@psytester1
Account based inGermany
About this account
- Account based in
- Germany
- Connected via
- Germany Android App
Account-level information from X, not a live location or the device used for a specific post.
testing》ethical hacking》vulnerability》cve 🧱 don't ask me for malicious actions https://nitter.cf/t.co/GRCRjgwQjd
Joined April 2020
- Tweets228
- Following7
- Followers106
- Likes14
Keycloak CVE-2026-79651 is easy to exploit.
The PoC took ~2 hours.
150 parallel requests to all known {realms} and iterate {locale} like zz-x-{loopcounter} on endpoint
/resources/{realm}/admin/{locale}
The message bundle for 'admin' has the highest impact with response of > 360kb
Shift right with right shit by shit left.
🤭
Happens if a project tries to move security responsibility to the end, from left to right and is no DevSec anymore.
But only one character in the word "shift" was lost.🤣
New week, new supply chain fun.
A package.json with entries for version pinning, e.g.
"axios": "^1.5.1"
vs.
"axios": "~1.5.1"
vs.
"axios": "1.5.1"
and `npm install` vs `npm ci` vs. `yarn add` but without yarn.lock
Can you see the problem?
A lot of projects had "fun" today.
I didn't have the time I needed; there were too many real problems to solve, but now the write-up for Intigriti's November 2025 challenge is online.
psytester.github.io/Intigrit…
Finally my PoC is out for Spring Cloud Gateway dynamic HTTP POST configuration abused as a SSRF service.
psytester.github.io/noCVE-Sp…
Finally my PoC is out for CVE-2025-41253 Using Spring Expression Language To Expose Environment Variables and System Properties
psytester.github.io/CVE-2025…
My PoC is out there, or what it is supposed to represent if CVSS scrore 10.0 on CVE-2025-41243: Spring Expression Language property modification using Spring Cloud Gateway Server WebFlux
At least property modification within its route context is possible
psytester.github.io/CVE-2025…
Lessons learned 😊
If users encounter a class global variable as a singleton when logging in...
In a race condition this gonna grills the session management.
Which SAST would identify this vulnerability while coding?
Linux bash script creates variable by
VAR=`eval echo ${USERINPUT}`
where user controlled input is used
What will happen? 😍
Does it make sense to publish a CVE ID already requested in 2021 or 2022 for a vulnerability fixed in 2025?
Yes it took that time....
and in meantime it's duplicated by vendor with own CVE-2024-...
1/n 🧵
Hi Splunk #Admins out there, if you setup an #onpremise Splunk enterprise server, do you already know that additional #hardening is required?
Especially that you have to create your own `inputs.conf` file with blacklist entries for local files or directories, ...
4/n 🧵
Do you know about required hardening with `inputs.conf` (docs.splunk.com/Documentatio…)?
Have your Splunk users with admin/system roles #SSH access to the OS too, to modify files locally?
Information disclosure or Splunk feature(?) to fingerprint OS patch level
psytester.github.io/SPLUNK_f…
I published a found Remote Code Execution in Entersekt Transakt secure gateway
psytester.github.io/Entersek…
I read "The MV3 Escape Artists" from @getsquarex about chrome extensions and thought "SquareX"? There was something!
yes "DoubleX"! Is square the double of the double?🤭
No, I saw @AuroreFass talk at RuhrSec22 with her paper & slides aurore54f.github.io/publicat…
The circle closes.