Some notes on how transformer-decoder language models work, taking GPT-2 as an example, and with lots references in order to dig deeper. This is intended both as a a roadmap for understanding on how LLMs work (especially the ones using a transformer-decoder architecture) and a a summary/recap on the topic.
In this post, I am describing some payloads which I used to bypass two distinct XSS filter implementations (such as Web Application Firewalls (WAF)) as well as the approach to design them.
This post is an overview of the different tunneling options available in OpenSSH. This is intended as a reference to use when I am explaining (every so often) how to use SSH for tunneling.
Arbitrary code execution through kitty-open.desktop file association
ニャーニャー
Published:
In Debian kitty package, the kitty-open.desktop file would associate kitty +open with several MIME types. This could be used to arbitrary trigger code execution by serving a file with such a MIME type.
This has been introduced in kitty in 73a197fcd (2022-02-06) released as part of v0.24.3. This has been fixed in v0.26.5-5 of the Debian kitty package. Fixed upstream in 537cabca7 released in v0.29.0. Other distributions such as Ubuntu Lunar are still impacted.