ai-security · 8 min
A prompt tells ChatGPT to play a character with no rules, and the model goes along with it. Why the role-play attack works, what changes between versions, and what it says about RLHF alignment.
· Manuel López Pérez
hackthebox · 5 min
Cascade write-up (HackTheBox): Windows media machine that exploits LDAP to enumerate users and hidden attributes, obtains VNC credentials from log, reverses .NET binary for AES key, and recovers admin password from deleted objects in Active Directory Recycle Bin.
· Manuel López Pérez
news · 1 min
Critical analysis of RustScan, the tool that promised to scan ports much faster than Nmap. Is it truly revolutionary or just an aggressive wrapper? Real comparison with advanced Nmap configurations that achieve more accurate and faster results.
· Manuel López Pérez
hackthebox · 4 min
First web challenge in the HackTheBox series completed. We learn how to bypass a hardcoded login in JavaScript, discover a secret area with a list of emails, and use Intruder (ZAP or Burp) to find the special address that reveals the flag.
· Manuel López Pérez
writeups · 5 min
Vault write-up (HackTheBox): average Linux machine that exploits file upload with filter bypass to obtain initial shell, pivots through OpenVPN and internal networks to escalate privileges and obtain root.
· Manuel López Pérez
writeups · 5 min
Write-up of a classic ASIS CTF challenge: bypassing a preg_match filter that prohibits letters (A-Za-z) using XOR to generate strings without letters that, when executed in eval(), call functions such as phpinfo() or show_source(). A very useful technique for understanding type juggling and WAF bypass in PHP.
· Pablo Plaza Martínez
writeups · 3 min
Curling write-up (HackTheBox): easy Linux machine that exploits Joomla with credentials leaked in comments, uploads webshell via template, obtains floris credentials via password_backup, and escalates to root with DirtySock (CVE-2019-7304).
· Manuel López Pérez
writeups · 6 min
Explanation of how to exploit a JWT vulnerability by changing the algorithm (RS256 → HS256) and using the public key as the secret. PoC based on the Moar Horse 4 challenge from TJCTF 2020.
· Manuel López Pérez
writeups · 6 min
Exploiting XSS with filter bypass using HTML encoding and eval+atob to perform CSRF and exfiltrate sensitive administrator information in a CTF.
· Pablo Plaza Martínez
tutorials · 6 min
Practical introduction to Frida on Android: setting up the environment (ADB + frida-tools + frida-server) and solving several basic exercises with JavaScript scripts.
· Pablo Plaza Martínez
tutorials · 8 min
Practical write-up of a 64-bit ELF with format string and buffer overflow to leak libc/PIE/canary and build a ROP that bypasses NX, ASLR, PIE, and stack canary.
· Manuel López Pérez
tutorials · 7 min
MITM with ARP poisoning and mitmproxy: intercept traffic in transparent mode, redirect with iptables, and modify responses on the fly using scripts with mitmdump.
· Pablo Plaza Martínez
