick to get RCE on Polyvore (Yahoo Acquisition)

On 5/5/2016 ImageMagick was assigned CVE-2016-3714 “ImageMagick Delegate Arbitrary Command Execution”. Now let’s dig to this vulnerability and how to exploit this.  Having ImageMagick locally installed is advised in order to validate the POC (but not required). For this particular report, I created a file named  exploit.png with the following in the “source code” to get the target’s `id`:

 Continue reading 

Yahoo Image Processing SSRF/XSPA

In this blog post I will be showing a few recent vulnerabilities reported and patched by the Yahoo Security Team. In July of 2014 I was able to identify a SSRF vulnerability affecting all of Yahoo’s services that required an image processing (such as flickr and Yahoo groups). This vulnerability was patched a few weeks ago (June 2015). Now let’s get to the good stuff:

Continue reading

Bug Bounty 101

Recently I was given the opportunity to speak at NBTCon (No Big Thing Con) held at the Sales Force office in San Francisco. In my talk I explained the basics of bug bounties, some ways to maximize your revenue, and also talked about how to make a productive report. Here’s a summary of the talk (with a little bit of extra info/details) and links to the slides: Continue reading