Operation Coldstart
A forgotten staging box: anonymous FTP leaks the source, an allow-list that resolves to localhost turns the URL previewer into an SSRF, and a tar wildcard in a root backup cron finishes the job.
Writeups
Operation Coldstart
A forgotten staging box: anonymous FTP leaks the source, an allow-list that resolves to localhost turns the URL previewer into an SSRF, and a tar wildcard in a root backup cron finishes the job.
Operation Promotion
A robots.txt tip-off, a one-quote login bypass, and a newline in a ping box open the door; a leaked bcrypt hash and a sudo-able find close out the promotion.