Flomb's Avatar

Flomb

@fl0mb.bsky.social

blog.flomb.net

73 Followers  |  904 Following  |  2 Posts  |  Joined: 02.12.2024  |  1.581

Latest posts by fl0mb.bsky.social on Bluesky

Playing with HTTP/2 CONNECT In HTTP/1, the CONNECT method instructs a proxy to establish a TCP tunnel to a requested target. Once the tunnel is up, the proxy blindly forwards raw traffic in both directions. This mechanism is mos...

blog.flomb.net/posts/http2c...

15.09.2025 17:49 β€” πŸ‘ 0    πŸ” 0    πŸ’¬ 0    πŸ“Œ 0
Preview
FAUST CTF 2025 | FAUST CTF 2025 FAUST CTF 2025 is an online attack-defense CTF competition run by FAUST, the CTF team of Friedrich-Alexander University Erlangen-NΓΌrnberg

We always love a good challenge. That’s why we’re sponsoring the 10th FAUST CTF. Game on at 2025.faustctf.net

28.08.2025 12:22 β€” πŸ‘ 7    πŸ” 6    πŸ’¬ 0    πŸ“Œ 0
Preview
OBS WebSocket to RCE | Jorian Woltjer Disabling password authentication of your OBS WebSocket server can have devastating consequences. We'll attack from the browser to construct an RCE payload on Windows formed from the pixels of an imag...

Just pushed a new frontend for my site, and a new post!
This one's about an tricky file write vulnerability on Windows in OBS. By crafting an image with very specific pixels, we can plant a backdoor on your PC all from an attacker's site by misconfiguring:
jorianwoltjer.com/blog/p/resea...

05.06.2025 18:48 β€” πŸ‘ 5    πŸ” 2    πŸ’¬ 1    πŸ“Œ 0
MrBruh's Epic Blog One-Click RCE in ASUS’s Preinstalled Driver Software Introduction This story begins with a conversation about new PC parts. After ignoring the advice from my friend, I bought a new ASUS motherboard fo...

One-Click RCE in ASUS’s Preinstalled Driver Software
mrbruh.com/asusdriverhub/

11.05.2025 05:07 β€” πŸ‘ 6    πŸ” 4    πŸ’¬ 0    πŸ“Œ 0
CODE WHITE | Analyzing the Attack Surface of Ivanti's DSM Ivanti's Desktop & Server Management (DSM) product is an old acquaintance that we have encountered in numerous red team and internal assessments. The main purpose of the product is the centralized dis...

Yes, we're beating a dead horse. But that horse still runs in corporate networks - and quietly gives attackers the keys to the kingdom. We're publishing what’s long been exploitable. Time to talk about it. #DSM #Ivanti code-white.com/blog/ivanti-...

13.05.2025 06:45 β€” πŸ‘ 8    πŸ” 8    πŸ’¬ 0    πŸ“Œ 1
GFI MailEssentials - Yet Another .NET Target What is this product GFI MailEssentials all about? We’re living the future, right? So let’s ask the GFI AI.

My blog post on some vulns in GFI MailEssentials

frycos.github.io/vulns4free/2...

28.04.2025 17:34 β€” πŸ‘ 7    πŸ” 7    πŸ’¬ 0    πŸ“Œ 0
Exploiting IngressNightmare: A Deep Dive Wiz recently discovered an unauthenticated remote code execution (RCE) vulnerability in the Ingress NGINX admission controller. I found the exploit chain particularly intriguing and decided to recreat...

blog.flomb.net/posts/ingres...

31.03.2025 14:28 β€” πŸ‘ 5    πŸ” 3    πŸ’¬ 0    πŸ“Œ 0
Walkthrough 2023

Ever wondered how Kurts Maultaschenfabrikle got hacked in 2023? The full story, all technical details, out now ;-) apply-if-you-can.com/walkthrough/...

21.02.2025 10:31 β€” πŸ‘ 7    πŸ” 10    πŸ’¬ 0    πŸ“Œ 0

@fl0mb is following 20 prominent accounts