pwnull @pwnull010

when you pwn the null to full,you go from zero to hero pwnull.github.io Joined March 2022

Tweets

8
Followers

11
Following

96
Likes

10

Orange Tsai 🍊 @orange_8361

a year ago

Thanks @BlackHatEvents for the #BHUSA acceptance! It's pure web hacking research this time! 🔥 However, I'm still not sure if I can enter the US or not. In advance, I reapplied for the VISA and had the interview in March. Two months have passed, and my case is still under…

20 54 473 100K 45

Download Image

pwnull @pwnull010

a year ago

CVE-2024-21006 Oracle just released a Critical Patch Update Advisory for Q2 2024, which fixes a vulnerability in the oracle weblogic middleware I submitted. For more information, you can check this link: oracle.com/security-alert… #cve #CyberSecurity #weblogic

0 1 3 432 0

Download Image

GitHub Security Lab @GHSecurityLab

a year ago

Level up your security game on GitHub with seamless security research! Discover code scanning, CVE management, and more within GitHub's ecosystem. Check out this insightful blog post now! 🔒 #GitHub #SecurityResearch #CodeScanning #CVEManagement github.blog/2024-04-03-sec…

0 9 18 4K 4

pwnull @pwnull010

a year ago

In 2024, Spring awarded me the year's first CVE credit😉. As per the security advisory👓, the app uses AuthenticatedVoter directly, passing null authentication parameters, leading to erroneous true returns.💢spring.io/security/cve-2… #cybersecurity #cve #spring

1 0 2 206 0

pwnull @pwnull010

2 years ago

Much learned from the apache httpd mod_proxy CVE-2021-40438 vulnerability. Mod_proxy is widely used, so this vulnerability is very suitable as a permission breakthrough in the rce chain. For details, see: pwnull.github.io/2023/From-apac… #apache #cve #rce

0 0 1 199 0

pwnull @pwnull010

2 years ago

Learned from the RCE vulnerability of Nacos including Jraft RPC protocol construction and hessian deserialization. The process of reproducing vulnerabilities and learning knowledge is summarized. For details,see: pwnull.github.io/2023/from-Ali-… #Jraft #hessian #nacos

0 0 1 187 0

pwnull @pwnull010

2 years ago

I summarized the knowledge about caucho resin path normalization and break parser logic. For details, see: pwnull.github.io/2023/from-urlp… And found an undisclosed special path: ab/%20;/c but it is not a 0day and has been fixed by the latest official version.

0 0 1 163 0

Download Image

pwnull @pwnull010

2 years ago

I summarized the vulnerabilities in the history of Spring Security,pwnull.github.io/2023/from-urlp… In addition, I found a clever mistake when combining Common Servlet and Ant Mappings. Spring officially provided a prompt explanation about this,github.com/spring-project… #springsecurity