Blog about ethical hacking and vulnerability research by Valentin Lobsteinhttps://chocapikk.com/https://chocapikk.com/posts/2026/monstaftp-ssrf-ipv6-blocklist-bypass/https://chocapikk.com/posts/2026/monstaftp-ssrf-ipv6-blocklist-bypass/An unauthenticated SSRF in Monsta FTP 2.14.4. The product ships a real SSRF blocklist that correctly blocks 127.0.0.1, 169.254.169.254 and RFC1918, then forgets that ::ffff:169.254.169.254 is the exact same host. One missing normalization, both gates bypassed, and a static AAAA record is all it takes.Mon, 13 Jul 2026 22:00:00 GMThttps://chocapikk.com/posts/2026/gen3c-pickle-rce/https://chocapikk.com/posts/2026/gen3c-pickle-rce/A critical unauthenticated RCE vulnerability in NVIDIA's GEN3C project. Two FastAPI inference endpoints deserialize raw HTTP POST bodies with pickle.loads() without any authentication, giving instant code execution to anyone with network access.Mon, 06 Jul 2026 00:00:00 GMThttps://chocapikk.com/posts/2026/fossbilling-unauth-rce/https://chocapikk.com/posts/2026/fossbilling-unauth-rce/A missing throw keyword in FOSSBilling's API router exposes the entire admin surface to unauthenticated attackers. Combined with an unsandboxed Twig SSTI that leaks the full DI container, this leads to arbitrary SQL execution, admin takeover, and unauthenticated RCE via malicious extension installation.Sun, 05 Jul 2026 22:00:00 GMThttps://chocapikk.com/posts/2026/netbox-export-template-rce/https://chocapikk.com/posts/2026/netbox-export-template-rce/A Jinja2 sandbox bypass in NetBox allows low-privilege users to achieve remote code execution via the RenderTemplateMixin environment_params finalize parameter, affecting both ExportTemplate and ConfigTemplate.Thu, 30 Apr 2026 22:00:00 GMThttps://chocapikk.com/posts/2026/opencats-installer-rce/https://chocapikk.com/posts/2026/opencats-installer-rce/Unauthenticated remote code execution in OpenCATS through unsanitized input in the installer AJAX endpoint, allowing PHP code injection into config.php.Mon, 27 Apr 2026 22:00:00 GMThttps://chocapikk.com/posts/2026/ktransformers-pickle-rce/https://chocapikk.com/posts/2026/ktransformers-pickle-rce/A critical unauthenticated RCE vulnerability in ktransformers' balance_serve backend. A ZMQ ROUTER socket binds to all interfaces and proxies messages to worker threads that deserialize them with pickle.loads() - no authentication, no validation.Wed, 22 Apr 2026 22:00:00 GMThttps://chocapikk.com/posts/2026/lerobot-pickle-rce/https://chocapikk.com/posts/2026/lerobot-pickle-rce/A critical unauthenticated RCE vulnerability in HuggingFace's LeRobot project (21.5k stars). The gRPC PolicyServer deserializes attacker-controlled data with pickle.loads() in two RPC handlers, allowing instant code execution without authentication.Wed, 22 Apr 2026 22:00:00 GMThttps://chocapikk.com/posts/2026/tensorwatch-pickle-rce/https://chocapikk.com/posts/2026/tensorwatch-pickle-rce/A local code execution vulnerability in Microsoft's tensorwatch. Calling tw.Watcher() - the first line in every README example - silently creates a ZMQ REP socket on localhost that deserializes incoming messages with pickle.loads(). Any local user on the same machine gets code execution.Wed, 22 Apr 2026 22:00:00 GMThttps://chocapikk.com/posts/2026/instagram-seen-is-a-lie/https://chocapikk.com/posts/2026/instagram-seen-is-a-lie/Instagram's 'seen' indicator is a separate GraphQL call that any browser extension can block. It's been this way since 2019. Now Meta wants to charge $2/month for it.Fri, 17 Apr 2026 22:00:00 GMThttps://chocapikk.com/posts/2026/contributing-to-metasploit/https://chocapikk.com/posts/2026/contributing-to-metasploit/68 modules in 2.5 years. Here's what the official docs don't tell you about writing Metasploit modules - from finding targets to surviving code review.Thu, 16 Apr 2026 22:00:00 GMThttps://chocapikk.com/posts/2026/swap-files-in-git/https://chocapikk.com/posts/2026/swap-files-in-git/Swap files from Vim and nano can leak usernames, hostnames, and sensitive data in git repos. Even after deletion, the blob stays in git history forever. Here's how to find them and how to actually clean them.Wed, 15 Apr 2026 22:00:00 GMThttps://chocapikk.com/posts/2026/cewlai-ai-powered-wordlist-generator/https://chocapikk.com/posts/2026/cewlai-ai-powered-wordlist-generator/CeWL has been the default wordlist generator for 10 years. CeWL AI crawls HTTP, FTP, SFTP, SMB, and S3 targets, feeds context to an LLM, scans for secrets with 800+ trufflehog detectors, and dumps files - all from one binary.Mon, 13 Apr 2026 22:00:00 GMThttps://chocapikk.com/posts/2026/xboard-v2board-account-takeover/https://chocapikk.com/posts/2026/xboard-v2board-account-takeover/The loginWithMailLink endpoint in Xboard and V2Board returns the magic login link in the HTTP response body, allowing unauthenticated attackers to take over any account - including admin.Wed, 08 Apr 2026 22:00:00 GMThttps://chocapikk.com/posts/2026/dumping-postgresql-without-credentials/https://chocapikk.com/posts/2026/dumping-postgresql-without-credentials/A technique for extracting PostgreSQL data through arbitrary file read vulnerabilities - without credentials, without SQL access, without knowing the schema. Full auto-discovery via system catalogs.Mon, 06 Apr 2026 22:00:00 GMThttps://chocapikk.com/posts/2026/windfall-nextcloud-flow-windmill-rce/https://chocapikk.com/posts/2026/windfall-nextcloud-flow-windmill-rce/Critical vulnerabilities in Windmill: unauthenticated path traversal leading to RCE, plus an authenticated SQL injection enabling full privilege escalation (operator → super admin → root RCE). Affects standalone Windmill and Nextcloud Flow.Mon, 06 Apr 2026 22:00:00 GMThttps://chocapikk.com/posts/2026/from-zero-to-exploit-dev/https://chocapikk.com/posts/2026/from-zero-to-exploit-dev/How I went from knowing nothing about computers in 2020 to writing exploits. No magic, no shortcuts, just the process.Fri, 03 Apr 2026 08:00:00 GMThttps://chocapikk.com/posts/2026/pwncat-busybox-pty/https://chocapikk.com/posts/2026/pwncat-busybox-pty/Every shell handler fails on busybox/Alpine. No script, no python, no PTY. I fixed it with 80 lines of C and a base64 upload.Wed, 01 Apr 2026 21:00:00 GMThttps://chocapikk.com/posts/2026/reverse-engineering-ite8910-keyboard-rgb/https://chocapikk.com/posts/2026/reverse-engineering-ite8910-keyboard-rgb/How I reverse-engineered the complete USB HID protocol of the ITE 8910 keyboard controller from a Windows DLL and .NET executable, and contributed per-key RGB support with 14 modes to OpenRGB - the first implementation for this chip on Linux.Thu, 26 Mar 2026 22:00:00 GMThttps://chocapikk.com/posts/2026/omnigen2-pickle-rce/https://chocapikk.com/posts/2026/omnigen2-pickle-rce/A critical unauthenticated RCE vulnerability in OmniGen2's reward server infrastructure. The Flask-based servers deserialize raw HTTP POST bodies with pickle.loads() without any authentication, giving instant code execution to anyone with network access.Tue, 17 Mar 2026 22:00:00 GMThttps://chocapikk.com/posts/2026/sglang-pickle-rce/https://chocapikk.com/posts/2026/sglang-pickle-rce/A critical unauthenticated RCE vulnerability in sglang's ZMQ transport layer for disaggregated serving. ZMQ PULL sockets bind to all interfaces and deserialize messages with pickle.loads() - no auth, no validation. Distinct from CVE-2025-10164 which only covers the HTTP API.Tue, 17 Mar 2026 22:00:00 GMThttps://chocapikk.com/posts/2026/opendcim-sqli-to-rce/https://chocapikk.com/posts/2026/opendcim-sqli-to-rce/Three chained vulnerabilities in openDCIM turn a missing authorization check into unauthenticated remote code execution on Docker deployments.Thu, 26 Feb 2026 22:00:00 GMThttps://chocapikk.com/posts/2026/spip-plugins-vulnerabilities/https://chocapikk.com/posts/2026/spip-plugins-vulnerabilities/Five vulnerabilities across SPIP plugins: two SQL injections, two RCE (one unauth, one auth), and reflected XSS. Same template engine, same mistakes, different entry points.Tue, 24 Feb 2026 22:00:00 GMThttps://chocapikk.com/posts/2026/spip-saisies-rce/https://chocapikk.com/posts/2026/spip-saisies-rce/From VulnCheck advisory to working PoC in 30 minutes. Full AI-assisted reversal of CVE-2025-71243, an unauthenticated PHP code injection in SPIP's Saisies plugin affecting versions 5.4.0 through 5.11.0.Wed, 18 Feb 2026 22:00:00 GMThttps://chocapikk.com/posts/2026/majordomo-revisited/https://chocapikk.com/posts/2026/majordomo-revisited/In 2023 I found CVE-2023-50917 in MajorDoMo. In 2026, AI agents found 8 more bugs I completely missed.Tue, 17 Feb 2026 23:00:00 GMThttps://chocapikk.com/posts/2026/android-a11y-god-mode/https://chocapikk.com/posts/2026/android-a11y-god-mode/How one API designed for disability access became the foundation of a $145M surveillance industry. A proof-of-concept implant demonstrates the full attack chain: silent permission escalation in 2.4 seconds, contextual keylogging, see-through overlays, network toggle, self-hiding persistence, and an embedded Linux terminal with apt - all from a single accessibility toggle, no root required.Sun, 15 Feb 2026 01:00:00 GMThttps://chocapikk.com/posts/2026/lightllm-pickle-rce/https://chocapikk.com/posts/2026/lightllm-pickle-rce/CVE-2026-26220: A critical unauthenticated RCE vulnerability in LightLLM's PD disaggregation system. Two WebSocket endpoints deserialize binary frames with pickle.loads() without authentication, and the server explicitly refuses to bind to localhost - it's always network-exposed.Wed, 11 Feb 2026 01:00:00 GMThttps://chocapikk.com/posts/2026/manga-image-translator-pickle-rce/https://chocapikk.com/posts/2026/manga-image-translator-pickle-rce/A critical unauthenticated RCE vulnerability in manga-image-translator. Two FastAPI endpoints deserialize raw HTTP POST bodies with pickle.loads(), and the nonce-based authentication is bypassed because the default value is an empty string - which is falsy in Python.Tue, 10 Feb 2026 23:00:00 GMThttps://chocapikk.com/posts/2026/how-internet-scanners-work/https://chocapikk.com/posts/2026/how-internet-scanners-work/A deep dive into how internet-wide scanners like Shodan, Censys, and nmap actually identify services. Spoiler: there's nothing passive about it.Sun, 08 Feb 2026 01:00:00 GMThttps://chocapikk.com/posts/2025/avideo-security-vulnerabilities/https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/A comprehensive security audit of AVideo revealing 10 vulnerabilities including a critical unauthenticated RCE that chains cryptographic weaknesses, predictable salt bruteforce, and an eval() vulnerability to achieve complete server compromise in under 10 seconds.Thu, 18 Dec 2025 22:00:00 GMThttps://chocapikk.com/posts/2025/streama-path-traversal-ssrf/https://chocapikk.com/posts/2025/streama-path-traversal-ssrf/A critical vulnerability in Streama allows authenticated users to write arbitrary files through a combination of Server-Side Request Forgery (SSRF) and Path Traversal. This write-up covers the root cause analysis, exploitation flow, and the vendor's comprehensive fix.Thu, 18 Dec 2025 16:00:00 GMThttps://chocapikk.com/posts/2025/setting-up-giscus-comments/https://chocapikk.com/posts/2025/setting-up-giscus-comments/How I set up Giscus for ad-free blog comments using GitHub Discussions, avoiding Disqus due to ads and other concerns.Fri, 14 Nov 2025 12:00:00 GMThttps://chocapikk.com/posts/2025/when-a-wifi-name-gives-you-root-part-two/https://chocapikk.com/posts/2025/when-a-wifi-name-gives-you-root-part-two/Deep dive into bind‐shell deployment, payload experiments, and a new ‘time_conf’ primitive for stealthy, persistent root access without reboot or UI lockup.Wed, 06 Aug 2025 12:00:00 GMThttps://chocapikk.com/posts/2025/when-a-wifi-name-gives-you-root/https://chocapikk.com/posts/2025/when-a-wifi-name-gives-you-root/How a €5 MT02 Wi-Fi repeater let me pop a root shell with nothing more than a cheeky SSID.Sun, 03 Aug 2025 12:00:00 GMThttps://chocapikk.com/posts/2025/completepbx/https://chocapikk.com/posts/2025/completepbx/Several critical vulnerabilities discovered in Xorcom CompletePBX 5.2.35, including authenticated file disclosure, remote command execution as root, file deletion, and reflected XSS. This write-up details the black-box methodology, PoCs, and patch timeline.Sun, 22 Jun 2025 02:04:00 GMThttps://chocapikk.com/posts/2025/patchstack-open-contributions/https://chocapikk.com/posts/2025/patchstack-open-contributions/Two missing checks inside the Open Contributions plugin let any fresh WordPress subscriber escalate to contributor and read arbitrary files — including the CTF flag — without brute-forcing a thing.Thu, 05 Jun 2025 19:30:00 GMThttps://chocapikk.com/posts/2025/helping-friends-cybersecurity/https://chocapikk.com/posts/2025/helping-friends-cybersecurity/Fri, 23 May 2025 12:30:00 GMThttps://chocapikk.com/posts/2025/bdrsuite/https://chocapikk.com/posts/2025/bdrsuite/Analysis of two unauthenticated XSS vulnerabilities and silently patched issues in Vembu BDRSuite up to version 7.6.0. Includes PoCs, API traces, patch timeline and commentary.Tue, 15 Apr 2025 17:00:00 GMThttps://chocapikk.com/posts/2025/wpprobe/https://chocapikk.com/posts/2025/wpprobe/WPProbe is a lightweight tool that leverages the WordPress REST API to detect installed plugins passively. This post covers its design, use cases, technical constraints, and how it helps avoid noisy scans.Sat, 12 Apr 2025 19:13:00 GMThttps://chocapikk.com/posts/2025/magnusbilling/https://chocapikk.com/posts/2025/magnusbilling/Two Stored XSS vulnerabilities discovered in MagnusBilling 7.x, including one unauthenticated, initially spotted during a CTF. This write-up covers the discovery process, PoCs, impact, patch timeline, and thoughts on the overall codebase.Fri, 21 Mar 2025 16:30:00 GMThttps://chocapikk.com/posts/2025/s1nk/https://chocapikk.com/posts/2025/s1nk/An in-depth forensic analysis of how a seemingly legitimate Proof-of-Concept (PoC) for CVE-2020-35489 turned out to be a cleverly disguised malware. This blog post details the attack vector, payload deobfuscation, Indicators of Compromise (IoCs), and the steps taken to analyze and neutralize the threat.Fri, 07 Feb 2025 12:35:21 GMThttps://chocapikk.com/posts/2024/svgtranslate/https://chocapikk.com/posts/2024/svgtranslate/Analysis of Unauthenticated Remote Command Execution Vulnerability in Wikimedia/svgtranslateThu, 23 May 2024 13:43:51 GMThttps://chocapikk.com/posts/2024/mocodo-vulnerabilities/https://chocapikk.com/posts/2024/mocodo-vulnerabilities/A Detailed Analysis of Two Critical Remote Command Execution Vulnerabilities in Mocodo: Implications and FixesThu, 09 May 2024 11:10:00 GMThttps://chocapikk.com/posts/2024/cve-2024-31819/https://chocapikk.com/posts/2024/cve-2024-31819/A technical analysis of CVE-2024-31819, uncovering a critical Remote Code Execution vulnerability in the AVideo platform's WWBNIndex plugin.Tue, 09 Apr 2024 18:35:21 GMThttps://chocapikk.com/posts/2024/derbynet-vulnerabilities/https://chocapikk.com/posts/2024/derbynet-vulnerabilities/A Comprehensive Analysis of Ten Critical Vulnerabilities in DerbyNet v9.0: From Cross-Site Scripting to SQL InjectionWed, 03 Apr 2024 18:35:21 GMThttps://chocapikk.com/posts/2023/cve-2023-50917/https://chocapikk.com/posts/2023/cve-2023-50917/Deep Dive: CVE-2023-50917 - Unmasking an Unauthenticated Remote Code Execution Flaw in MajorDoMo's Thumb ModuleMon, 18 Dec 2023 08:49:15 GMThttps://chocapikk.com/posts/2023/n00bzctf2023-conditions/https://chocapikk.com/posts/2023/n00bzctf2023-conditions/In this article, we will explore the step-by-step walkthrough of the Web challenge 'Conditions' presented at n00bzCTF 2023.Sun, 11 Jun 2023 16:55:00 GMThttps://chocapikk.com/posts/2023/n00bzctf2023-ezrev/https://chocapikk.com/posts/2023/n00bzctf2023-ezrev/In this article, we will explore the step-by-step walkthrough of the Reverse challenge 'EZrev' presented at n00bzCTF 2023.Sun, 11 Jun 2023 16:55:00 GMThttps://chocapikk.com/posts/2023/n00bzctf2023-mypin/https://chocapikk.com/posts/2023/n00bzctf2023-mypin/In this article, we will explore the step-by-step walkthrough of the Reverse challenge 'MyPin' presented at n00bzCTF 2023.Sun, 11 Jun 2023 16:55:00 GMThttps://chocapikk.com/posts/2023/tjctf2023-gish/https://chocapikk.com/posts/2023/tjctf2023-gish/In this article, we will explore the step-by-step walkthrough of the MISC challenge 'Gish' presented at tjCTF 2023.Sun, 28 May 2023 00:02:50 GMThttps://chocapikk.com/posts/2023/fcsc2023-lapin-blanc/https://chocapikk.com/posts/2023/fcsc2023-lapin-blanc/In this article, we will explore the step-by-step walkthrough of the 'Lapin Blanc' challenge presented at FCSC 2023.Sun, 30 Apr 2023 20:36:07 GMThttps://chocapikk.com/posts/2023/fcsc2023-uid/https://chocapikk.com/posts/2023/fcsc2023-uid/In this article, we will explore the step-by-step walkthrough of the 'uid' challenge presented at FCSC 2023.Sun, 30 Apr 2023 20:36:07 GMThttps://chocapikk.com/posts/2023/fcsc2023-zero-pointe/https://chocapikk.com/posts/2023/fcsc2023-zero-pointe/In this article, we will explore the step-by-step walkthrough of the 'Zéro Pointé' challenge presented at FCSC 2023.Sun, 30 Apr 2023 20:36:07 GMThttps://chocapikk.com/posts/2023/tamuctf2023-connect/https://chocapikk.com/posts/2023/tamuctf2023-connect/In this article, we will explore the step-by-step walkthrough of the Web challenge 'Connect' presented at TamuCTF 2023.Sun, 30 Apr 2023 20:36:07 GMThttps://chocapikk.com/posts/2023/tamuctf2023-gamer-redux/https://chocapikk.com/posts/2023/tamuctf2023-gamer-redux/In this article, we will explore the step-by-step walkthrough of the MISC challenge 'Gamer Redux' presented at TamuCTF 2023.Sun, 30 Apr 2023 20:36:07 GMThttps://chocapikk.com/posts/2023/fcsc2023-enisa-flag-store-1/https://chocapikk.com/posts/2023/fcsc2023-enisa-flag-store-1/In this article, we will explore the step-by-step walkthrough of the 'ENISA Flag Store 1/2' challenge presented at FCSC 2023.Sun, 30 Apr 2023 20:36:07 GMThttps://chocapikk.com/posts/2023/tamuctf2023-logical/https://chocapikk.com/posts/2023/tamuctf2023-logical/In this article, we will explore the step-by-step walkthrough of the Web challenge 'Logical' presented at TamuCTF 2023.Sun, 30 Apr 2023 20:36:07 GMThttps://chocapikk.com/posts/2023/caf2023-babyrev/https://chocapikk.com/posts/2023/caf2023-babyrev/In this article, we will explore the step-by-step walkthrough of the Reverse challenge 'BabyRev' presented at the CTF Cyber Africa Forum 2023.Tue, 18 Apr 2023 19:02:57 GMThttps://chocapikk.com/posts/2023/caf2023-tower-of-encryption/https://chocapikk.com/posts/2023/caf2023-tower-of-encryption/In this article, we will explore the walkthrough of the Cryptography challenge 'Tower of Encryption' presented at the CTF Cyber Africa Forum 2023.Tue, 18 Apr 2023 12:22:07 GMThttps://chocapikk.com/posts/2023/caf2023-it-administrator-credentials/https://chocapikk.com/posts/2023/caf2023-it-administrator-credentials/In this article, we will explore the walkthrough of the Steganography challenge 'IT Administrator Credentials' presented at the CTF Cyber Africa Forum 2023.Tue, 18 Apr 2023 11:42:57 GMThttps://chocapikk.com/posts/2023/caf2023-i-warn-you/https://chocapikk.com/posts/2023/caf2023-i-warn-you/In this article, we will explore the step-by-step walkthrough of the Digital Forensic challenge 'I Warn You!' presented at the CTF Cyber Africa Forum 2023.Tue, 18 Apr 2023 10:27:28 GMThttps://chocapikk.com/posts/2023/caf2023-baby-hacker-big-brother/https://chocapikk.com/posts/2023/caf2023-baby-hacker-big-brother/In this article, we will explore the step-by-step walkthrough of the Web challenge 'Baby Hacker Big Brother' presented at the CTF Cyber Africa Forum 2023.Mon, 17 Apr 2023 17:46:48 GMThttps://chocapikk.com/posts/2023/faille_idor/https://chocapikk.com/posts/2023/faille_idor/In this article, we will explore the Insecure Direct Object Reference (IDOR) vulnerability, a common security vulnerability in web applications that can have significant impacts on data confidentiality, integrity, and availability.Fri, 07 Apr 2023 15:40:43 GMThttps://chocapikk.com/posts/2023/utilisation_socket_python/https://chocapikk.com/posts/2023/utilisation_socket_python/In this article, we will explore how to use Python sockets in the context of offensive securityFri, 07 Apr 2023 07:37:40 GMThttps://chocapikk.com/posts/2023/faille_upload/https://chocapikk.com/posts/2023/faille_upload/This article presents the various variants of the 'upload vulnerability' and how to protect against them.Wed, 05 Apr 2023 14:21:38 GMThttps://chocapikk.com/posts/2023/elevation_privileges_unix_crontab/https://chocapikk.com/posts/2023/elevation_privileges_unix_crontab/This article demonstrates how to exploit privilege escalation from insecure scheduled tasks.Tue, 04 Apr 2023 14:06:19 GMThttps://chocapikk.com/posts/2023/injection_de_commande/https://chocapikk.com/posts/2023/injection_de_commande/This article explains what command injection is, how to exploit it, and how to reduce the risks of this attack.Tue, 04 Apr 2023 13:20:38 GMThttps://chocapikk.com/posts/2023/configurer_un_serveur_apache/https://chocapikk.com/posts/2023/configurer_un_serveur_apache/This post explains how to secure an Apache server with SSL/TLS hardening and best practices.Mon, 03 Apr 2023 14:52:33 GMThttps://chocapikk.com/posts/2023/creer_un_dork_shodan/https://chocapikk.com/posts/2023/creer_un_dork_shodan/This article explains how to create a Shodan dork based on the `favicon.ico` file using MMH3 hashMon, 03 Apr 2023 12:55:21 GMThttps://chocapikk.com/posts/2022/oteria_cyber_cup_2022/https://chocapikk.com/posts/2022/oteria_cyber_cup_2022/In this post, I will write 2 writeups from the 'Applicatif' category, 1 and 2, both being Easy level Buffer Overflow challenges.Mon, 03 Apr 2023 12:52:19 GMT