/dev/posts/

Remote code execution via cross site request forgery in InternetCube and YunoHost

Published:

How I found remote code execution vulnerabilities via Cross Site Request Forgery (CSRF) on the administration interfaces of InternetCube applications and of the YunoHost administration interface which could have been used to execute arbitrary code as root. These vulnerabilities were fixed in YunoHost 3.3, OpenVPN Client app 1.3.0. and YunoHost 3.4.

Read more…

My document generation workflow with Markdown, YAML, Jinja2 and WeasyPrint

Published:

Here is the workflow I am using to generate simple text documents (resume, cover letters, etc.) from Markdown, YAML and Jinja2 templates.

Read more…

IP address spoofing in order to watch South Park

Published:

Trying to bring back some old IP spoofing Firefox extension for watching South Park episodes.

Read more…

More example of argument and shell command injections in browser invocation

Published:

In the previous episode, I talked about some argument and shell command injections vulnerabilities through URIs passed to browsers. Here I am evaluating some other CVEs which were registered at the same time (not by me).

Read more…

Argument and shell command injections in browser invocation

Published:

I found an argument injection vulnerability related to the handling of the BROWSER environment variable in sensible-browser. This lead me (and others) to a few other arguments and shell command injection vulnerabilities in BROWSER processing and browser invocation in general.

Read more…

Sibling tail call optimization in Python

Published:

In Tail Recursion In Python, Chris Penner implements (self) tail-call optimization (TCO) in Python using a function decorator. Here I am extending the approach for sibling calls.

Read more…

Foo over SSH

Using SSH as a transport for your protocol

Published:

A comparison of the different solutions for using SSH2 as a secured transport for protocols/services/applications.

Read more…

Terminal read-only live sharing

Published:

Live sharing a terminal session to another (shared) host over SSH in read-only mode.

Read more…

OpenSSH ProxyUseFdPass

Published:

While looking at the OpenSSH ssh_config manpage, I found the ProxyUseFdpass configuration I did not know about. It is apparently not widely known or used.

Read more…

C++ synchronisations for SimGrid

Published:

This is an overview of some recent additions to the SimGrid code related to actor synchronisation. It might be interesting for people using SimGrid, working on SimGrid or for people interested in generic C++ code for synchronisation or asynchronicity.

Read more…

Page 7 of 11 | | | JSON Feed | Atom Feed