Year: 2019

  • Writeup: pwnable.kr “unlink”

    Pretty easy task from pwnable.kr but took me waaay too long. We’ve got here three structures allocated on the heap, which are doubly-linked in a ptalloc fashion where a chunk’s header contains a pointer to the previous chunk and to the next one. There is also an obvious overflow which presumably would allow us to…

  • Why you should not use GraphQL schema generators

    It has been quite a while since GraphQL has been introduced by Facebook, lots of tools and frameworks has appeared and are being used in the wild now. In 2017 I made an overview of the technology from the security point of view in the post “Looting GraphQL for Fun and Profit” and some of…