avatar

Spaceraccoon's Blog

InfoSec and White Hat Hacking

2025

Cybersecurity (Anti)Patterns: Frictionware
dev appsec
Cybersecurity (Anti)Patterns: Busywork Generators
dev appsec
Pwning Millions of Smart Weighing Machines with API and Hardware Hacking
web code-review reverse engineering ios android api

2024

Universal Code Execution by Chaining Messages in Browser Extensions
web desktop reverse engineering
Cache Me If You Can: Local Privilege Escalation in Zscaler Client Connector (CVE-2023-41973)
binary desktop reverse engineering
Back to the (Clip)board with Microsoft Whiteboard and Excalidraw in Meta (CVE-2023-26140)
web code review desktop

2023

Hacking HP Display Monitors via Monitor Control Command Set (CVE-2023-5449)
binary desktop reverse engineering hardware
Passing the New OSEE Exam After Forgetting Everything
reverse engineering binary exploit
Rule Writing for CodeQL and Semgrep
dev code review

2022

I Hope This Sticks: Analyzing ClipboardEvent Listeners for Stored XSS
web code review
Challendar: Creating a Challenge for The Infosecurity Challenge 2022
dev web code review
Exploiting Improper Validation of Amazon Simple Notification Service SigningCertUrl
cloud web code review
You Have One New Appwntment: Exploiting iCalendar Properties in Enterprise Applications
desktop red team web ios android
Embedding Payloads and Bypassing Controls in Microsoft InfoPath
desktop red team
Solving DOM XSS Puzzles
web code review

2021

2Q21: New Year's Reflections
writing
The InfoSecurity Challenge 2021 Full Writeup: Battle Royale for $30k
desktop binary reverse engineering dev code review web android api red team
All Your (d)Base Are Belong To Us, Part 2: Code Execution in Microsoft Office (CVE-2021-38646)
desktop binary reverse engineering fuzzing
All Your (d)Base Are Belong To Us, Part 1: Code Execution in Apache OpenOffice (CVE-2021-33035)
desktop binary reverse engineering fuzzing code review
Down the Rabbit Hole: Unusual Applications of OpenAI in Cybersecurity Tooling
dev ai code review reverse engineering
ROP and Roll: EXP-301 Offensive Security Exploit Developer (OSED) Review and Exam
training binary
Life's a Peach (Fuzzer): How to Build and Use GitLab's Open-Source Protocol Fuzzer
fuzzing binary
Offensive Security Experienced Penetration Tester (OSEP) Review and Exam
training red team
Applying Offensive Reverse Engineering to Facebook Gameroom
desktop reverse engineering

2020

Supply Chain Pollution: Hunting a 16 Million Download/Week npm Package Vulnerability for a CTF Challenge
web code review
Imposter Alert: Extracting and Reversing Metasploit Payloads (Flare-On 2020 Challenge 7)
binary reverse engineering
Beat The Clock: The CSIT InfoSecurity Challenge
binary reverse engineering
Open Sesame: Escalating Open Redirect to RCE with Electron Code Review
desktop code review reverse engineering
Closing the Loop: Practical Attacks and Defences for GraphQL APIs
web api
Same Same But Different: Discovering SQL Injections Incrementally with Isomorphic SQL Statements
web
A Tale of Two Formats: Exploiting Insecure XML and ZIP File Parsers to Create a Web Shell
web
Remote Code Execution in Three Acts: Chaining Exposed Actuators and H2 Database Aliases in Spring Boot 2
web

2019

Low-Hanging Apples: Hunting Credentials and Secrets in iOS Apps
ios
From checkra1n to Frida: iOS App Pentesting Quickstart on iOS 13
ios