https://patrik.re/topics/web-exploitation/ Bugs in web applications, APIs, and the software behind them. en-GB Thu, 25 Jun 2026 00:00:00 +0000 https://slcyber.io/research-center/cargowise-webtracker-the-keys-were-in-the-cargo/ https://slcyber.io/research-center/cargowise-webtracker-the-keys-were-in-the-cargo/ Thu, 25 Jun 2026 00:00:00 +0000 Credentials recoverable from a logistics platform's own tracking interface. Searchlight Cyberweb-exploitation https://slcyber.io/research-center/keys-to-the-kingdom-anonymous-sql-injection-in-drupal-core-cve-2026-9082/ https://slcyber.io/research-center/keys-to-the-kingdom-anonymous-sql-injection-in-drupal-core-cve-2026-9082/ Thu, 21 May 2026 00:00:00 +0000 Unauthenticated SQL injection reachable in Drupal core. Searchlight Cyberweb-exploitation https://slcyber.io/research-center/new-age-of-collisions-reading-arbitrary-files-pre-auth-as-root-in-cpanel-cve-2026-29205/ https://slcyber.io/research-center/new-age-of-collisions-reading-arbitrary-files-pre-auth-as-root-in-cpanel-cve-2026-29205/ Mon, 18 May 2026 00:00:00 +0000 Reading arbitrary files pre-authentication, as root, on cPanel. Searchlight Cyberweb-exploitation https://patrik.re/how-i-made-more-than-30k-with-jolokia-cves/ https://patrik.re/how-i-made-more-than-30k-with-jolokia-cves/ Tue, 16 Jun 2020 00:00:00 +0000 A full lab build and exploitation walkthrough for exposed Jolokia JMX endpoints: reflected XSS (CVE-2018-1000129), JNDI remote code execution via a rogue LDAP server (CVE-2018-1000130), and dumping the Java heap to recover credentials. patrik.reweb-exploitation https://patrik.re/bugbounty-decoding-a--f0-9f-98-b1-00000-htpasswd-bounty/ https://patrik.re/bugbounty-decoding-a--f0-9f-98-b1-00000-htpasswd-bounty/ Thu, 08 Sep 2016 00:00:00 +0000 Directory brute-forcing a private bug bounty target turned up a world-readable .htpasswd whose descrypt hash, once cracked, opened four staging and development subdomains. patrik.reweb-exploitationreconnaissance https://patrik.re/bugbounty-sleeping-stored-google-xss-awakens-a-5000-bounty/ https://patrik.re/bugbounty-sleeping-stored-google-xss-awakens-a-5000-bounty/ Tue, 17 May 2016 00:00:00 +0000 An XSS payload stored as a Google Cloud project name executed months later in the unfiltered project-deletion error message, earning a $5,000 VRP reward, plus the impact argument that got it past a self-XSS classification. patrik.reweb-exploitation https://patrik.re/digging-into-the-shopify-pos-firmware-part-1/ https://patrik.re/digging-into-the-shopify-pos-firmware-part-1/ Fri, 09 Oct 2015 00:00:00 +0000 An in-scope Shopify POS endpoint exposed the card reader's firmware bundles, which unpack via binwalk, a dd carve at 0x202024 and jffs2dump into a JFFS2 root filesystem containing a salted MD5 root hash. patrik.reweb-exploitationreverse-engineering https://patrik.re/research-stop-osx-spotlight-from-sending-your-location/ https://patrik.re/research-stop-osx-spotlight-from-sending-your-location/ Mon, 15 Jun 2015 00:00:00 +0000 Proxying OS X Spotlight through Burp showed it shipping the user's latitude and longitude to api.smoot.apple.com on every search, with two ways to block the request. patrik.reweb-exploitationreverse-engineering https://patrik.re/bugbounty-papyal-xml-upload-cross-site-scripting-vulnerability/ https://patrik.re/bugbounty-papyal-xml-upload-cross-site-scripting-vulnerability/ Wed, 07 Jan 2015 00:00:00 +0000 PayPal's invoicing feature accepted .xml attachments, and an XHTML-namespaced script element inside the XML executed when the file was served back. Includes the exploitability argument needed to qualify it for a bounty. patrik.reweb-exploitation https://patrik.re/bugbounty-reflected-cross-site-scripting-at-paypal-com/ https://patrik.re/bugbounty-reflected-cross-site-scripting-at-paypal-com/ Mon, 15 Dec 2014 00:00:00 +0000 A duplicated q parameter in PayPal's merchant directory let an injected payload break out of script context, producing a reflected XSS that PayPal patched within days. patrik.reweb-exploitation https://patrik.re/bugbounty-malicious-redirect-on-mailroom-prezi-com/ https://patrik.re/bugbounty-malicious-redirect-on-mailroom-prezi-com/ Wed, 10 Dec 2014 00:00:00 +0000 mailroom.prezi.com concatenated the request path onto its own hostname when redirecting, so a request to /.attacker-domain sent victims to a lookalike attacker-controlled host. patrik.reweb-exploitation https://patrik.re/bugbounty-reflected-cross-site-scripting-billmelater/ https://patrik.re/bugbounty-reflected-cross-site-scripting-billmelater/ Mon, 17 Nov 2014 00:00:00 +0000 A Firefox-only reflected XSS on wwwb.search.billmelater.com, achieved by closing out of a style attribute and injecting a fresh script element, which the vendor classified as out of scope. patrik.reweb-exploitationdisclosure https://patrik.re/research-ssh-honeypot-honey-wss-sh-com/ https://patrik.re/research-ssh-honeypot-honey-wss-sh-com/ Mon, 17 Nov 2014 00:00:00 +0000 Results from two weeks of a Kippo SSH honeypot in November 2014: roughly 4,000 brute-force attempts, 2,500 distinct credential pairs, and a source distribution dominated by hosts in China. patrik.reweb-exploitationreconnaissance https://patrik.re/bugbounty-paypal-stored-xss-security-bypass/ https://patrik.re/bugbounty-paypal-stored-xss-security-bypass/ Tue, 11 Nov 2014 00:00:00 +0000 A stored XSS in PayPal's account name field, delivered to arbitrary users through invoices after bypassing the signup flow's security check by truncating the workflow URL to /webapps/. patrik.reweb-exploitation https://patrik.re/bugbounty-paypal-dom-xss-main-domain/ https://patrik.re/bugbounty-paypal-dom-xss-main-domain/ Wed, 05 Nov 2014 00:00:00 +0000 A payload placed in the URL fragment reached a DOM sink on PayPal's main domain and executed; PayPal closed the report as a duplicate. patrik.reweb-exploitation https://patrik.re/bugbounty-the-5000-google-xss/ https://patrik.re/bugbounty-the-5000-google-xss/ Fri, 31 Oct 2014 00:00:00 +0000 Google Tag Manager validated macro names in the web UI but not in the JSON container import path, so a payload smuggled through a file upload executed and earned a $5,000 bounty. patrik.reweb-exploitation https://patrik.re/wordpress-3x-vulnerable-chat-plugins-3/ https://patrik.re/wordpress-3x-vulnerable-chat-plugins-3/ Thu, 02 Oct 2014 00:00:00 +0000 WP Live Chat Support, MyLiveChat and Provide Support all accepted stored cross-site scripting during a 2014 customer install. patrik.reweb-exploitationdisclosure https://patrik.re/google-chrome-security-multiple-leading-slashes-in-urls-may-confuse-some-server-side-xss-filters/ https://patrik.re/google-chrome-security-multiple-leading-slashes-in-urls-may-confuse-some-server-side-xss-filters/ Tue, 17 Jun 2014 00:00:00 +0000 Chrome resolves and executes a script URL written as http: followed by any number of backslashes. Firefox does not, and that difference can slip past pattern-matching XSS filters, closed by Chromium as wontfix. patrik.reweb-exploitationdisclosure https://patrik.re/bug-bounty-prezi-map-prezi-com-path-traversal/ https://patrik.re/bug-bounty-prezi-map-prezi-com-path-traversal/ Wed, 21 May 2014 00:00:00 +0000 A path traversal issue on Prezi's map.prezi.com subdomain, fixed within two days of reporting and rewarded with a $1,000 bounty. patrik.reweb-exploitationdisclosure https://patrik.re/a-tale-of-7-vulnerabilities-paypal-bug-bounty/ https://patrik.re/a-tale-of-7-vulnerabilities-paypal-bug-bounty/ Sun, 20 Apr 2014 00:00:00 +0000 A 2014 run through PayPal's bug bounty scope: seven confirmed issues across paypal.com, financing.paypal.com, apps.paypal.com and the paypal-*.com family, all closed as duplicate or invalid. patrik.reweb-exploitationreconnaissance https://patrik.re/were-on-heise-german-found-160-sites-vulnerable-to-xss/ https://patrik.re/were-on-heise-german-found-160-sites-vulnerable-to-xss/ Mon, 11 Nov 2013 00:00:00 +0000 Reflected cross-site scripting across 160 German tax office websites, disclosed via heise.de and forwarded to CERT-Bund for coordinated remediation. patrik.reweb-exploitationdisclosure https://patrik.re/php-5-3-3-5-3-6-exploit-bind-shell/ https://patrik.re/php-5-3-3-5-3-6-exploit-bind-shell/ Sat, 06 Jul 2013 00:00:00 +0000 A public PHP 5.3.3-5.3.6 socket_connect exploit carrying a bind-TCP shell payload, dropped as an uploaded PHP file and located with an nmap sweep of ports 4000-4500. patrik.reweb-exploitationreconnaissance https://patrik.re/from-nobody-to-root-advanced-sql-injection/ https://patrik.re/from-nobody-to-root-advanced-sql-injection/ Tue, 07 May 2013 00:00:00 +0000 Chaining a login-form SQL injection through sqlmap's --os-shell into a Linux 2.6.32 local root exploit to go from the 'nobody' user to full control of the server. patrik.reweb-exploitation https://patrik.re/bugbounty-yahoo-phpinfo-php-disclosure/ https://patrik.re/bugbounty-yahoo-phpinfo-php-disclosure/ Sun, 20 Jan 2013 00:00:00 +0000 Pivoting from Yahoo's main A record to its ARIN netblock and sweeping all 260,000 addresses in the /14 for an exposed phpinfo.php. patrik.reweb-exploitationreconnaissance