PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

The Campaign Is Not Available in Your Country: XBOW Discovered an SQLi While Attempting to Bypass Geolocation Restrictions.

xbow.com | research | #bug-bounty | #cloud | #rce | #vulnerability-research | #sql-injection | #web-security | #cookies | #geolocation-restrictions
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Narrates XBOW's dogged SQL injection hunt after geolocation blocks: header and user-agent spoofing failed, but a cookie pivot into a /non_participating/ endpoint broke through.
Published
Collected

Related coverage

research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
research · slcyber.io
More Critical Bugs in Adobe Experience Manager: Pre-Auth RCE
Chaining an unauthenticated bulk import, an in-band XXE, leaked IMS credentials and Groovy execution into full pre-auth RCE on Adobe Experience Manager Cloud.
vulnerability · vercel.com
Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers
How Vercel and Hacktron coordinated a fix for a remote code execution vulnerability that reached Next.js image optimization through sharp, libvips, and libheif.
vulnerability · vercel.com
The Vercel OSS Bug Bounty program is now available
Vercel is opening its open source software bug bounty program to the public for researchers find vulnerabilities and make OSS safer
vulnerability · vercel.com
Our $1 million hacker challenge for React2Shell
We paid $1M to security researchers to break our WAF. Here's what we learned defending against React2Shell.
research · projectdiscovery.io
PHP2Shell: finding and patching affected PHP
Two CVSS 9.2 bugs in the PHP runtime allow unauthenticated code execution; the patch is a package upgrade and a restart, and this guide shows how to find every PHP runtime you need to patch.
Back