PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

When too much access is not enough: a story about Confluence and tokens

blog.quarkslab.com | research | #cloud | #aws | #red-team | #post-exploitation | #database | #api-tokens | #confluence
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Quarkslab red team story: after compromising a Confluence host and its database but lacking app credentials, they study the Confluence database structure and API token generation mechanism.
Published
Collected

Related coverage

research · blog.quarkslab.com
BYOVD to the next level (part 2) — rootkit like it's 2025
Part two of Quarkslab's BYOVD series: using read/write primitives from a vulnerable driver to reflectively load an unsigned driver from memory and bypass Windows Driver Signature Enforcement.
research · blog.quarkslab.com
Post-Exploitation: Abusing the KeePass Plugin Cache
A post-exploitation technique that injects code into KeePass without process injection, by abusing the cache produced when PLGX plugins are compiled.
research · blog.quarkslab.com
MongoDB vs. Elasticsearch: The Quest of the Holy Performances
A practical MongoDB vs. Elasticsearch comparison for Ivy, Quarkslab's large-scale network reconnaissance tool: storing and mining unstructured data on ordinary hardware, and the trade-offs involved.
research · projectblack.io
Nessus Reporting Customisation & Analysis
A tool that exports Nessus scan results into a relational database via the API for cross-scan queries, trending, custom reports, and alerting — with schema, stored procedures, and sample reports.
research · bugcrowd.com
Why We’re Letting 60,000 Bugcrowd Security Researchers Ethically Hack Us
Atlassian launches its first public bug bounty on Bugcrowd, adding JIRA and Confluence Cloud to existing Trello and StatusPage programs, with Bugcrowd triaging submissions across 14+ product lines.
research · github.com
php2shell: Pure HTTP Full-Chain RCE and ASLR Bypass on Stock PHP 8.4 Configurations
Overcomes historical constraints where PHP heap exploitation required display_errors=On, restricted memory limits, or target application vulnerabilities, demonstrating reliable pure-HTTP RCE and ASLR defeat against standard production ini configurations.
Back