Nitro v3 interpolates plugin file paths directly into ES import specifiers with no sanitization. A single " character in a path injects arbitrary JavaScript into your production server bundle, code that persists across package removals, lockfile cleanups, and audit passes. This post covers the vulnerability, the supply chain delivery mechanism, a working PoC, and why the vendor's "working as intended" closure misses the point.

As organisations mature in their Cyber Security capabilities they quickly notice that structure and overlap are just around the corner. In this blogpost I let my mind wander on how larger organisations can implement and develop a Offensive Security Capability as next step in their Cyber Security strategy.

As the journey continues through the various Layers of the Abyss we are still wandering around in the first layer "Edge of the Abyss". The third post of my Journey into the World of Offensive Development and Reverse Engineering, this time it's about the process injection Early Bird technique.

As the journey continues through the various Layers of the Abyss we are now visiting the the first layer "Edge of the Abyss". The second post of my Journey into the World of Offensive Development and Reverse Engineering, this time it's about process injection.

The start of my Journey into the World of Offensive Development and Reverse Engineering

A full writeup of the Ninja Hacker Academy

A review of the current state of OffSec's PEN300 Course and Exam.