npm search RCE? - Escape Sequence Injection by solidsnail in c/[email protected]
[-] [email protected] 1 points 9 months ago

That is very true.
I do think that there's more depth to it than that. For example, dealing with it on the end of the terminal will probably break compatibility, and dealing with it on the app end will require every single dev to start sanitizing this. The challenges are real.

6
npm search RCE? - Escape Sequence Injection (blog.solidsnail.com)
submitted 9 months ago by [email protected] to c/[email protected]
0 comments fedilink
5
npm search RCE? - Escape Sequence Injection (blog.solidsnail.com)
submitted 9 months ago by [email protected] to c/[email protected]
2 comments fedilink
3
It’s not a Feature, It’s a Vulnerability (blog.solidsnail.com)
submitted 9 months ago by [email protected] to c/[email protected]
0 comments fedilink

cross-posted from: https://infosec.pub/post/5707149

I talk about a report I've made to MSRC in the beginning of the year regarding vscode.

It's a bit different. There's no in depth technical stuff, because I basically just reported the feature, not a bug.

9
It’s not a Feature, It’s a Vulnerability (blog.solidsnail.com)
submitted 9 months ago by [email protected] to c/[email protected]
0 comments fedilink

I talk about a report I've made to MSRC in the beginning of the year regarding vscode.

It's a bit different. There's no in depth technical stuff, because I basically just reported the feature, not a bug.

From Terminal Output to Arbitrary Remote Code Execution by solidsnail in c/[email protected]
[-] [email protected] 1 points 1 year ago

( ͡° ͜ʖ ͡°)

From Terminal Output to Arbitrary Remote Code Execution by solidsnail in c/[email protected]
[-] [email protected] 1 points 1 year ago

Stopped you? Wdym?

6
From Terminal Output to Arbitrary Remote Code Execution (blog.solidsnail.com)
submitted 1 year ago by [email protected] to c/[email protected]
4 comments fedilink

cross-posted from: https://infosec.pub/post/2466014

This is my first write-up, on a vulnerability I discovered in iTerm2 (RCE). Would love to hear opinions on this. I tried to make the writing engaging.

3
From Terminal Output to Arbitrary Remote Code Execution (blog.solidsnail.com)
submitted 1 year ago by [email protected] to c/[email protected]
0 comments fedilink

cross-posted from: https://infosec.pub/post/2466014

This is my first write-up, on a vulnerability I discovered in iTerm2 (RCE). Would love to hear opinions on this. I tried to make the writing engaging.

7
From Terminal Output to Arbitrary Remote Code Execution (blog.solidsnail.com)
submitted 1 year ago by [email protected] to c/[email protected]
0 comments fedilink

cross-posted from: https://infosec.pub/post/2466014

This is my first write-up, on a vulnerability I discovered in iTerm2 (RCE). Would love to hear opinions on this. I tried to make the writing engaging.

7
From Terminal Output to Arbitrary Remote Code Execution (blog.solidsnail.com)
submitted 1 year ago by [email protected] to c/[email protected]
0 comments fedilink

cross-posted from: https://infosec.pub/post/2466014

This is my first write-up, on a vulnerability I discovered in iTerm2 (RCE). Would love to hear opinions on this. I tried to make the writing engaging.

3
From Terminal Output to Arbitrary Remote Code Execution (blog.solidsnail.com)
submitted 1 year ago by [email protected] to c/[email protected]
0 comments fedilink

cross-posted from: https://infosec.pub/post/2466014

This is my first write-up, on a vulnerability I discovered in iTerm2 (RCE). Would love to hear opinions on this. I tried to make the writing engaging.

6
From Terminal Output to Arbitrary Remote Code Execution (blog.solidsnail.com)
submitted 1 year ago by [email protected] to c/[email protected]
0 comments fedilink

This is my first write-up, on a vulnerability I discovered in iTerm2 (RCE). Would love to hear opinions on this. I tried to make the writing engaging.

Which browsers are best for privacy? by solidsnail in c/[email protected]
[-] [email protected] 9 points 1 year ago

I think they're lacking explanation of what the data means.

This can be very nuanced, and dependent on your goals.

For example, in the context of fingerprinting, sometimes it's better to provide fake data instead of no data, because that itself can be a unique characteristic.

Mentorship Monday - Discussions for career and learning! by solidsnail in c/[email protected]
[-] [email protected] 0 points 1 year ago

I feel like I'm a bit lacking when it comes to finding race condition vulnerabilities. Any tips on that?

solidsnail

joined 1 year ago