avatar

Spaceraccoon's Blog

InfoSec and White Hat Hacking

2022

You Have One New Appwntment: Exploiting iCalendar Properties in Enterprise Applications
desktop red team web ios android
Solving DOM XSS Puzzles
web code review

2021

The InfoSecurity Challenge 2021 Full Writeup: Battle Royale for $30k
desktop binary reverse engineering dev code review web android api red team

2020

Supply Chain Pollution: Hunting a 16 Million Download/Week npm Package Vulnerability for a CTF Challenge
web code review
Closing the Loop: Practical Attacks and Defences for GraphQL APIs
web api
Same Same But Different: Discovering SQL Injections Incrementally with Isomorphic SQL Statements
web
A Tale of Two Formats: Exploiting Insecure XML and ZIP File Parsers to Create a Web Shell
web
Remote Code Execution in Three Acts: Chaining Exposed Actuators and H2 Database Aliases in Spring Boot 2
web