S
System Weakness
systemweakness.com · Group blog · on HN since 2022
System Weakness is a Medium publication of security articles on pentesting, phishing detection, privilege escalation and mobile and container security.
What HN saysHN links it for practical security how-tos, such as a Linux privilege escalation via PATH manipulation, which one commenter calls a decent security check.
16HN people shared it
4linked it in comments
15stories submitted
34story points
9 months agolast shared
2022people per year2026
Most-shared posts
- 1Give me a browser, I’ll give you a Shell1 people · 10 points · first shared 2022 · discussion on HN
- 2The Hitchhiker's Guide to Building a Distributed Filesystem in Rust1 people · 4 points · first shared 2024 · discussion on HN
- 3Give me a browser, I’ll give you a Shell1 people · 3 points · first shared 2022 · discussion on HN
- 4How to find Phishing websites with Favicon Hash1 people · 3 points · first shared 2023 · 1 comments on HN
- 5How to keep and read WhatsApp messages thats been deleted by the owners?1 people · 2 points · first shared 2023 · 1 comments on HN
- 6Analyzing Container Filesystem Isolation for Multi-Tenant Workloads1 people · 2 points · first shared 2026 · discussion on HN
- 7How to install Burp Suite certificate in an Android emulator1 people · 2 points · first shared 2023 · discussion on HN
- 8Accounts get taken over without "hacks", step by step1 people · 1 points · first shared 2026 · discussion on HN
- 9The Art of Pivoting using Socat (forward/reverse)1 people · 1 points · first shared 2026 · discussion on HN
- 10Hack Satellites1 people · 1 points · first shared 2023 · discussion on HN
- 11Give me a browser, I’ll give you a Shell1 people · 1 points · first shared 2022 · 3 comments on HN
- 12SSL Certificate Pinning on Flutter1 people · 1 points · first shared 2022 · discussion on HN
- 13How to store login credentials, the right way in Flutter1 people · 1 points · first shared 2022 · discussion on HN
- 14SSH LLM Honeypot caught a real threat actor1 people · 1 points · first shared 2025 · discussion on HN
- 15Give me a browser, I’ll give you a Shell1 people · 1 points · first shared 2022 · discussion on HN
What HN people wrote when they linked it
Terr_ · 2024-05-24
> To me the most clear-cut benefit of AI is automated content moderation.
Maybe someday but not with LLMs, which by nature do not understand who's talking, who is being quoted, and who is being falsely quoted.
> Let’s say that we have a forum where there is only one rule: You cannot talk about your favorite color.
https://systemweakness.com/attacking-large-language-models-37229085d4f…
upwardbound · 2023-10-15
This is devastating. Amazing job Riley for discovering this and thank you for being a defender of the public by warning people about this huge issue!!
I must also say that I'm saddened that OpenAI really hasn't learned any sense of caution from their poor handling of the similarly gaping security hole that is indirect prompt injection.
The image-based hidden prompt injection Riley shows here could be combined with image-based ChatGPT data exfiltration, since a user asking about images might not be surprised to see an image rendered by the chatbot in the context of "perhaps you might be interested in similar images like this."
https://systemweakness.com/new-prompt-injection-attack-on-chatgpt-web-…
Incredible work once again Riley!!
-- UpwardBound, part of the team at Preamble which first discovered direct prompt injection. (https://www.preamble.com/prompt-injection-a-critical-vulnerability-in-…
nikanj · 2025-12-10
And many things break in different, exciting ways. For example, we discovered that whilst the JVM can be configured to use system certificate store, that does not apply to websocket connections. So the product seems to be able to connect to the server, but all socket connections bork out with TLS errors.
Fun!
And so many of those products deliver broken chains, and your client needs to download more certificates transparently ( https://systemweakness.com/the-hidden-jvm-flag-that-instantly-fixes-ss… )
Double the fun!
OccamsMirror · 2024-02-26
Not bad for a security check.
https://systemweakness.com/linux-privilege-escalation-using-path-varia…