Halloween 🎃, Oktoberfest 🍺, and World Smile Day 😊 are not the only notable events happening next month… Our latest roundup of offensive security insights for CISOs, security teams and security-conscious devs begins with a reminder that 17 October is another date to mark in your calendar if you have a security role in an organisation providing critical services within the EU.

That’s the deadline by which member states must transpose the Network and Information Security (NIS) 2 Directive into national law. We’ve compiled 

10 need-to-know facts for organisations that might be affected

, which is designed to achieve “a high common level of security of network and information systems across the Union” more effectively than its 2016 predecessor, NIS 1. Or for a more in-depth explainer of NIS 2 and the implications for your SecOps strategy 

In this roundup (originally published as a LinkedIn newsletter called 

) we’d also like to flag the (fairly) recent publication of 

Gartner’s latest Hype Cycle for Security Operations

assess the maturity and value of a given security innovation

, whether it’s cyber AI assistants or pentesting-as-a-service, and their capability to adopt it. 🛠️ 

The Hype Cycle (to which no technology is seemingly immune) is visualised on two axes – mapping rising, falling then stabilising expectations of a given technology over time as reality outruns hype. The cycle always runs through five phases: innovation trigger, peak of inflated expectations, trough of disillusionment, slope of enlightenment, and plateau of productivity. It’s an interesting and valuable read from an independent, data-driven and respected market research firm. 📈

, widely considered to be one of the most talented and effective ethical hackers in the world. 👇 Nagli was speaking during his participation at our 

 recently shared his thoughts on the impressive 

 podcast, with Fredrick Lee joining co-hosts David Spark and Andy Ellis for the latest, beautifully-named episode, ‘

I Said I Was Technically a CISO, Not a Technical CISO

’ (they have form for great titles, with the previous instalment called ‘

Everyone Has a Zero-Trust Plan Until They Get Punched in the Face

Among other CISO-focused content we’ve browsed this week, notable highlights include a

interview with Sailaja Kotra-Turner, CISO and director of global infrastructure at

 (owner of Jack Daniel’s whiskey 🥃), and a piece exploring 

, for which journalist Sam Birchall spoke to a CISO and cyber firm CEO. 🤝

The continuing rise in the volume of new vulnerabilities is unsurprising, we admit – but we’ll flag it anyway! A 

 reveals that the number of new CVEs rose 43% year-on-year between H1 2023 and H1 2024, continuing the inexorable surge that began in 2017. The report also investigates trends in state-sponsored activity, new threat actor groups and why 

 are being targeted at an accelerated rate. 🧐

 on another all-too-common “clash of interpretations surrounding who reported a flaw, when it was discovered, how severe it is, and whether the resulting patch is adequate”, when it comes to coordinated vulnerability disclosure. This particular episode pertains to a ‘spoofing’ flaw fixed as a “defence-in-depth” issue in Trident, 

’s proprietary browser engine for Internet Explorer, which Trend Micro’s Zero Day Initiative (ZDI) team claims was an RCE that warranted a higher CVSS. 🔒

Other new content in our wheelhouse that might be worth a peek is a 

Inside the ‘three billion people’ data breach

Troy Hunt, founder of data breach notification site 

 and Microsoft regional director, has documented 

’, his blog post centres on National Public Data, “a data aggregator most people had never heard of where a 'threat actor' has published various partial sets of data with no clear way to attribute it back to the source. And they're already the subject of a class action”. The vendor is apparently claiming that 

 1.3 million people were affected, although Hunt discovered 134 million unique email addresses in the related data dump – which would amount to around 100 emails per individual if both of these numbers are accurate, 

We’re super-excited to break new ground next month when we run Italy’s 

 in Rome on 28 September. The identity of the organisation involved will, as usual, be kept under wraps until the event is about to begin. Learn about the 

Just in case you happen to be in the countries in question at the time, YesWeHack will also be showcasing our vulnerability management solutions at 

, (Nuremburg, Germany; 22-24 October). 📅🌍

Read this monthly roundup even sooner by subscribing to 

 – our LinkedIn newsletter curating news, insights and inspiration around offensive security topics like Bug Bounty, vulnerability disclosure and management, pentest management and attack surface protection.

Are you a bug hunter or do you have an interest in ethical hacking? Check out our ethical hacking-focused sister newsletter, 

 – offering hunting advice, interviews with hunters and CTF-style challenges, among other things.

NIS 2 in brief, security tech hype cycle, Italy’s first ever live Bug Bounty – OffSec roundup for CISOs

This article explains how to perform white-box penetration testing on a Python web application running in a Docker container. In this white-box pentest, we will go through how to debug Python in VS Code in order to track our payloads throughout the process, and understand how security filters can hide vulnerabilities in plain sight.

Improve future black-box testing with code analysis

Visual Studio Code aka VS Code (or your preferred IDE)

, you can install the Python debugger extension from the extension tab on the left-hand side. Simply search for "

Our project will use the following file structure:

Certain files are extra-important and must be added or modified. The files below contain the final file content:

This is the vulnerable Python web application that we will run in a dockerised environment.

In our supervisord.conf file the only thing we need to modify is the 

python -m debugpy --listen 0.0.0.0:5678 --wait-for-client /app/6-ssti-classic.py

 to make sure our debugger listener starts once our Docker container boots up.

This will be the configuration used to tell Visual Studio Code how to connect to the Python Debugger running in a Docker container.

As well as building the Docker image, the Dockerfile installs and activates our Python debugger inside the Docker container.

To this file we will add a network called debug-net. We will then add a static IPv4 address to our Python web application: 172.20.0.111. Finally, we will open Python's debugger port: 5678.

This setup allows us to more effectively connect and communicate with the Python debugger running in the Docker container.

To validate that our setup is working properly, we need to start our Docker container, connect to Python Debugger, set up breakpoints in Visual Studio Code and, finally, perform a request to the web application to see if the debugger stops at these breakpoints.

Usually, you want to start this command in the background (using the argument 

), but if you’re unfamiliar with Docker, I recommend running the command as it appears above so that you can see the logs. Once the Docker container has finished the build process and starts, we notice this message from our Python debugger:

This message shows that our Docker started successfully and that Python’s debugger is now listening for a connection and primed to start debugging Python.

Now let's set up some breakpoints inside the Python web application code located in Visual Studio Code!

We can set up breakpoints by clicking on the red dot that appears when you hover over the line number.

Inside VS Code, go to the debugger section on the left-side panel (shortcut: 

). Once inside the debug section, press the green arrow icon located at the top (

With the debugger in Visual Studio Code up and running and connected to Python's debugger, you should now see in the terminal that the Python web application is running.

Now our debugger is connected, it's time to perform a HTTP request to trigger the Visual Studio Code breakpoints. We can use the command line interface (CLI) tool cURL to send a GET request to our web application:

If everything goes as expected, you should not get a response back directly. Instead you should have some code highlighted inside VS Code that proves the debugger is working and that it stopped at the first breakpoint:

Now we know our setup and debugger are working as expected, it's time for the bug hunt.

As you may have already noticed, our web application is vulnerable to a server-side template injection (SSTI) vulnerability. Let’s try an SSTI payload: 

Next we analyse the request we sent containing our payload in the 

 GET parameter. In Visual Studio Code, we can see a breakpoint hit:

We then click the blue, triangular arrow at the top (the first arrow from left to right):

Take a close look at the debug side panel to the left: our payload, which was included in the GET parameter 

 Python variable. But you might also notice that the payload has been HTML-escaped – so in theory, if the web application is vulnerable to a SSTI, we should get an error.

Let's move to our next breakpoint to see what final input is given to the template engine:

, is HTML-escaped by the Python function 

And as predicted, we got a 500 server error in our HTTP response!

To confirm that the vulnerability now exists, we can use the payload 

 and see how Python reacts this time using VS Code's debugger:

Looking at our debugger result, we can see that everything looks good!

 appearing in the HTTP response from our vulnerable web application!

Now that we understand how our payload is being escaped and inserted, we can adapt the payload to exploit the web application and achieve a remote code execution (RCE)!

Because our payload is HTML-escaped before it is inserted into the template string, we cannot take advantage of quotes. And without being able to write the command as a pure string, it will be more challenging to provide a system command. Luckily, we have a solution: Read ‘

Limitations are just an illusion: Advanced server-side template exploitation with RCE everywhere

’ to learn how to achieve RCE without using quotation marks in your payload.

, which converts a hex decimal value to its string character and use this to generate a string. As an example, we can generate the 

Then we can use this string as our argument in Python's 

 function, which will execute our system command and give us RCE:

This results in a successful remote code execution on our web application!

Below are three common Python weaknesses associated with the Python programming language.

: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Although prototype pollution vulnerabilities mainly affect the JavaScript programming language, Python can contain flaws that fall into this category, namely 

: Improper Neutralisation of Special Elements Used in a Template Engine

While this vulnerability is not specifically related to Python, it is important to note that most Python template engines are very powerful. Since they typically provide the ability to run pure Python code within the template engine, there’s a particularly significant risk of high-impact vulnerabilities.

Any programming language can be vulnerable to this CWE. With Python, absolute path traversal can arise when developers use 

 insecurely. This function is often used when joining paths and filenames, but many developers don’t realise that if 

 contains a filename with a front-slash prefix such as 

, it may have unexpected and unwanted results.

As we hoped, our SSTI payload generated a HTTP response containing a 500 server error. By using the debugger, we discovered that the payload failed not because of an error in the payload itself, but because the server HTML-escaped the payload, rendering it invalid.

As a takeaway for future black-box testing, it’s worth testing out multiple payloads with various tweaks when trying to detect the same vulnerability. Deploying a wide variety of payloads is a great way of detecting possible changes from the back-end server and to avoid false negatives.

Debugging your target’s source code helps you to track executed code triggered by the client (attacker). The process we’ve detailed can optimise your testing flow and surface behaviours that help you identify how user input is being handled.

If the server HTML encodes your SSTI payload and makes it invalid in the execution process, it is important to understand how this will affect your future exploitation of the vulnerability. To this end, practising debugging and code analysis on vulnerable targets will teach you how different filters are used and how various programming languages implement protection mechanisms.

White-box penetration testing: Debugging for Python vulnerabilities

Generous bounties, technically stimulating scopes and the feel-good factor of helping to secure critical infrastructure that underpins a free and open internet – sound appealing, bug hunters?

You can enjoy these benefits by hunting on the seven (so far) public Bug Bounty Programs operated by the Sovereign Tech Fund (STF), which invests in open digital infrastructure to ensure a resilient and sustainable open source ecosystem.

Your hacking skills, together with support from the STF, are particularly invaluable to these volunteer-run open source projects, given their vital role infrastructurally or for critical dependencies. Just consider the downstream impact of the 

 to see the importance of effective vulnerability management in this realm.

Java logging framework, is now among the STF’s Bug Bounty Programs, alongside 

All seven programs are currently offering rewards up to 

 for critical vulnerabilities. High-severity flaws command bounties up to €5,000, while for medium severity it’s €3,000 and low-severity issues earn €500 rewards.

The generous bounties – among the highest on YesWeHack – reflect the unusual and challenging nature of many of the targets. Scroll down and check out these programs to see if the scopes align with your hacking expertise.

Tara Tarakiyee, a technologist at the STF, comments: 

“Our societies increasingly rely on open source software as critical infrastructure, and it takes a lot of effort to keep that infrastructure safe. Which is why STF is committed to fostering the community of security researchers looking to use their skills to secure the open source ecosystem in the public interest through programs like the 

Open-source Bug Bounty Programs from the Sovereign Tech Fund

These seven public Bug Bounty Programs are currently active. With the Sovereign Tech Fund having numerous active investments – also including Drupal, PHP, Fortran, GNU libmicrohttpd and Python Package Index – and on the lookout for more, the organisation may well be a source of new hunting opportunities in the not-too-distant future.

The site of arguably the most significant vulnerability of all time – Log4Shell – owing to its severity and the ubiquity of this Java logging framework. 

 comprises an API, its implementation, and components to facilitate deployment for various use cases.

Qualifying vulnerabilities (at the time of writing): 

log injections, log event loss, memory safety, remote code execution, deadlocks, DoS.

 for up-to-date scopes, qualifying/non-qualifying vulnerabilities and other rules.

A suite of basic building blocks for a Linux system. Among other features, 

 provides aggressive parallelisation capabilities, socket and D-Bus activation for starting services, on-demand starting of daemons, tracking of processes using Linux control groups, maintenance of mount and automount points, and implementation of transactional, dependency-based service control logic.

UEFI SecureBoot bypasses, remote code execution, remote denial of service, local and unprivileged denial of service, privilege escalation, sandboxing bypass, login prompt/password check bypass, disk encryption keys leaks, misuse of cryptographic primitives, leaking user logs to other unprivileged users, and signed dm-verity compromise.

Fully featured desktop environment and application platform for Linux. Used with the likes of Ubuntu, Fedora, RHEL and Tails and in security-critical contexts by activists, journalists, corporations and governments, among other users. The 

 Bug Bounty Program began with two critical scopes, GLib and libsoup, but there is enormous scope for growth with the GNOME desktop consisting of hundreds of modules.

Memory safety issues, denial of service, undefined behavior leading to a security vulnerability, race conditions, missing validation of untrusted inputs, privilege escalation, cryptographic problems, exfiltration of confidential material, and supply chain issues.

 is an open-source implementation of the Network Time Protocol written in Rust, with support for the Network Time Security protocol and a focus on exposing minimal attack surface.

Qualifying vulnerabilities (at the time of writing):

 Remote code execution; remote denial of service (excluding protocol limitations); privilege escalation; misuse of cryptographic primitives; and arbitrary clock modifications, using only NTS sources, controlling at most a minority of the NTS sources.

 is a JavaScript library implementing the OpenPGP standard for message encryption and signing. OpenPGP is typically used for end-to-end encrypted email, signing of git commits and software releases, and encrypted file storage, among a variety of other applications.

 Where OpenPGP.js: incorrectly encrypts a message, causing (part of) it to be decryptable by an attacker; uses an insecure algorithm (by default) to encrypt a message, causing (part of) it to be decryptable by an attacker; incorrectly decrypts or signs the message, causing (part of) the private key to be extractable by an attacker; returns unauthenticated data (by default), potentially causing EFAIL-style vulnerabilities; incorrectly verifies an invalid signature; fails to parse a compliant OpenPGP public key, possibly causing the application or user to send the message in cleartext instead.

 provides secure communication and authentication in the OpenPGP arena. “We are committed to protecting the privacy and security of our users with a particular emphasis on the most vulnerable people in our society: activists, journalists, lawyers and their clients,” reads the program introduction.

Memory safety issues, denial of service, undefined behaviour leading to a security vulnerability, injection attacks into human-readable and machine-readable output, authentication bypasses, creation of cryptographic artifacts using high-level interfaces that break or undermine the properties of cryptographic algorithms, invalid reasoning about OpenPGP certificates, exfiltration of confidential material, diversion of packet streams with respect to another major OpenPGP implementation, improper use of cryptographic primitives, and improper handling of secret key material.

 is a project to read, write and generate CycloneDX SBOMs. It comprises cyclonedx-bom, a Rust library for reading and writing CycloneDX SBOMs from/to Rust structs, and cargo-cyclonedx, a Rust application that leverages cyclonedx-bom to generate CycloneDX SBOMs for Cargo-based Rust projects.

 Remote code execution, remote denial of service, local and unprivileged denial of service, privilege escalation, memory safety issues, sandbox or security boundary bypass, arbitrary file read/write operations, code injection vulnerabilities, insecure deserialization, cryptographic implementation flaws, integrity check bypass, dependency resolution vulnerabilities, exposure of sensitive information in logs, compromise of signed SBOMs (e.g., signature verification failures), manipulation of SBOM content leading to incorrect or incomplete data, misconfiguration vulnerabilities, and insecure handling of command-line arguments and environment variables.

 invests in open digital infrastructure projects in order to strengthen open source security, resilience and technological diversity. Founded in 2022, the fund is financed – to the tune of €17 million for 2024 – by the German Federal Ministry for Economic Affairs and Climate Action.

 in 2023 to help time-poor open source maintainers prevent and patch vulnerabilities through technical debt reduction, secure code audits and Bug Bounty Programs managed by YesWeHack. 

, meanwhile, saw an initial three successful applicants – developers, contributors or maintainers – given €300,000 to spend on creating or improving developer tooling, production security mechanisms and project documentation for their Free and Open Source Software (FOSS) components over a four- or eight-month period. The Sovereign Tech Fund is also piloting a 

 under which overworked and hitherto unpaid maintainers of critical open source components will be paid for their work.

These are important initiatives when you consider how, according to 

, 96% of codebases contain open source, applications have 526 open source components on average, and 84% of codebases contain at least one open source vulnerability.

Hacking for €10k rewards and a secure open source ecosystem: Bug Bounty opportunities from the Sovereign Tech Fund

This article explains some novel techniques for exploiting 

 (SSTIs) with complex, unique payloads that leverage default methods and syntax from various 

. Even better, we will show how to do so without needing any quotation marks or extra plugins within the templates. All server-side template injection payloads detailed below can achieve 

By default, many template engines have auto-escape enabled or perform HTML escape before the template rendering process. This sometimes makes our exploitation scenario much more difficult because of quote filtering used to render string-based data. Without string-based data in some form, RCE is significantly harder to achieve for some template engines, 

 being a notable example. For others, however, exploitation remains relatively simple even without the use of quotation marks. Our 

 exploit was simplified, for instance, by the availability of the 

The goal of our research was simple: to create payloads for some of the most popular template engines with the impact being an RCE. The payloads should not rely on any resources, such as HTTP parameters, outside of the payload itself. Achieving this would ensure the payload works in as many exploitation scenarios as possible.

Our research attempted to achieve a payload in relation to our goal on the following template engines:

As we said before, all payloads use only the default functions and methods from the template engine and don’t take advantage of any quotes or resources available outside the template engine itself, such as parameters in the HTTP request. Despite these limitations, all payloads  can be used to achieved a RCE on an application vulnerable to a server-side template injection.

, the default template engine used within Flask, is very powerful since it makes it possible to write and execute pure Python code.

To write a simple string, we can write this payload (note: index values may vary):

, which contains all global variables accessible to that function. This is then converted to a string with the help of the 

 method. To build our string, we take advantage of index positions 1786 and 1788 from the converted 

 string, which finally returns the string: id.

We can now leverage this technique to build a payload that performs a remote code execution and runs system command 

A similar payload structure can be used to exploit one of the 

 that used Jinja2 as it's template engine and filtered out all quotation marks.

 is another template engine compatible with Python and is used by default by Python frameworks Pyramid and Pylons.

In Mako, a payload such as the one below will generate the string 

We can then use this crafted string within Python’s 

Although you could also use a payload like the one below, it requires the use of "less-than" (

) characters – putting it outside the scope of our research objective:

, the PHP template engine, was one of the most challenging template engines to find a working payload for. The biggest challenge of all was making a string from its built-in and default configurations. 

Fortunately, I managed to craft a payload by leveraging the 

 variable. Finally, I nested them together, which resulted in a successful payload:

I also discovered an interesting payload that takes advantage of the built-in 

This payload allows you to achieve RCE if a

 template engine has performed a double rendering process

 function to generate a string based on the Hexadecimal value. We then use the variable modifier 

 to concatenate our other generated chars and complete the string. The resulting string 

Similar to Twig, we can use the function 

 to execute our generated string and achieve RCE:

 is the default template engine for the Laravel framework. We can use the 

 function to convert hexadecimal values to characters, insert the characters into an array map, and use 

 to join all generated characters into a string.

Combined with the string generated from our previous payload, we can use 

 command, which results in remote code execution:

 is a Java-based template engine mainly used in the Grails framework. It’s a powerful engine. In Groovy, you can craft a string using either of the following methods:

 function to run the resulting string-based command as a system command:

If you prefer the payload to have no spaces, you can always use a multi comment (

 is a popular template engine used in Java-based applications and is supported by a variety of frameworks, including Spring and Apache struts.

Our efforts to generate a suitable string in FreeMarker led to the discovery of a pretty neat function: 

. This function converts int based values into a string – but not in the way you might expect from functions such as 

, etc. This is the same logic that you can see in column labels in spreadsheet applications (like Excel or Calc). The lowest allowed number is 

. There's no upper limit. If the number is 

 or less or it isn't an integer number then the template processing will be aborted with error.

So if you wanted a string that represents the letter "

", meanwhile, can be generated with the payload:

By using this method, you can build a string that can be used to create a payload such as the following, with the impact being RCE:

 is a powerful template engine that can run pure 

 code. The ability to generate a string by taking full advantage of the 

 programming language opens up a wide range of payload possibilities.

For instance, the following payload generates the string 

If you then want to run this command as a system command, you can use 

Achieving RCE in various popular template engines in this manner – with unique payloads that use only built-in methods/functions – shows just how much you can do with a program even when limited to using minimal resources.

There are still plenty of template engines that I personally have yet to investigate. For anyone interested in building on my research, I believe there are payloads following the same structure that could also achieve RCE in the template engines not covered here. I would say that is a good way to start.

 made by Hackmanit! They made the payload testing a lot easier!

Finally, I would like to thank the guys at SCH Tech for their research: 

Limitations are just an illusion - advanced server-side template exploitation with RCE everywhere

object relational mapper (ORM) leak vulnerabilities

 by Elttam kicks off our latest roundup of InfoSec news and hacking writeups.

The YesWeHack Blog

NIS 2 in brief, security tech hype cycle, Italy’s first ever live Bug Bounty – OffSec roundup for CISOs

White-box penetration testing: Debugging for Python vulnerabilities

Hacking for €10k rewards and a secure open source ecosystem: Bug Bounty opportunities from the Sovereign Tech Fund

NIS 2 in brief, security tech hype cycle, Italy’s first ever live Bug Bounty – OffSec roundup for CISOs

Limitations are just an illusion - advanced server-side template exploitation with RCE everywhere

ORM leaks, CSRF is alive, lockpicking lessons – ethical hacker news roundup

Partial SolarWinds reprieve, CrowdStrike lessons, LLM kryptonite – OffSec roundup for CISOs

Limitations are just an illusion - advanced server-side template exploitation with RCE everywhere

Dojo challenge #34 winners!

Hack Me I’m Famous #2: Louis Vuitton sets trend with first live hacking event in luxury fashion sector

White-box penetration testing with Xdebug: Debugging for PHP vulnerabilities

Dojo challenge #34 winners!

Don't wait for threats to strike

Produits

Chercheurs

Ressources

A propos

Suivez-nous