Apache Tomcat

Tomcat, the manager application, and whoever decided the default password was fine.

2020

patrik.re 16 Jun 2020

Jolokia endpoints: JNDI RCE and heap dumps

A full lab build and exploitation walkthrough for exposed Jolokia JMX endpoints: reflected XSS (CVE-2018-1000129), JNDI remote code execution via a rogue LDAP server (CVE-2018-1000130), and dumping the Java heap to recover credentials.

CVE-2018-1000129 CVE-2018-1000130

2014

patrik.re 20 Apr 2014 Archive

Seven PayPal Bugs, Zero Bounties

A 2014 run through PayPal's bug bounty scope: seven confirmed issues across paypal.com, financing.paypal.com, apps.paypal.com and the paypal-*.com family, all closed as duplicate or invalid.

↑