Home
Liam Galvin
Cancel

Malicious Rego: OPA Supply Chain Attacks

I’ve been using Rego a lot lately and have been very pleased with it. Like any technology though, it can be abused - especially if used irresponsibly. I was inspired by this post about IaC supply-c...

OPA Rego + tfsec: Custom security policies for your infrastructure

Recently, tfsec added support for applying Rego policies to your Terraform code. Clear rules can be written against simple data structures, whilst providing the developer with a wealth of informati...

Escalating Privileges with Dirty Pipe (CVE-2022-0847)

The Dirty Pipe vulnerability allows users to write to files for which they should only have read access. I recommend reading Max Kellermann’s vulnerability abstract to get a good grounding in how i...

Configuring Google Authenticator on Ubiquity EdgeOS OpenVPN

The following guide will help you to set up Google Authenticator based 2FA for OpenVPN on EdgeOS 2.0+ devices. It’s recommended to ensure you have another method to access your device in case you a...

Write-up: Intigriti March 2021 XSS Challenge

The following is my write-up for the March 2021 Intigriti XSS challenge. Let’s Get Started… The challenge takes place on a single web page, though this one appears more dynamic than those I’ve ...

Write-up: Intigriti January 2021 XSS Challenge

The following is my write-up for the first Intigriti XSS challenge of 2021. I discovered two solutions, the intended one and an unintended one, both of which were accepted by the challenge creat...

Write-up: HackerOne #HackyHolidays CTF

A few weeks back, HackerOne announced their Christmas CTF: The Grinch has gone hi-tech this year with the intention of ruining the holidays 😱We need you to infiltrate his network and take him down...

Write-up: BugPoc November 2020 XSS Challenge

I’ve been getting into XSS challenges over the last few weeks and BugPoc recently announced a nice tough one: Check out our XSS CTF! Skip an Amazon Interview + $2k in prizes!Submit solutions to be...

Leaking Git Repositories From Misconfigured Sites

Many deployment mechanisms for web applications exist in which the contents of a repository is copied onto a production server, whether this is by building the files into a Docker container, or sim...