15 stories

Vulnerability Research

Explore comprehensive research and analysis on vulnerabilities, exploits, and security techniques, featuring insights into SQL injection, fuzzing, CVEs, and more by ProjectDiscovery and our community.

PHP Development Server <= 7.4.21 - Remote Source Disclosure

Introduction While testing request pipelining on multiple programming language built-in servers, we observed strange behavior with PHP’s. As we delved deeper, we discovered a security bug in PHP that could expose the source code of PHP files as if they were static files rather than executing them as intended. Upon further testing, we found that the vulnerability was not present in the latest PHP release. We conducted further tests on different versions of PHP to determine when the bug was fixe

Vulnerability Research Nuclei & Templates

Abusing Reverse Proxies, Part 2: Internal Access

Introduction As seen in Part 1: Abusing Reverse Proxies: Metadata, open proxies can allow an attacker to access cloud metadata API services. However, even without metadata services available, open proxies can be a boon for an attacker. A primer on open proxy types: * Forward: typical use case is allowing private network users to access the internet via a common egress point. This allows an organization to make rules for which types of internet services are accessible to users. * Reverse:

Vulnerability Research Nuclei & Templates

Abusing Reverse Proxies, Part 1: Metadata

Introduction Many cloud service providers offer a "metadata" service on their virtual machines. These services offer sensitive details about the instance and cloud operating environment. Metadata services offer REST APIs to programmatically retrieve this data. Amazon’s AWS service defined the IMDSv1 “standard” on their EC2 instances, and since then many others have adopted this IMDSv1 scheme as well, including AWS, Google, and Azure. The services have generally settled on the IP address 169.254

Vulnerability Research Nuclei & Templates

Vulnerability Research

PHP Development Server <= 7.4.21 - Remote Source Disclosure

Abusing Reverse Proxies, Part 2: Internal Access

Abusing Reverse Proxies, Part 1: Metadata

Monitor your infrastructure

Talk to sales

Platform

Open Source

Resources

Company