0day on lemons lab https://vrechson.github.io/categories/0day/ Recent content in 0day on lemons lab Hugo -- gohugo.io en-us Sat, 29 May 2021 14:09:33 -0300 Pwn2win 2021 Small Talk: Write-Up https://vrechson.github.io/posts/small-talk-writeup/ Sat, 29 May 2021 14:09:33 -0300 https://vrechson.github.io/posts/small-talk-writeup/ <p>From a race condition in postMessage to <a href="https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf">prototype pollution</a>. In this writeup, I will explain how to abuse a wrong fix in the <a href="https://github.com/robinvdvleuten/shvl">shvl library</a> to achive XSS using <a href="https://www.npmjs.com/package/@popperjs/core">Popper.js</a> and solve the &ldquo;Small talk&rdquo; challenge in Pwn2Win 2021.</p> Pwn2win 2020 Watchers: Write-Up https://vrechson.github.io/posts/watchers-writeup/ Wed, 03 Jun 2020 14:09:33 -0300 https://vrechson.github.io/posts/watchers-writeup/ <p>Hi folks, this is a write up for my challenge in this year&rsquo;s Pwn2Win edition, the environment docker is available at <a href="https://github.com/pwn2winctf/challenges-2020/tree/master/web-Watchers">pwn2win repository</a>, hope you enjoy!</p>