Post

𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗪𝗼𝗿𝘁𝗵 𝗥𝗲𝗮𝗱𝗶𝗻𝗴 - 𝗪𝗲𝗲𝗸 𝟴, 𝟮𝟬𝟮𝟲 Java x2, Go, JWT and a sprinkling of AI 🦫 𝗖𝗧𝗙𝘁𝗶𝗺𝗲.𝗼𝗿𝗴 / 𝗷𝘂𝘀𝘁𝗖𝗧𝗙 [*] 𝟮𝟬𝟮𝟬 / 𝗚𝗼-𝗳𝘀 / 𝗪𝗿𝗶𝘁𝗲𝘂𝗽 A cool Golang quirk via an unintended CTF solution ctftime.org/writeup/25852.

ctftime.orgCTFtime.org / justCTF [*] 2020 / Go-fs / WriteupCTF writeups, Go-fs

22/2/26, 10:16 pm0 reposts1 like

PentesterLab

@pentesterlab.com

22 Feb

☕️ 𝗔𝗹𝗺𝗼𝘀𝘁 𝗜𝗺𝗽𝗼𝘀𝘀𝗶𝗯𝗹𝗲: 𝗝𝗮𝘃𝗮 𝗗𝗲𝘀𝗲𝗿𝗶𝗮𝗹𝗶𝘇𝗮𝘁𝗶𝗼𝗻 𝗧𝗵𝗿𝗼𝘂𝗴𝗵 𝗕𝗿𝗼𝗸𝗲𝗻 𝗖𝗿𝘆𝗽𝘁𝗼 𝗶𝗻 𝗢𝗽𝗲𝗻𝗧𝗲𝘅𝘁 𝗗𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆 𝗦𝗲𝗿𝘃𝗶𝗰𝗲𝘀 What an adventure in Java Deserialisation... slcyber.io/research-cen....

slcyber.ioAlmost Impossible: Java Deserialization Through Broken Crypto in OpenText Directory Services › Searchlight CyberIntroduction We recently found ourselves looking into OpenText Directory Services (OTDS). We had seen it present on our customer's attack surface, and it seemed to be an interesting target. OTDS is a ...

PentesterLab

@pentesterlab.com

22 Feb

😱 𝗩𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝘆 𝗗𝗶𝘀𝗰𝗹𝗼𝘀𝘂𝗿𝗲: 𝗝𝗪𝗧 𝗔𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗕𝘆𝗽𝗮𝘀𝘀 𝗶𝗻 𝗢𝗽𝗲𝗻𝗜𝗗 𝗖𝗼𝗻𝗻𝗲𝗰𝘁 𝗔𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗼𝗿 𝗳𝗼𝗿 𝗧𝗼𝗺𝗰𝗮𝘁 The exact same vulnerability I found in HarbourJWT but in a much cooler target, still not fixed... insinuator.net/2026/02/jwt-....

insinuator.netVulnerability Disclosure: JWT Authentication Bypass in OpenID Connect Authenticator for Tomcat – Insinuator.net

PentesterLab

@pentesterlab.com

22 Feb

☕️ 𝗖𝗩𝗘-𝟮𝟬𝟮𝟲-𝟬𝟲𝟬𝟯: 𝗦𝗲𝗰𝗼𝗻𝗱-𝗢𝗿𝗱𝗲𝗿 𝗦𝗤𝗟 𝗜𝗻𝗷𝗲𝗰𝘁𝗶𝗼𝗻 𝗶𝗻 𝗛𝗶𝗯𝗲𝗿𝗻𝗮𝘁𝗲 𝗨𝗣𝗗𝗔𝗧𝗘/𝗗𝗘𝗟𝗘𝗧𝗘 (𝗜𝗻𝗹𝗶𝗻𝗲𝗜𝗱𝘀𝗢𝗿𝗖𝗹𝗮𝘂𝘀𝗲𝗕𝘂𝗶𝗹𝗱𝗲𝗿) A bit of a stretch but an interesting insight into Hibernate: www.herodevs.com/blog-posts/c....

herodevs.comHeroDevs Blog | CVE-2026-0603: Second-Order SQL Injection in Hibernate UPDATE/DELETE (InlineIdsOrClauseBuilder)CVE-2026-0603 is a high-severity second-order SQL injection vulnerability in Hibernate ORM caused by unsafe ID inlining during UPDATE and DELETE operations. Learn impact, root cause, and remediation.

PentesterLab

@pentesterlab.com

22 Feb

🤖 𝗨𝘀𝗶𝗻𝗴 𝘁𝗵𝗿𝗲𝗮𝘁 𝗺𝗼𝗱𝗲𝗹𝗶𝗻𝗴 𝗮𝗻𝗱 𝗽𝗿𝗼𝗺𝗽𝘁 𝗶𝗻𝗷𝗲𝗰𝘁𝗶𝗼𝗻 𝘁𝗼 𝗮𝘂𝗱𝗶𝘁 𝗖𝗼𝗺𝗲𝘁 The team at Trail of Bits is sharing some key learnings from their audit of Comet (AI browser) blog.trailofbits.com/2026/02/20/u....

blog.trailofbits.comUsing threat modeling and prompt injection to audit CometTrail of Bits used ML-centered threat modeling and adversarial testing to identify four prompt injection techniques that could exploit Perplexity’s Comet browser AI assistant to exfiltrate private Gma...