Turning Almost Nothing into a Supply Chain Compromise of Angular with GitHub Actions Cache Poisoning
adnanthekhan
bugbounty
Copilot or Coconspirator - Tricking GitHub Copilot and Stealing all Your Secrets
adnanthekhan
Who's SHA is it Anyway: Bypassing Google Cloud Build Comment Control for $30,000
adnanthekhan
Watch your Dispatch: Race Condition in Dependabot Core CI
adnanthekhan
Release-Drafter To google/accompanist Compromise: VRP Writeup
adnanthekhan
BlackHat 2024 and DEF CON 32 Preview
adnanthekhan
The Monsters in Your Build Cache - GitHub Actions Cache Poisoning
adnanthekhan
An Obscure Actions Workflow Vulnerability in Google's Flank
adnanthekhan
Web3''s Achilles'' Heel: A Supply Chain Attack on Astar Network
adnanthekhan
One Supply Chain Attack to Rule Them All - Poisoning GitHub's Runner Images
adnanthekhan
Welcome to my blog - there is more to come!
adnanthekhan
HTML Over the Wire
Ryan
A new web app architecture pattern is being adopted by many popular frameworks. Let’s talk about risk! What is HTML Over the Wire? A brief history of web app tech. TL;DR: Early web applications made you wait after every click until it could render an HTML response on the server and send it...
Opinions are like Bugs - Every Spec has one.
Ryan
When two specifications have differing opinions on how something should be parsed: here be dragons. This writeup is about a bug I first discovered over a year ago and have found a number of times since. There’s nothing particularly novel about the vulnerability itself, but I think there’s an...
Bypassing Safe-Redirect in Rails 7.0
Ryan
Yet another parsing differential bug Safe-Redirect The normal pattern for throwing a 302 redirect in a rails application is by using the built-in method redirect_to. As of rails v7.0, the default behaviour is to only allow relative redirects to locations on the same origin domain, unless the...
A Novel Approach to Subdomain Takeover
Ryan
*Subdomain takeover and DNS hijacking have been covered at length by Franz Rosen, Patrik Hudak, and plenty of other people. Rather than rehashing those traditional techniques, this post will explore a novel approach to finding dangling CNAME records. * BACKGROUND Rather than digging through a...