Chaining Multiple Vulnerabilities to Gain Admin Access

In April of this year I participated in a private program on HackerOne that was vulnerable to a series of IDOR that led to a complete takeover of an application. Unfortunately because this is a private program, I cannot disclose the name or company related information per their request. However I wanted to share the details on how I escalated my basic privileges from a regular “customer” account to an admin user.

Secure your Jenkins instance or hackers will force you to! (Snapchat’s $5,000 Vulnerability)

After presenting “Doing Recon Like a Boss” at levelUp and releasing a blog post on HackerOne about the same topic, I decided to start looking for a few vulnerabilities on public programs to see if that methodology is still applicable to public programs. As a part of this I decided to look at Slack and Snapchat’s bug bounty programs and preforming my recon exactly as described in the talk.

Exploiting ImageMagick to get RCE on Polyvore (Yahoo Acquisition)

On 5/5/2016 ImageMagick was assigned CVE-2016-3714 “ImageMagick Delegate Arbitrary Command Execution”. Now let’s dig to this vulnerability and how to exploit this.  Having ImageMagick locally installed is advised in order to validate the POC (but not required). For this particular report, I created a file named  exploit.png with the following in the “source code” to get the target’s `id`:

Apple Pages, Numbers, Keynote Input Validation and XXE (CVE-2015-7032)


In June of 2015, Patrik Fehrenbach and I were able to identify a series of vulnerabilities in a few of Apple’s productivity applications: Pages, Numbers, as well as Keynote available for OS X and iOS 8.x (or older). In short, the application failed to validate the input while parsing a document.

Yahoo Image Processing SSRF/XSPA

In this blog post I will be showing a few recent vulnerabilities reported and patched by the Yahoo Security Team. In July of 2014 I was able to identify a SSRF vulnerability affecting all of Yahoo’s services that required an image processing (such as flickr and Yahoo groups). This vulnerability was patched a few weeks ago (June 2015). Now let’s get to the good stuff:

Single vulnerability to cause stored XSS in Yahoo, Flickr, Google, Twitter, Amazon, Youtube, Pinterest and more

Hello, In my last research with Y! Toolbar and Flickr I was able to identify and report a few vulnerabilities to Yahoo. Keep in mind that before starting this research as I was installing a few things on my new box, I had accidentally installed Y! Toolbar on chrome (so my Windows box has chrome, but not my linux box). While poking around Flickr to find a few vulnerabilities, I had set a few titles as different XSS payloads which in the past had never worked but suddenly something was triggering the XSS payloads (keep in mind that I wasn’t able to reproduce my own vulnerabilities on my linux box). So what was causing these to suddenly work ONLY for me?