Orange Tsai

Here is my list of solo developer blogs. Usually they are on topic. This does not include personal blogs I follow that happen to be developers. @mdo (Bootstrop) - http://markdotto.com/ Keith Cirkel - https://www.keithcirkel.co.uk/ Coding – Corbin's Treehouse - https://www.corbinstreehouse.com/blog Aaditya Purani – Ethical Hacker - https://aadityapurani.com/ Ben Balter - http://ben.balter.com/ fulldecent - https://privacylog.blogspot.com Orange - http://blog.orange.tw/ Cocoa with Love - http://www.cocoawithlove.com/ Mark Otto - http://markdotto.com/ Moxie Marlinspike's Blog - http://www.thoughtcrime.org/blog/ hueniverse - http://hueniverse.com/

Aside from Filedescriptor's work, here are some of my favourite blogs in the web application security space (not an exhaustive list): - https://blog.orange.tw/ - https://ngailong.wordpress.com/ - https://whitton.io/ - https://sakurity.com/blog - https://homakov.blogspot.com/ - https://buer.haus/ - https://philippeharewood.com/ - https://portswigger.net/research - https://gerbenjavado.com/ - https://medium.com/@intideceukelaire - https://samcurry.net/ - https://stephensclafani.com/ - https://www.josipfranjkovic.com/ - https://www.arneswinnen.net/ - https://blog.assetnote.io/ - https://medium.com/@alex.birsan - https://cablej.io/ - https://jonbottarini.com/ - https://www.corben.io/ There is also this massive list of write-ups that might be of interest to you: https://github.com/ngalongc/bug-bounty-reference. Shameless plug: I write about web application security at https://edoverflow.com/.

I wasn't aware of the issues described in the linked post about MobileIron exploits. Really interesting to hear about vulnerabilities in such a big MDM. https://blog.orange.tw/2020/09/how-i-hacked-facebook-again-mobileiron-…

True but FYI if you want to, you can reverse engineer the code of the GitHub enterprise version: https://blog.orange.tw/2017/01/bug-bounty-github-enterprise-sql-inject…

Blackhat/Defcon videos aren't up yet but Orange Tsai gave the same talk at HITBGSEC and that video is up: https://www.youtube.com/watch?v=D1S-G8rJrEk He also has a blog post about it: http://blog.orange.tw/2017/07/how-i-chained-4-vulnerabilities-on.html The premise is that URL parsing is complex and libraries get it wrong. This problem is pervasive and leads to server side request forgery vulnerabilities, which Orange was able to escalate to remote code execution on Github.

I'm directionally with Micah Lee on this in that I think all of these kinds of applications are activism theater, and I would hate for anything I say to sound like I'm getting the "ICEBlock" guy's back --- I'm sure it's bad and you shouldn't use it (though: Micah Lee's previous takedown of ICEBlock more or less comes down to "anybody can claim they saw ICE anywhere and also they don't have warrant canaries", which is... not interesting). But I'm struck that Lee reported CVE-2024-38476 to the author, with a simple link to the NVD site, based on a banner grab. For those unfamiliar, 2024-38476 is part of a batch of vulnerabilities Orange Tsai announced at Black Hat that year. You can (and very much should) read more about them here: https://blog.orange.tw/posts/2024-08-confusion-attacks-en/ [†] This is extremely good (and elegant) vulnerability research. It's also very situational. Lee reports that 38476 "could take over your server". Could it? Did Lee check? 38476 is a second-order vulnerability that pivots CRLF injection in another vulnerable application to an Apache handler override (just read it, it's fucking awesome). If you've got `mod_proxy` enabled, you've got a decent shot at SSRF with it --- SSRF is game-over on a corporate network, but situational when the target is a hobby server. Otherwise, the most likely outcome of it is being able to dump source code (by rewiring the request handling of something from, say, PHP back to HTML). The RCE's on these…