Unquoted Service Path Privilege Escalation in Razer Cortex - $750 USD
An unquoted search path in the Razer Cortex service (RzKLService.exe) lets a local attacker run code as SYSTEM.
dr3dd@sec:~$ whoami
dr3dd
Security Engineer. Notes on security research, exploitation and CTFs.
-
-
Stealing HackerEarth Client Secrets via CORS Misconfiguration and Open Redirect XSS
Two bugs on HackerEarth - a CORS misconfiguration that leaks OAuth client secrets and CSRF tokens, and an open redirect that leads to XSS.
-
GSoC'19 Final Report | OWASP Foundation
My final report for Google Summer of Code 2019 with OWASP: what I shipped for DefectDojo.