https://sec.stealthcopter.com/Recent content on StealthcopterHugoen-USWed, 24 Sep 2025 07:30:11 +0000https://sec.stealthcopter.com/regexss/Wed, 24 Sep 2025 07:30:11 +0000https://sec.stealthcopter.com/regexss/Overly-greedy regex replacements can break HTML sanitisation and lead to XSS. I’ve already pulled in over $6k from this bug class, and there are plenty more out there. Live demo included so you can have a play at exploiting it!https://sec.stealthcopter.com/patchstack-ctf-sneaky/Tue, 25 Feb 2025 20:00:00 +0000https://sec.stealthcopter.com/patchstack-ctf-sneaky/Third write-up for the Sneaky Patchstack CTF challenge, exploring visual diffing and fun with PHP filter chainshttps://sec.stealthcopter.com/patchstack-ctf-blocked/Tue, 25 Feb 2025 12:00:00 +0000https://sec.stealthcopter.com/patchstack-ctf-blocked/Explore how creative tricks in PHP and WordPress allow you to bypass restrictions in a fun Patchstack CTF (S02E01) challenge and uncover neat tricks with filters and file paths!https://sec.stealthcopter.com/patchstack-ctf-cool-templates/Sun, 23 Feb 2025 20:00:00 +0000https://sec.stealthcopter.com/patchstack-ctf-cool-templates/This writeup explores a Patchstack WordPress CTF challenge where a vulnerable custom footer feature allows for dynamic function execution. The challenge involves bypassing a blocklist and REGEX restrictions on function names to execute arbitrary code.https://sec.stealthcopter.com/jupiterx-chaining-svg-to-rce/Sat, 11 Jan 2025 12:00:00 +0000https://sec.stealthcopter.com/jupiterx-chaining-svg-to-rce/tldr; On their own, these two vulnerabilities in JupiterX Core wouldn’t have been very impactful or likely to get a bounty; but by chaining them together, the exploit could be escalated from a simple SVG upload to full Remote Code Execution (RCE).https://sec.stealthcopter.com/wpml-rce-via-twig-ssti/Wed, 21 Aug 2024 08:30:55 +0000https://sec.stealthcopter.com/wpml-rce-via-twig-ssti/tldr; Server-Side Template Injection (SSTI) is one of my favorite vulnerabilities, but rarely do I see it outside of CTF competitions… The WPML Multilingual CMS Plugin for WordPress used by over 1 million sites is susceptible to an Authenticated (Contributor+) Remote Code Execution (RCE) vulnerability through a Twig server-side template injection.https://sec.stealthcopter.com/intigriti-august-2024-ctf/Thu, 15 Aug 2024 20:35:20 +0000https://sec.stealthcopter.com/intigriti-august-2024-ctf/tldr; This challenge was fun and engaging, blending CSPT with an open redirect flaw to ultimately pull off a successful XSS attack and grab the flag!https://sec.stealthcopter.com/splashing-around-in-the-shallow-end/Mon, 22 Jul 2024 19:45:11 +0000https://sec.stealthcopter.com/splashing-around-in-the-shallow-end/tldr; Reported ~300 vulns in WordPress plugins and themes, made about ~$27k. Have made some of my write-ups public and am working on a WordPress hacking workshop as an introduction to bug bounty.https://sec.stealthcopter.com/intigriti-july-2024-ctf-challenge-memo/Mon, 08 Jul 2024 12:19:58 +0000https://sec.stealthcopter.com/intigriti-july-2024-ctf-challenge-memo/This fun little challenge was to get reflected cross-site scripting (XSS) on a simple web app that is protected by a content security policy (CSP) and DOMPurify. The solution involves DOM clobbering, relative path abuse and a CSP bypass via HTML base tag injection.https://sec.stealthcopter.com/nahamcon-ctf-2024-my-shop-disaster/Mon, 27 May 2024 12:56:01 +0000https://sec.stealthcopter.com/nahamcon-ctf-2024-my-shop-disaster/Solution for the WooCommerce WordPress plugin challenge that PatchStack submitted to the NahamCon 2024 CTF.https://sec.stealthcopter.com/cve-2024-22144/Tue, 12 Mar 2024 09:54:54 +0000https://sec.stealthcopter.com/cve-2024-22144/Unauthenticated Remote Code Execution (RCE) by chaining multiple vulnerabilities in the Anti-Malware Security and Brute-Force Firewall GOTMLS WordPress Pluginhttps://sec.stealthcopter.com/intigriti-february-ctf-challenge-love-letter-storage/Thu, 22 Feb 2024 00:01:00 +0000https://sec.stealthcopter.com/intigriti-february-ctf-challenge-love-letter-storage/tl;dr: Solved an awesome Valentine’s Day challenge by @goatsniff from Intigriti. I gained valuable insights into using character conversions to bypass XSS protections and learned about data exfiltration through the manipulation of cookie paths.https://sec.stealthcopter.com/ninja-contact-forms/Sat, 10 Feb 2024 15:06:04 +0000https://sec.stealthcopter.com/ninja-contact-forms/The Ninja Forms Contact Form Plugin for WordPress is susceptible to an SQL injection vulnerability when processing data export requests.https://sec.stealthcopter.com/intigriti-december-challenge-smarty-pants/Thu, 21 Dec 2023 00:01:50 +0000https://sec.stealthcopter.com/intigriti-december-challenge-smarty-pants/I decided to dust off my hacking hat and delve back into CTF challenges with the Intigriti December challenge. Here’s my write-up on the journey I had with this interesting puzzle, teaching me new tricks and reinforcing old skills.https://sec.stealthcopter.com/cve-2022-39841/Thu, 15 Sep 2022 08:00:00 +0000https://sec.stealthcopter.com/cve-2022-39841/A critical vulnerability in Medusa allows for information leakage, including plaintext credentials, by attaching to an unauthenticated WebSocket and waiting for a user to make a configuration change.https://sec.stealthcopter.com/dctf-just-take-your-time/Mon, 17 May 2021 06:29:51 +0000https://sec.stealthcopter.com/dctf-just-take-your-time/Over the weekend I participated in dCTF by DragonSec SI along with some friends. There were some really interesting and unique challenges in this CTF.https://sec.stealthcopter.com/saltstack-snapper-minion-privledge-escaltion/Sat, 17 Apr 2021 10:40:52 +0000https://sec.stealthcopter.com/saltstack-snapper-minion-privledge-escaltion/I discovered a command injection vulnerability in SaltStack’s Salt that allows privilege escalation using malicious filenames on a minion when the master calls snapper.diff. But… I was too slow!https://sec.stealthcopter.com/cve-2020-28243-v2/Tue, 23 Mar 2021 20:00:00 +0000https://sec.stealthcopter.com/cve-2020-28243-v2/Recently I disclosed a local privilege escalation, CVE-2020-28243, in SaltStack’s Salt via specially crafted process names. However, due to an incomplete fix, argument injection leading to a low impact denial of service is still possible.https://sec.stealthcopter.com/cve-2020-28243/Thu, 25 Feb 2021 19:00:00 +0000https://sec.stealthcopter.com/cve-2020-28243/I discovered a command injection vulnerability in SaltStack’s Salt that allows privilege escalation via specially crafted process names on a minion when the master calls restartcheck.https://sec.stealthcopter.com/htb-ctf-write-up-gunship/Thu, 10 Dec 2020 13:02:00 +0000https://sec.stealthcopter.com/htb-ctf-write-up-gunship/The HTB x Uni CTF 2020 - Qualifiers have just finished and I wanted write-up some of the more interesting challenges that we completed.https://sec.stealthcopter.com/htb-ctf-writeup-cargo-delivery/Thu, 10 Dec 2020 13:01:00 +0000https://sec.stealthcopter.com/htb-ctf-writeup-cargo-delivery/Cargo Delivery was a Python command line application that uses AES CBC encryption and is vulnerable to a padding oracle attack.https://sec.stealthcopter.com/htb-ctf-writeup-cached-web/Thu, 10 Dec 2020 13:00:00 +0000https://sec.stealthcopter.com/htb-ctf-writeup-cached-web/The HTB x Uni CTF 2020 - Qualifiers have just finished and I wanted to write-up some of the more interesting challenges that we completed.https://sec.stealthcopter.com/metasploit-community-ctf-2020-dec-write-up-5-of-clubs-port-8101/Mon, 07 Dec 2020 21:01:00 +0000https://sec.stealthcopter.com/metasploit-community-ctf-2020-dec-write-up-5-of-clubs-port-8101/Summary The 5-of-clubs challenge was to write a Metasploit module that is uploaded and run on a computer to which you do not have direct access. The module is uploaded along with a resource file that is used to automate Metasploit, the output is logged and can be viewed following execution.https://sec.stealthcopter.com/metasploit-community-ctf-2020-dec-write-up-7-of-spades-port-8888/Mon, 07 Dec 2020 21:01:00 +0000https://sec.stealthcopter.com/metasploit-community-ctf-2020-dec-write-up-7-of-spades-port-8888/Summary The 7-of-spades challenge is a basic Python web application that lists information about Metasploit modules. It uses a pickle saved in base64 to a cookie that can be modified to get remote code execution.https://sec.stealthcopter.com/metasploit-community-ctf-2020-dec-write-up-9-of-clubs-port-1337/Mon, 07 Dec 2020 21:01:00 +0000https://sec.stealthcopter.com/metasploit-community-ctf-2020-dec-write-up-9-of-clubs-port-1337/This fun little challenge was solved by our binary exploitation expert: benything.https://sec.stealthcopter.com/metasploit-community-ctf-2020-dec-write-up-ace-of-clubs-port-9009/Mon, 07 Dec 2020 21:01:00 +0000https://sec.stealthcopter.com/metasploit-community-ctf-2020-dec-write-up-ace-of-clubs-port-9009/Summary The ace-of-clubs challenge presented a SSH server on port 9009 that had an easy to guess login. This is followed by a privilege escalation to root in a custom binary using a file overwrite exploit.https://sec.stealthcopter.com/metasploit-community-ctf-2020-dec-write-up-queen-of-hearts-port-9008-9010/Mon, 07 Dec 2020 21:01:00 +0000https://sec.stealthcopter.com/metasploit-community-ctf-2020-dec-write-up-queen-of-hearts-port-9008-9010/Summary The queen-of-hearts challenge was on two ports, 9010 which contained a downloadable Java .jar file and 9008 which was the service that you needed to interact with. Initially it appeared that it was an insecure deserialisation exploit, and while it is likely that that was also present, the flag could be obtained using a simple logic flaw as the application was relying on a client-side check for authentication status.https://sec.stealthcopter.com/metasploit-community-ctf-2020-dec/Mon, 07 Dec 2020 21:00:00 +0000https://sec.stealthcopter.com/metasploit-community-ctf-2020-dec/Metasploit ran another community CTF this year, and we decided to put forward a team. The team ended up bigger than all other teams I’ve been part of before and hence PrettyBeefy team was born.https://sec.stealthcopter.com/about/Fri, 13 Nov 2020 18:43:47 +0000https://sec.stealthcopter.com/about/@stealthcopter MSc Computer Security | OSCP I’m an Application Security Professional. I teach developers by creating insecure applications so they don’t have to :) I’ve made some open source software that you can find on Githubhttps://sec.stealthcopter.com/metasploit-1-2-3/Thu, 06 Aug 2020 10:10:00 +0000https://sec.stealthcopter.com/metasploit-1-2-3/I wrote a new metasploit module, enum_containers, that enumerates a target post exploit and detects container platforms and lists any containers that are actively running on them.https://sec.stealthcopter.com/docker_privileged_container_escape/Tue, 04 Aug 2020 10:15:00 +0000https://sec.stealthcopter.com/docker_privileged_container_escape/I wrote a new metasploit module, docker_privileged_container_escape, that escapes from a docker container with access to the docker sock obtaining a root shell on the host operating system.https://sec.stealthcopter.com/deepce/Fri, 31 Jul 2020 18:59:00 +0000https://sec.stealthcopter.com/deepce/I developed a container enumeration script. Think of it like linpeas/linenum but for containers.https://sec.stealthcopter.com/portdroid/Mon, 15 Jun 2020 19:54:00 +0000https://sec.stealthcopter.com/portdroid/PortDroid is a Network Analysis Application that helps Network Administrators, Penetration Testers and Hackers with several useful networking tools.https://sec.stealthcopter.com/rootbeer/Sat, 08 Feb 2020 21:04:00 +0000https://sec.stealthcopter.com/rootbeer/A tasty root checker library and sample app. We’ve scoured the internets for different methods of answering that age old question… Has this device got root?https://sec.stealthcopter.com/python-uuencode-vulnerability/Mon, 02 Dec 2019 22:13:00 +0000https://sec.stealthcopter.com/python-uuencode-vulnerability/tl;dr Found a vuln in some old and mostly unused data format in python, spoke to Guido van Rossum (inventor of Python), and submitted a PR with a fix. I had a look at the Python source code for and discovered a vulnerability in the UUEncode methods in Python.