Topic
5 posts
I went looking for something clever in the ASUS Router Android app and instead found a service sitting wide open with a sign on it. Here is the whole story: the manifest, the Parcelable, the six payloads, and the wait for a fix.
Two penetration tests, two APIs that never checked. One handed HIPAA-protected medical records to the open internet. The other let anyone pull live card data from an app the bank swore was still in development. Same bug, two costumes.
I typed a single quote into a log search box on an internal pentest and DeliverNow told me everything. Here is the whole story: the confession in the error message, the xp_dirtree callback, the sa account, and the CVE that came out of it.
SonicWall's SSO Agent runs as Domain Admin and authenticates to any workstation it is told about, without ever checking who that is. One curl command through the firewall, one Domain Admin hash. Here is the whole story.
An internet-facing page where parents look up their child's school bus turned out to take SQL. Here is how one unauthenticated form field became a foothold, a service account, and eventually an entire Active Directory forest.
