Dockerfile for creating a git repository to serve CVE-2018-11235
It has been a while since the Git vulnerability was announced. The major public repository providers have long since been preventing hosting repositories serving CVE-2018-11235. ...
Posts
Getting root on a Kubernetes node with gitRepo and CVE-2018-11235
Shortly after the recent Git vulnerability was announced, a security advisory for Kubernetes was published. ...
CVE-2018-11235 git RCE
Remote code execution through malicious submodules.
CVE-2017-17405 RCE in Ruby's FTP lib
The FTP library in Ruby did not validate remote filenames and blindly passed these to the kernel.open function. This created a remotely exploitable vulnerability. Since the filenames were supplied by the remote FTP server, it was possible to create a malicious server that could exploit this vulnerability when a vulnerable Ruby client connected and tried to download a file. ...
Quick win with GraphQL
GraphQL provides a powerful query language for APIs and we can abuse some built in features to map out the attack surface.