@flomb_

https://xitter.cf/t.co/EaIY9AfpBu

blog.flomb.net
Joined March 2019
  • Tweets58
  • Following1.9K
  • Followers159
Published my write-up regarding two vulnerabilities in the Tekton Dashboard. blog.flomb.net/posts/tekton/

Tekton Dashboard RCE and Kubernetes API Proxy

This is the story of how I found two vulnerabilities in the Tekton CI/CD Dashboard component that allow remote code execution and a potential node takeover if deployed in read/write mode as well as...

blog.flomb.net
21
1
64
10,292
flomb - @fl0mb.bsky.social retweeted
Soroush Dalili
@irsdlAug 10
The blog that hosted the 2011 to 2015 Top 10 Web Hacking Techniques lists is gone. So are hundreds of the articles those lists cite. I rebuilt all of it. Every nominee since 2006, all 1,136 of them, plus 351 more the nomination rounds missed. webhacklist.com
10
26
2
99
12,675
flomb - @fl0mb.bsky.social retweeted
pfiatde@pfiatdeMar 1
Sometimes a stupid idea get stuck in your head. And will not disappear after a while. Anyway, here is a new blogpost, just a little hoax this time. badoption.eu/blog/2026/02/28…
1
3
11
784
incredibly excited to share that my research 'Playing with HTTP/2 CONNECT' made the final @PortSwigger Top 10 Web Hacking Techniques of 2025! A huge thank you to everyone who voted. It’s a privilege to be featured alongside such talented researchers. portswigger.net/research/top…

Top 10 web hacking techniques of 2025

Welcome to the Top 10 Web Hacking Techniques of 2025, the 19th edition of our annual community-powered effort to identify the most innovative must-read web security research published in the last year

portswigger.net
1
1
17
3,237
flomb - @fl0mb.bsky.social retweeted
OmerAF@omer_asfuFeb 2
👼GatewayToHeaven (CVE-2025-13292). I discovered a cross-tenant vulnerability in @GoogleCloud's #Apigee, allowing me to access other organizations' data (and sometimes even plaintext JWTs of end users). Below is the full breakdown of the exploit chain⛓️
Technical architecture diagram titled 'GatewayToHeaven' showing a 5-step exploitation chain in Google Cloud Apigee. It illustrates an attacker pivoting from an isolated tenant project through an SSRF, poisoning Dataflow dependencies, and exfiltrating tokens via GCP APIs to access cross-tenant metadata and logs.

ALT Technical architecture diagram titled 'GatewayToHeaven' showing a 5-step exploitation chain in Google Cloud Apigee. It illustrates an attacker pivoting from an isolated tenant project through an SSRF, poisoning Dataflow dependencies, and exfiltrating tokens via GCP APIs to access cross-tenant metadata and logs.

A redacted screenshot of JSON log data serving as proof of exploit. The image highlights captured sensitive fields including a 'client_ip' and a cross-tenant 'access_token' (JWT), demonstrating successful unauthorized data access.

ALT A redacted screenshot of JSON log data serving as proof of exploit. The image highlights captured sensitive fields including a 'client_ip' and a cross-tenant 'access_token' (JWT), demonstrating successful unauthorized data access.

12
109
4
554
64,683
flomb - @fl0mb.bsky.social retweeted
CODE WHITE GmbH@codewhitesecJan 23
You like technical deep dives into binary exploitation and crazy heap wizardry? Then you'll like our blog post by @0xor_solo about unauth'ed RCE in NetSupport Manager aka CVE-2025-34164 & CVE-2025-34165 code-white.com/blog/2026-01-…

CODE WHITE | Unauthenticated RCE in NetSupport Manager - A Technical Deep Dive

NetSupport Manager is a remote control and support software that we find surprisingly often utilized in sensitive *Operational Technology (OT)* environments, such as production plant networks....

code-white.com
52
3
137
18,649
Honored to be nominated for the @PortSwigger Top 10 Web Hacking Techniques 2025 with my research "Playing with HTTP/2 CONNECT". Make sure to check out the full list and cast your vote! portswigger.net/polls/top-10…

Top 10 web hacking techniques of 2025

Welcome to the community vote for the Top 10 Web Hacking Techniques of 2025.

portswigger.net
1
4
165
flomb - @fl0mb.bsky.social retweeted
CODE WHITE GmbH@codewhitesec5 Dec 2025
Our 2024 applicants challenge is officially #roasted: the full BeanBeat × Maultaschenfabrikle walkthrough is now online. Unwrap the write-up at apply-if-you-can.com/walkthr… and revisit the hacks that escalated from cold brew to full breach.

CODE WHITE - Applicants Challenge

Applicants Challenge! Face real-world vulns, earn trophies, First Bloods & epic swag!

apply-if-you-can.com
12
34
2,923
flomb - @fl0mb.bsky.social retweeted
CODE WHITE GmbH@codewhitesec29 Oct 2025
Latest ≠ Greatest? A Retrospective Analysis of CVE-2025-59287 in Microsoft WSUS from our very own @mwulftange who loves converting n-days to 0-days code-white.com/blog/wsus-cve…

CODE WHITE | A Retrospective Analysis of CVE-2025-59287 in Microsoft WSUS

How the n-day research for a suspected vulnerability in Microsoft WSUS (CVE-2025-59287) led to the surprising discovery of a new `SoapFormatter` vulnerability added by the Patch Tuesday updates of...

code-white.com
1
51
1
97
15,557
flomb - @fl0mb.bsky.social retweeted
m1tz@_m1tZ7 Oct 2025
Did you encounter the Supabase? Might wanna try my newest tooling or have a read about quickwins? There you go: blog.m1tz.com/posts/2025/10/…

A Hands-On Edition: Will Supabase Be the Next Firebase (At Least in Terms of Security)?

It all started with my good colleague @schniggie who’s got my attention with an X post earlier that year. Until then I rarely heared of Supabase, but let us start from the scratch. Firebase changed...

blog.m1tz.com
4
7
494
blog.flomb.net/posts/http2co…

Playing with HTTP/2 CONNECT

In HTTP/1, the CONNECT method instructs a proxy to establish a TCP tunnel to a requested target. Once the tunnel is up, the proxy blindly forwards raw traffic in both directions. This mechanism is...

blog.flomb.net
3
6
186
flomb - @fl0mb.bsky.social retweeted
CODE WHITE GmbH@codewhitesec15 Sep 2025
CODE WHITE proudly presents #ULMageddon which is our newest applicants challenge at apply-if-you-can.com/ packaged as a metal festival. Have fun 🤘 and #applyIfYouCan
2
14
1
34
5,104
flomb - @fl0mb.bsky.social retweeted
Solar Designer@solardiz8 Aug 2025
Just out of stealth mode last week, @TeamCyata reports on their "deliberate, weeks-long effort [...] to uncover logic-level vulnerabilities" in HashiCorp Vault and CyberArk Conjur. And uncover they did. cyata.ai/blog/cracking-the-v… cyata.ai/blog/exploiting-a-f…

AI Security Solutions - Check Point Software

Check Point's AI Security Solutions deliver AI-driven threat prevention and unified security management for advanced protection across enterprise networks.

checkpoint.com
This Post is from a suspended account. Learn more
1
5
8
1,708
flomb - @fl0mb.bsky.social retweeted
xEHLE
@xEHLE_7 Jul 2025
New writeup: Early last month, @samwcyo, @sshell_, and I found a Django ORM injection in an online shooter game that let us steal cryptocurrency from the game's wallet. Read the blog post here: blog.p1.gs/writeup/2025/07/0…

Exploiting an ORM Injection to Steal Cryptocurrency from an Online Shooter

blog writeup

blog.p1.gs
36
72
1
264
20,093
flomb - @fl0mb.bsky.social retweeted
Source Incite@sourceincite17 Jul 2025
Here is a really cool blog post by wasamasa whos is a past student of our FSWA class: emacsninja.com/posts/cve-202…. You can find them on Mastodon: lonely.town/@wasamasa/
9
1
25
5,949
flomb - @fl0mb.bsky.social retweeted
James Kettle
@albinowax19 Jun 2025
"Funky chunks: abusing ambiguous chunk line terminators for request smuggling" - quality research by @__w4ke! Also thankfully it doesn't overlap with my upcoming presentation 😅 w4ke.info/2025/06/18/funky-c…

Funky chunks: abusing ambiguous chunk line terminators for request smuggling

Jeppe’s place.

w4ke.info
1
45
202
14,201
flomb - @fl0mb.bsky.social retweeted
frycos@frycos17 Jun 2025
A quick-and-dirty late night blog post on discovering an nday variant in Zyxel NWA50AX Pro devices frycos.github.io/vulns4free/…

Zyxel NWA50AX Pro - Discovery of an Nday Variant

Today was an eventful day thanks to many interesting blog posts, e.g. from my friends at watchTowr. So I thought, why not publish a small quick-and-dirty blog post myself about a story from last...

frycos.github.io
2
22
55
8,299
flomb - @fl0mb.bsky.social retweeted
Trail of Bits
@trailofbits18 Jun 2025
Three unexpected attack scenarios: 1. Marshaling private data with misconfigured tags 2. Parser differentials in a microservices architecture 3. Cross-format confusion attacks (JSON→XML) blog.trailofbits.com/2025/06…

Unexpected security footguns in Go's parsers

File parsers in Go contain unexpected behaviors that can lead to serious security vulnerabilities. This post examines how JSON, XML, and YAML parsers in Go handle edge cases in ways that have...

blog.trailofbits.com
2
35
2
133
21,263
flomb - @fl0mb.bsky.social retweeted
MrBruh@mister_bruz11 May 2025
One-Click RCE in ASUS’s Preinstalled Driver Software mrbruh.com/asusdriverhub/

One-Click RCE in ASUS's Preinstalled Driver Software

One-Click RCE in ASUS’s Preinstalled Driver Software Part Two of the ASUS series is out, read it here. Introduction This story begins with a conversation about new PC parts. After ignoring the advice...

mrbruh.com
2
19
3
83
21,949
flomb - @fl0mb.bsky.social retweeted
c1sc0@C1sc0126 May 2025
Here is a short writeup for my recently discovered CVE: hesec.de/posts/cve-2025-4666…
1
2
15
430
flomb - @fl0mb.bsky.social retweeted
CODE WHITE GmbH@codewhitesec13 May 2025
Yes, we're beating a dead horse. But that horse still runs in corporate networks - and quietly gives attackers the keys to the kingdom. We're publishing what’s long been exploitable. Time to talk about it. #DSM #Ivanti code-white.com/blog/ivanti-d…

CODE WHITE | Analyzing the Attack Surface of Ivanti's DSM

Ivanti's Desktop & Server Management (DSM) product is an old acquaintance that we have encountered in numerous red team and internal assessments. The main purpose of the product is the centralized...

code-white.com
49
4
106
16,457
Load more