Current Research and Interests

Data Leaks

• The Mega Leak of Brazil (In Portuguese)

Web Application Security Vulnerabilities

SSJS Injection

• Time-Based PHP V8JS Injection & NoSQL/SSJS Injection (Paper)
• Testing for NoSQL injection - OWASP
• Node.Js Server-Side JavaScript Injection Detection & Exploitation

Vulnerability Research

• CVE-2014-2875 (Predictable Session ID) in CGILua
  • Lua Web Application Security Vulnerabilities
• CVE-2010-3743 (Directory Traversal) in Visual Synapse HTTP Server
  • Visual Synapse HTTP Server Directory Traversal Vulnerability
• CVE-2009-1464 (Arbitrary Command Execution via XSRF) in AAS
• CVE-2009-1465 (Undocumented Default Password) in AAS
• CVE-2009-1466 (Insecure Password Storage) in AAS
  • A-A-S (Application Access Server) Multiple Security Vulnerabilities
• CVE-2008-0409 (XSS) in HFS
• CVE-2008-0410 (Information Disclosure) in HFS
  • HFS (HTTP File Server) Template Cross-Site Scripting and Information Disclosure Vulnerabilities
• CVE-2008-0405 (Log Arbitrary File/Directory Manipulation) in HFS
• CVE-2008-0406 (Denial-of-Service) in HFS
  • HFS (HTTP File Server) Log Arbitrary File/Directory Manipulation and Denial-of-Service Vulnerabilities
• CVE-2008-0407 (Username Spoofing) in HFS
• CVE-2008-0408 (Log Forging/Injection Vulnerability) in HFS
  • HFS (HTTP File Server) Username Spoofing and Log Forging/Injection Vulnerability
• Bugtraq ID 23645 (HTML Injection) in Google Talk
  • Google Talk DXImageTransform HTML Injection Vulnerability