https://0day.click/page/ Recent content in Pages on 0day.click Hugo en-us https://0day.click/page/about/ Mon, 01 Jan 0001 00:00:00 +0000 https://0day.click/page/about/ <p>This site contains misc stuff I came across in the last decade or so.</p> https://0day.click/page/references/ Mon, 01 Jan 0001 00:00:00 +0000 https://0day.click/page/references/ <h1 id="talks-and-presentations">Talks and Presentations</h1> <ul> <li>Nullcon Berlin 2025 - Keynote LLMs Everywhere: The future is now and the past keeps repeating itself - <a href="https://0day.click/the-future-is-now/">Slides</a></li> <li>OffensiveCon 2025 - Parser Differentials - <a href="https://www.youtube.com/watch?v=Dq_KVLXzxH8">Video</a> &amp; <a href="https://0day.click/parser-diff-talk-oc25/">Slides</a></li> <li>Invited Talk for <a href="https://bi0s.in">Team Bi0s</a> - Argument Injection - <a href="https://www.youtube.com/watch?v=FHiJnw9TTX8">Video</a> &amp; <a href="https://docs.google.com/presentation/d/1U8r5CJs9dLOLO2-hj_bHidRMXugUl3ejv8Hdw6bDMv4/">Slides</a></li> <li>HITB GSEC 2018 - Surprise Rant 2.0 <a href="https://www.youtube.com/watch?v=W2SLg--am1A">Video</a></li> <li>OffensiveCon 2018 - Surprise Rant <a href="https://www.youtube.com/watch?v=VTic5d13u2E">Video</a></li> <li>Ekoparty 2016 - Let Me GitHub That For You (2016 Argentinian Edition) <a href="https://www.youtube.com/watch?v=g4NiV8tbGT8">Video</a></li> <li>Hacktivity 2015 - Your Web app, those hackers &amp; you <a href="https://www.youtube.com/watch?v=p-Njhwp5PZA">Video</a></li> <li>HackPra 2015 - Bug Tales <a href="https://www.youtube.com/watch?v=XWrci09sGMU">Video</a></li> <li>Hackito Ergo Sum 2014 - Ruby on Rails exploitation and effective backdooring</li> <li>t2-2013 - &lt;3 Ruby on Rails &lt;3</li> <li>HITB Amsterdam 2013 - Attacking Ruby on Rails Applications</li> <li>ZeroNights 2012 - They told me I could be anything, so I became BAh7BkkiDHVzZXJfaWQGOgZFVGkG</li> <li>HITB Malaysia 2011 - Building and Breaking Ruby on Rails</li> <li>Hackito Ergo Sum 2011 - Ruby On Rails From A Code Auditor&rsquo;s Perspective <a href="https://www.youtube.com/watch?v=o4goIQAzIME">Video part 1</a> <a href="https://www.youtube.com/watch?v=kEE9uaBOPyk">part 2</a> <a href="https://www.youtube.com/watch?v=3oI3gZwVQYk">part 3</a></li> <li>Berlinsides 2010 - Ruby On Rails From A Code Auditor&rsquo;s Perspective</li> </ul> <h1 id="blogposts">Blogposts</h1> <h2 id="gitlab">GitLab</h2> <ul> <li><a href="https://about.gitlab.com/blog/git-security-audit/">Git security audit: Inside the hunt for - and discovery of - CVEs</a></li> <li><a href="https://about.gitlab.com/blog/terraform-as-part-of-software-supply-chain-part1-modules-and-providers/">Terraform as part of the software supply chain</a></li> <li><a href="https://about.gitlab.com/blog/two-bugs-and-a-quick-fix-in-gitpod/">A brief look at Gitpod, two bugs, and a quick fix</a></li> <li><a href="https://about.gitlab.com/blog/switching-sides-in-security/">Switching &ldquo;sides&rdquo; in security</a></li> <li><a href="https://about.gitlab.com/blog/how-to-play-gitlab-ctf-at-home/">How to play GitLab&rsquo;s Capture the Flag at home</a></li> <li><a href="https://about.gitlab.com/blog/how-to-exploit-parser-differentials/">How to exploit parser differentials</a></li> <li><a href="https://about.gitlab.com/blog/shopping-for-an-admin-account/">Shopping for an admin account via path traversal</a></li> </ul> <h2 id="gitlab-security-tech-notes">GitLab Security Tech Notes</h2> <ul> <li><a href="https://gitlab-com.gitlab.io/gl-security/security-tech-notes/security-research-tech-notes/devfile/">Devfile file write vulnerability in GitLab</a></li> <li><a href="https://gitlab-com.gitlab.io/gl-security/security-tech-notes/security-research-tech-notes/arr-pm/">arr-pm command execution</a></li> </ul> <h2 id="recurity-labs">Recurity Labs</h2> <ul> <li><a href="https://blog.recurity-labs.com/2019-04-12/knx.html">KNX, %s and a backdoor</a></li> <li><a href="https://blog.recurity-labs.com/2017-08-10/scm-vulns.html">Compromise On Checkout - Vulnerabilities in SCM Tools</a></li> <li><a href="https://blog.recurity-labs.com/2011-05-12/18_06_51.html">dRuby for Penetration Testers</a></li> <li><a href="https://blog.recurity-labs.com/2011-03-09/18_34_04.html">At Least, I got DoS</a></li> </ul> <h2 id="phenoelit">Phenoelit</h2> <ul> <li><a href="http://194.150.168.69//blog/archives/2014/10/11/tldr_just_another_way_to_get_rce_in_i2p_version_0_9_13/index.html">TL;DR: Just another way to get RCE in i2p version 0.9.13.</a></li> <li><a href="http://194.150.168.69/blog/archives/2013/09/24/ruby_on_rails_default_token_database/index.html">Ruby on Rails Default Token Database</a></li> <li><a href="http://194.150.168.69/blog/archives/2013/02/05/mysql_madness_and_rails/index.html">MySQL madness and Rails</a></li> <li><a href="http://194.150.168.69/blog/archives/2012/12/21/let_me_github_that_for_you/index.html">Let Me Github That For You</a></li> <li><a href="http://194.150.168.69/blog/archives/2012/04/05/a_worst_practice_in_ruby_on_rails/index.html">A worst practice in Ruby on Rails</a></li> </ul> <h1 id="papers">Papers</h1> <ul> <li>Attacking Ruby on Rails Applications - <a href="http://phrack.org/issues/69/12.html#article">Phrack 69</a></li> <li>A Vulnerability in Reduced Dakarand from PoC||GTFO 01:02 - <a href="https://www.alchemistowl.org/pocorgtfo/pocorgtfo02.pdf">PoC||GTFO 02</a>:09</li> </ul> <h1 id="trainings">Trainings</h1> <ul> <li>Source Code Auditing Like a Ninja - <a href="https://gsec.hitb.org/sg2018/sessions/3-day-training-3-source-code-auditing-like-a-ninja/">HITB GSEC Singapore 2018</a></li> <li>Source Code Auditing Like a Ninja - <a href="https://archive.conference.hitb.org/hitbsecconf2018ams/sessions/3-day-training-4-source-code-auditing-like-a-ninja/">HITB Amsterdam 2018</a></li> <li>Ruby on Rails – Auditing &amp; Exploiting the Popular Web Framework - <a href="https://2015.appsec.eu/trainings/#train11">OWASP AppSec EU 2015</a></li> <li>Ruby on Rails – Auditing &amp; Exploiting the Popular Web Framework - <a href="https://2014.appsecusa.org/2014/training/ruby-on-rails-auditing-exploiting-the-popular-web-framework/">OWASP AppSec USA 2014</a></li> <li><a href="https://code-audit-training.gitlab.io/">Recurity Labs Code Audit Training Archive</a></li> </ul> <h1 id="other">Other</h1> <ul> <li>Founding member of <a href="https://wiki.das-labor.org/w/LABOR_Wiki">das Labor</a> a Hackerspace in Bochum</li> <li>Review panel member for <a href="https://threatcon.io">THREAT CON</a> 2018 - 2023</li> </ul>