Top all-time · #9659
ziot
Personal blog · buer.haussecurityprogramming
ziot is a personal blog at buer.haus about security and programming. Since 2017, 8 different Hacker News readers have linked it 8 times, most often “Airbnb – Ruby on Rails String Interpolation Led to Remote Code Execution”. The last post was in 2024, but the archive is still widely read.
Too few sampled comments (2) to say how often HN recommends it.?
Why HN links it
Web application security research, including a 2019 post on a file-write attack via LibreOffice file parsing in Slack and other sites. One commenter lists it among favourite appsec blogs.
Summarised by Claude from a sample of 2 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Airbnb – Ruby on Rails String Interpolation Led to Remote Code Execution2 people · 2 mentions · first linked 2017-03-13
What Hacker News says?
Interesting. I published research on this style of attack in 2019 when I found Slack and a few other big websites vulnerable to it. In their cases, LibreOffice was passing the files off to specific parsers based on magic headers rather than file extensions. https://buer.haus/2019/10/18/a-tale-of-exploitation-in-sprea... We published a PoC for file write as part of our research and bug bounty submissions: https://gis…
Comment linking /2019/10/18/a-tale-of-exploitation-in-spreadsheet-file-conversions/
on “4chan Sharty Hack And Janitor Email Leak”Submitted Airbnb Audit Results as a story · 50 points
HN discussionAside from Filedescriptor's work, here are some of my favourite blogs in the web application security space (not an exhaustive list): - https://blog.orange.tw/ - https://ngailong.wordpress.com/ - https://whitton.io/ - https://sakurity.com/blog - https://homakov.blogspot.com/ - https://buer.haus/ - https://philippeharewood.com/ - https://portswigger.net/research - https://gerbenjavado.com/ - https://medium.com/@intid…
Comment linking /
on “Google YOLO clickjacking (2018)”Submitted Reversing and Tooling a Signed Request Hash in Obfuscated JavaScript as a story · 48 points
HN discussionSubmitted Airbnb – Ruby on Rails String Interpolation Led to Remote Code Execution as a story · 3 points
HN discussionSubmitted Hacking Montecrypto Crypto Puzzle Game to Win 1BTC Prize as a story · 2 points
HN discussionSubmitted Remote Code Execution on Airbnb via Rails String Interpolation as a story · 2 points
HN discussionSubmitted We won $20k solving coin_artist's $coin puzzle as a story · 1 points
HN discussion