PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Why 2FA would not have saved HT?

blog.quarkslab.com | research | #sql-injection | #authentication | #python | #vulnerability | #2fa | #yubikey
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A trivial SQL injection in yubico-yubiserve, a Python YubiKey OTP server: an unfiltered publicID parameter in the OATH path lets attackers run SQL; the flaw is in the server, not the hardware.
Published
Collected

Related coverage

vulnerability · about.gitlab.com
Pillow CVE-2026-112900: How to find and fix it with GitLab
Upgrade to Pillow 13.0.0, then use dependency scanning, code search, and GitLab Duo Agent Platform to patch every affected Python project in your groups.
blog · netspi.com
Why TOTP Won’t Cut It (And What to Consider Instead)
NetSPI examines why TOTP codes no longer stop determined attackers, walking through a brute force scenario and recommending stronger 2FA alternatives to replace time-based one-time passwords.
blog · netspi.com
Targeting RSA Emergency Access Tokencodes for Fun and Profit
Shows how an attacker with domain credentials can request an RSA Emergency Access Tokencode from the self-service console and brute force the numeric PIN, turning recovery features into a 2FA bypass.
research · blog.quarkslab.com
Paramiko Security Audit
Quarkslab's security audit of Paramiko for OSTIF covered the pure-Python SSHv2 library, its cryptography dependencies and rust-openssl bindings, entropy sources, constant-time code, testing and CI/CD.
research · blog.quarkslab.com
Introducing TritonDSE: A framework for dynamic symbolic execution in Python
Introducing TritonDSE, a Python library atop Triton for customizable dynamic symbolic execution: high-level program exploration primitives, hooks, and the base of PASTIS's white-box fuzzer.
research · blog.quarkslab.com
Arybo: cleaning obfuscation by playing with mixed boolean and arithmetic operations
Introducing Arybo, a Python module wrapping a native library for understanding, creating and simplifying Mixed Boolean-Arithmetic expressions, aiding de-obfuscation of protected code.
Back