Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

The minefield between syntaxes: exploiting syntax confusions in the wild

yeswehack.com | blog | #bug-bounty | #arbitrary-file-read | #research | #ssrf | #parsing | #syntax-confusion

Summary

Hunter Alex Brumen (Brumens) on syntax confusion and ambiguous parsing exploits, including turning a limited SSRF and blind file read into complete arbitrary file access, plus mitigation advice.
Published
Collected

original ↗

Related coverage

  1. ‘I usually choose targets that offer value to society’: krevetk0 on his principled approach to Bug Bounty hunting (yeswehack.com)
  2. YesWeHack joins G-Cloud framework for UK public-sector procurement after clearing rigorous evaluation (yeswehack.com)
  3. How to use Codex for Bug Bounty research: explore broadly, validate rigorously (yeswehack.com)
  4. ‘Having humans in the loop’: Crédit Agricole Personal Finance & Mobility on the value of Bug Bounty (yeswehack.com)
  5. World Poker Tour and the Curry-Shah collab, in-flight exploits, does maths maketh the hunter? – ethical hacker news roundup (yeswehack.com)
  6. Beyond ‘../../’ - a practical guide to path traversal and arbitrary file read attacks (yeswehack.com)

back