PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Beyond Electron: Attacking Alternative Desktop Application Frameworks

bishopfox.com | research | #rce | #appsec | #xss | #electron | #tauri | #desktop-security
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Tauri research: real-world apps chained XSS with permissive settings, such as broad filesystem access and app-launch capabilities, into RCE; Electron alternatives change mechanics, not risk.
Published
Collected

Related coverage

blog · yeswehack.com
Pentesting Electron Applications
A guide to penetration testing Electron apps: understanding the Chromium-plus-Node architecture, unpacking and repacking .asar archives, extracting secrets, and scanning with Electronegativity.
research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
research · github.com
php2shell: Pure HTTP Full-Chain RCE and ASLR Bypass on Stock PHP 8.4 Configurations
Overcomes historical constraints where PHP heap exploitation required display_errors=On, restricted memory limits, or target application vulnerabilities, demonstrating reliable pure-HTTP RCE and ASLR defeat against standard production ini configurations.
research · crowdstrike.com
CrowdStrike Protects Customers from Threats Delivered via PHP2Shell
The Falcon platform provides out-of-the-box visibility and detection coverage for post-exploitation activities of CVE-2026-109618 and CVE-2026-109619.
research · yokai.hakaisecurity.io
Client-Side Path Traversal na Prática: De Stored XSS à Exclusão de Conta
# Client-Side Path Traversal na Prática: De Stored XSS à Exclusão de Conta RESEARCHER **Pedro Cruz "gankd"** READ TIME**12 MINUTES** PUBLISHED**15 Oct 2026** INDEX ▸ Sumário ▸ Introdução ▸...
research · yokai.hakaisecurity.io
Client-Side Path Traversal in the Wild: From Stored XSS to Account Deletion
# Client-Side Path Traversal in the Wild: From Stored XSS to Account Deletion RESEARCHER **Pedro Cruz "gankd"** READ TIME**11 MINUTES** PUBLISHED**15 Oct 2026** INDEX ▸ Table of contents ▸...
Back