pentestercrab
Ruby 4.0 Universal RCE Deserialization Gadget Chain
The Sunlight CT Log
Cruising for Shells in Flowise – 6 RCEs That Rode Flowise Low and Slow
Re:Richard Dawkins concludes AI is conscious, even if it doesn't know it
on Thursday May 07, 2026 @12:06AM (#48045271)
(63 points, 4 days ago, 431 comments) https://news.ycombinator.com/item?id=47972481
When Dawkins met Claude – Could this AI be conscious?
Vulnerability in Ruby that has existed since 2002
Ruby Array Pack Bleed – Impacts Ruby 1.6.7 to 4.0.0
Inline Style Exfiltration: leaking data with chained CSS conditionals
Marshal madness: A brief history of Ruby deserialization exploits
Breaking the Sorting Barrier for Directed Single-Source Shortest Paths
Re:Google's shortened goo.gl links will stop working next month
on Friday July 25, 2025 @11:58AM (#44684668)
There seems to have been a recent uptick in phishers using goo.gl URLs. Yes, even without new URLs being accepted by registering expired domains with an old reference.
Re:Former cybersecurity chief Chris Krebs leaves SentinelOne after exe...
on Wednesday April 16, 2025 @07:32PM (#43711463)
The risky.biz podcast episode got pulled too: https://bsky.app/profile/patrick.risky.biz/post/3lmioqiobks2...
New Method to Leverage Unsafe Reflection and Deserialisation to RCE on Rails
Escaping Ruby's Gem:SafeMarshal Sandbox
Escaping Ruby's Gem:SafeMarshal Sandbox
RubyGem's Gem:SafeMarshal buffer overrun with length larger than fit into a byte
Re:Speeding up Ruby by rewriting C in Ruby
on Wednesday December 04, 2024 @10:22AM (#42318320)
Anyone interested in ruby should take a look at the blog https://nastystereo.com
CORS Vulnerabilities in Go: Vulnerable Patterns and Lessons
Shiny Vulnerabilities in R's Most Popular Web Framework
PentesterLab: Web Hacking and Security Code Review 600 exercises and 700 videos
Cross-Site Post Requests Without a Content-Type Header – CSRF Attack
Execute commands by sending JSON? Ruby deserialization vulnerabilities
JWT Libraries Block Algorithm Confusion: Key Lessons for Code Review
Chosen-Prefix Collisions on AES-Like Hashing
Re:Ruby 3.4 Universal RCE Deserialization Gadget Chain
on Monday November 25, 2024 @01:01AM (#42233644)
Once again GTFOBins[0] proving to be a valuable resource.
Ruby 3.4 Universal RCE Deserialization Gadget Chain
Re:Ruby's String Slice is Broken
on Monday November 04, 2024 @01:32AM (#42039067)
Thanks for the feedback, fixed!