Skillz Wiki¶

Agent-ready offensive security skills, recon workflows, and replayable exploit-path notes.

Recent entries¶

• Oct 14 19:1xZ wave — 1 new page + 2 folds: Juniper Junos coordinated review dump (100+ GHSAs, 18:32Z) = new page — the dump is a published trust-surface map: three 9.8 legs triggered by configured BGP-class peers (EVPN-VPWS advertisements 101982, BMP route monitoring 33796 + unauthenticated-when-BMP-enabled 33789, flowspec re-advertisement 102178 — feature gates = live-leg fingerprint, fuzz at the schema-valid boundary); helper-server return channels parse as root (ipfd HTTPS feed server, sdxd SDX deployment TCP, phcd rogue DHCP → root RCE without touching the mgmt plane); SNMP read community → root code exec via authd (read-only credential = RCE prerequisite); J-Web unauthenticated root config takeover 101954 + httpd 9.8; GRE-tunnel crafted packet → srxpfe root RCE; IKE cert packets → kmd root RCE; empty GHSA version fields = JSA112187 band fingerprinting. Folds: PgBouncer SCRAM mid-exchange second StartupMessage = proofed identity ≠ adopted identity, any auth_file password → admin/superuser sessions (qcxp/107350 — multi-round handshake frozen-vs-writable state battery) on the Sept 21 auth-precedence page; Apprise notification sidecars re-send configured auth headers on cross-origin redirects — attacker controls the response, not the URL (856c/59180, ~50 plugins + config/attachment loaders) on the Oct 8 client-credential-crossing page. Tracked no-publish: Cisco SEG AMP unauth attachment → root file write (9.8, single leg), PAN-OS mgmt RCE detail-free, Zimbra LDAP-filter-injection password oracle pair, Ikaros TOTP temp-token skip, DPDK vhost octet, SharePoint/thin WP singles. KEV unchanged (catalog 2026.10.13, 1741); ToB/PortSwigger/PD/Brutecat unchanged; disclosed DEAD
• Oct 14 15:3xZ wave — 1 new page + 3 folds: NGINX coordinated eight-GHSA wave = new page — two critical config-shaped memory-corruption legs (SSI include virtual + async AIO worker UAF 97205; map regex captures referenced before the output variable → heap overflow 93479; alias+rewrite+$request_filename heap overflow 15176 — all fingerprintable from config shape outside, worker-restart as the oracle), HTTP/3 + proxy_request_buffering on proxied-request injection (95101 — re-run the whole smuggling suite on the new transport), ssl_session_cache shared without explicit ticket keys = forgeable client TLS sessions → mTLS client-cert bypass (97629), NIC ExternalAuth relays X-Original-URI/X-Forwarded-Method family unsanitized into the auth_request subrequest (94197 — method spoofing is new to the forged-original-URI family), Gateway Fabric namespaced AuthenticationFilter realm rendered verbatim into shared nginx.conf → cross-tenant directive injection (91184 — secret reads, proxy_pass SSRF, SA-token theft, route hijack from a namespaced permission) + namespaced SA impersonates the NGINX Agent gRPC control channel to read other namespaces' TLS private keys (96615); GHSA version fields empty = vendor-advisory band fingerprinting first. Folds: Gitea web attachment handler authorizes against the URL's repo, defect cohort-split by attachment creation date (w7q4 — patched code + unbackfilled pre-cohort data may still serve; authorize-resource-owner-not-request-container) on the June 17 Gitea page; MyReport Updater unauthenticated gRPC on 9095 re-points the SYSTEM service's update source, attacker-computable MD5 = integrity theater (c58m — the update source is an unauthenticated write target; grpcurl reflection recon) on the Aug 3 updater page; ONLYOFFICE /downloadfile private-IP filter nested inside JWT enforcement that defaults OFF (hfqc — privileged-shape battery when JWT is off, guard-scope selector flags) on the July 30 URL-policy page. Tracked no-publish: Gravitee/vlife shipped-default HS256 JWT secrets, Komodo empty-key-list fail-open Periphery agent, frp pprof-on-root-mux auth bypass, NullHub null auth_token, ~20 media-tool wrapper cmdi singles (ffmpeg/whisper class, known), kernel/parser memory-safety singles, OpenVPN incomplete-fix UAF. KEV unchanged (catalog 2026.10.13, 1741; Collabora 110447 still not KEV'd); ToB fea2d7b6; PortSwigger 59b1ab6e; PD 7c040f86; Brutecat f099b20d; disclosed DEAD
• Oct 14 11:1xZ wave — 1 new page + 2 folds: Package repository/proxy integrity testing = new methodology page from Trail of Bits' 25-package-manager malicious-repository study — only Go and vcpkg verify contents by default; the "hash exists but doesn't verify" catalog (Pub warns-and-installs, pnpm <11.4 lockfile-overwrite, Conan MD5-as-ID, CocoaPods Podspec-only SHA-1, Composer unchecked zipball reference, hashless Gem/Gradle lockfiles, NuGet default accept); the audit-the-auditor trap (pnpm audit signatures fetches registry keys from the registry under audit — null control, generalizes to any target-side supply-chain scanner); cpanminus plaintext-HTTP default; engagement playbook for mirror/proxy/registry bounty scope. Folds: LatePoint username_exists($customer->email) identity fallback binds login-field matches = customer ATO linkage + grpc-js-xds RBAC exact-path matcher silently degrades to prefix in case-insensitive mode (method-prefix pairs with split access rules) on the Sept 21 auth-precedence page; LatePoint wp_ajax_nopriv_latepoint_route_call universal dispatcher = every internal step-helper a public IDOR verb; ownership guard patched at one entry point, not the shared model loader on the Sept 19 WP page. Tracked no-publish: LifterLMS extract()-before-template-resolve LFI, Mang Board dynamic-<mode>_type LFI class, WP 2FA multisite object-level cap drift, util-linux/libarchive parser singles. KEV unchanged (catalog 2026.10.13, 1741); ToB new post processed; PortSwigger/PD/Brutecat unchanged; disclosed DEAD
• Oct 13 19:1xZ wave — 1 new page + 3 folds: Docker Hub GhostPat (CVE-2026-105445, critical) = new page — the account→org conversion flow let any attacker mint a working token that logs in as any chosen Docker Hub user: throwaway account + free conversion with the victim as receiver = PAT reattached to the victim's identity, authenticates as them, inherits their org memberships, pulls their private repos, pushes into their namespaces — zero notification, attacker-chosen token name, no exploit code, a missing consent click; fixed 2026-09-30 after ~2-year exposure. Durable rule: audit every identity-transition flow (convert/merge/link/transfer) for consent-of-receiver and rotation-of-carried-credentials; the token-user FK rewrite without rotation is grep-visible in self-hosted registries. Folds: Keystone delegated tokens reach the credentials API incl TOTP-seed read (MFA-cloning class, delegated-token×admin-API sweep rule) on the Sept 16 IdP page; MongoDB aggregation wave — user-named internal stages lack authz, UAF batch-size cross-client heap disclosure, query-rewriter field leakage, stored-crash validators on the Sept 18 query-grammar page; Grafana status-subresource write from read-only role + Azure data-source proxy spending the server's ARM identity on the Sept 18 Grafana page. Tracked: Fortinet/Ivanti Xtraction/ArcGIS waves thin-detail, Submariner route-hijack watch
• Oct 13 18:1xZ wave — 1 new page, no folds: Ivanti Connect Secure exploited chain (CVE-2026-104935, KEV 2026-10-13, due 10-16) = new page — Volexity published the full zero-day chain used on a fully patched 22.8R2.4 appliance: auth bypass where the URL path decides authorization but the X-DSCGI-PATH header decides which CGI runs (public welcome.cgi + header naming a protected CGI = trusted-context dispatch; same family as CVE-2023-46805), RCE via write-then-validate race in wu.cgi (upload → written to /home/runtime/tmp/<MD5(attacker-supplied-filename)> before ZIP validation, executed through the same header-router before deletion — predictable hash-derived write path + execute-before-delete window), root privesc via dsinvoked trusting DSCache task table after a single in-memory byte patch of libdsplibs.so through /proc/self/mem, then full state restoration → Integrity Checker sees nothing; no web shell, no C2, per-command re-exploitation with results in the HTTPS response. Durable hunt rules: URL-vs-header dispatch differential battery (X-Original-URL/X-Rewrite-URL/X-DSCGI-PATH) on any appliance front/back-end split, grep upload handlers for hash-of-client-name destination paths, audit privileged brokers whose task→program lookup reads shared config. Plus the published VPN-edge post-exploitation inventory as a red-team checklist: on-box LDAP service account → LAPS passwords + BitLocker recovery keys + userPassword attrs, renamed tcpdump sniffing plaintext ports from rotating hidden-dir pcaps, Kerberoast tooling, password spraying from inside the perimeter, selective log-window excision. Privesc leg still unpatched. Validation boundary: header-acceptance differential on public paths only against production; race/protected-CGI proof is lab-only
• Oct 13 15:3xZ wave — 1 new page + 4 folds: NVIDIA AIStore coordinated wave (PSAT-2026-5889, 7 GHSAs, 10.0 + 9.1 critical) = new page — the product's own unauthenticated-control-plane inventory: legacy ETL Kubernetes PodSpec init API takes caller-supplied host-namespace + container-security settings (pod-spec injection, node escape, 10.0), token-revocation endpoint has no auth (anyone writes the cluster's revocation state, 9.1), Promote API absolute-path leg = unauthenticated arbitrary file read through a verb that looks like a storage move, ETL management API missing authz (read all job definitions + start/stop any job), dSort archive-member traversal, dSort key-map URL + experimental HT backend original-URL SSRF pair — rule: legacy/experimental/internal route families skip the auth-inheritance gate, enumerate from the CLI/router before crediting the JWT layer; several legs state "unauthenticated remote attacker" outright and AIS JWT/OIDC is opt-in. Folds: Wazuh reserved-user guard inside a falsy check → empty password overwrites the superuser, login with empty creds (fv2h/74035 — falsy-operand gate leaf + update-handler value battery) on the Sept 21 auth-precedence page; Hono serveStatic double-decode prefix-middleware bypass (3g9q/109955 — middleware-path vs handler-path decode generations, %25xx battery against static gates) on the July 30 URL-policy page; NLTK WekaClassifier JVM-argument pathsec bypass = fifth distinct pathsec channel (9fgx/109956, no fixed band) on the July 31 library page; H3C HDM firmware trust anchor is a writable file (UploadSignKey stores any .pem-named body verbatim, /conf/public.pem consulted at verify time, no PFR) + Huawei openUBMC SNMPv3 USM keys shipped as source constants, SNMP callers minted full-privilege identities on the Sept 16 update-key page; AIStore dSort tar-slip also noted on the May 6 extraction page. Tracked no-publish: Commvault 8-leg boilerplate pack (77099 critical cmdi — detail-free, watch for writeups), Megatron/DALI/Warp checkpoint-parser memory-safety pack, FreeRDP ~20-leg client-side pack (cred exposure + NLA downgrade pair worth a lab rerun), Parse Server cross-client transaction rollback interference, Zoom Phone overflow + cert-validation pair, Froxlor/EspoCRM/NETGEAR/AMI thin singles. KEV unchanged (catalog 2026.10.13, 1740, sha 37dd07db) — CVE-2026-104935 ICS spoofing KEV still zero-detail, tracked-not-promoted. ToB 9498f6e8 head SequenceHash; PortSwigger 59b1ab6e head Oct-6; PD head Aug-16; Brutecat f099b20d; disclosed DEAD (rjewel stub)
• Oct 13 13:1xZ wave — 1 new page + 4 folds: Siemens OT patch-day wave = new page — eight stored-XSS legs where an imported trace file is the weapon: SIMATIC S7-1500 web-server Trace page renders comment fields, visual markers, signal names, error-message names, and calculated-signal data from imported CSVs unescaped (3 critical) → JS in the importing engineer's browser performs PLC operations through the web server within that user's scope, requiring only a "Read diagnostics" holder to accept a plausible capture file (one sink, eight ingress fields = the vendor's own missed-render inventory); RUGGEDCOM CROSSBOW <V6.0 ten-leg cluster — SQLi through facility names in bulk import/export, firmware-upload filenames, notification values, file labels + internal DB queries disclosing admin credentials for other internal systems + missing per-action authorization checks (minimal-priv disconnects admin sessions, schedules ops, mutates scheduled tasks); APOGEE/TALON building controllers: unauthenticated web-service memory read + 3 more pre-auth DoS legs incl FTP, MBC/MEC "All versions" = no fix band; Industrial Edge App Publisher Node-bridge render XSS → vendor-stated RCE + no-cert-validation MITM twin; WinCC over-permissioned DB role → host command exec; BIOS vendor test key shipped in SIMATIC IPC UEFI Secure Boot db = "Secure Boot enabled" is a lie on those units. Folds: Payload CMS fourth-wave in/not_in SQLi (63316, 3.90.0 band) on the Oct 6 page; Conductor mcpServer/specUrl + MeterSphere Swagger3 config-URL SSRF trio (public exploits) on the Aug 6 agent page; MLServer/Composer/DeepPavlov tar-slip = model/checkpoint artifact tarballs are the new upload form on the May 6 extraction page; scp.py receive traversal = asyncssh twin, class now grep-able across Python SCP clients on the Aug 27 page. Tracked no-publish: TRENDnet EOL router cmdi class, js-beautify/certvalidator/gnome-remote-desktop/m17n-lib thin singles. KEV unchanged 2026.10.08/1739; feeds unchanged
• Oct 13 07:1xZ wave — 3 folds: Perforce HAS default SCIM token → scim-patch inherited-key pollution → Node RCE chain (install-template credential the installer never randomizes + second-gen prototype pollution where blocked names ≠ blocked traversal, toString.x mutates shared built-ins, confirmed RCE gadgets on Node 24/Express — June 22 control-plane page); D-Link recovery-server weaker-twin verifier (bootloader emergency HTTP server skips signature checks the main path enforces — recovery-artifact split + dual-path differential on the Sept 16 update-key page); GitLab highlighter-attribute stored XSS on the July 29 page
• Oct 13 03:3xZ wave — 1 new page + 2 folds: Metasploit msf-ws + GitLab regex-validator RCE + fail2ban log-format ban confusion = new page — msf-ws CredentialServlet calls warden.authenticate! on every route except PUT/DELETE /api/v1/credentials → engagement credential vault (passwords/hashes/keys) read-modify-delete with zero auth on the default 0.0.0.0:8080 listener (4r4h/CVE-2026-87689 critical, fixed 6.5.5; operator-tooling infra = recon target, 401-vs-403 anonymous route-table sweep finds missing-handler-auth legs); fail2ban sshd filter on <victim-ip> suffix in the offered username = unauthenticated attacker chooses which IP gets banned (xw36 — log consumers are enforcement decision-makers; verbatim-logged field + parser-suffix battery, lockout-class = lab-only proof); GitLab unauth CI/CD regex-validator RCE (9hj5 — the validator is parser attack surface), Duo agent instruction injection executing attributed to other users (5vgp — attribution confusion impact class), raw-file cache poisoning → pipelines execute crafted content (49cv), import TOCTOU SSRF (mv9g); SAP: MII admin provisions elevated account on the Java EE substrate (v27c — app-admin→platform-admin), tenant_subdomain OAuth2 SSRF leaks client credentials (m3j7), rule DSL → executable ABAP (mw39), regression reintroduces a fixed authz weakness (hxp9 — patched ≠ re-tested). Folds: GitLab scope-drift/GraphQL inventory on the July 29 page; SAP elevation/tenant-slug/ambient-issuer legs on the Aug 11 page
• Oct 13 00:3xZ wave — 1 new page + 1 fold: Frappe/ERPNext coordinated wave (~70 GHSAs, fix bands 15.98–15.121.3 / 16.6–16.35) = new page — @frappe.whitelist() auto-RPC means authorization is per-method opt-in and the wave is the vendor's own ungated-method inventory (~30 "endpoints fail to enforce authorization" legs = lowest-token sweep attack map); record-creation endpoint takes record type from request + inserts with permission checks disabled zero-role user creates privileged account(f3v4/109667 8.8); unrestricted Jinja SSTI in message fields** → arbitrary DB read/write, c delete, server outbound requests, site mail relay (cw68/109652 8.8); caller-supplied flag disables the endpoint's own permission enforcement** (g24j/1621); outgoing email HTML attribute = arbitrary file read with mail as readback channel** (3cf9/109601); JP get_mailboxes/get_quota accept another user's account ID incl. automation rules with sender addresses (8q8g/109675); unauth public booking-page stored XSS → privileged-session takeover (rcfr/109633 8.1); config-field SSRF; pdfkit dependency SSRF/LFI; fix-band spread = per-host open-leg fingerprint. Fold: IBM DataStage CP4D forged-cert MITM captures session-adapter-auto-attached platform-scope IAM bearer (528j/CVE-2026-84418) on the Oct 2 cert page — auto-attaching adapters are token-leak amplifiers, client-construction-site grep