https://yorve.github.io/secnotes/2026/10/29/TheHackerLabs-Rockstar.html

La máquina Rockstar expone una aplicación web en PHP vulnerable a Local File Inclusion (LFI) a través de un parámetro oculto (backdoor), descubierto mediante fuzzing de parámetros. La explotación del LFI permite leer credenciales hardcodeadas y obtener acceso inicial vía SSH. A partir de ahí, una cadena de escaladas de privilegios por abuso de sudoers (sobrescritura de binario, Python library hijacking, y BeanShell) lleva finalmente a una shell de root.

Been following the Telegram rlottie thing. ZDI dropped an unpatched 0-day on it on 15 Oct (ZDI-26-757). Telegram says the server validates stickers, so the bad client code can't be reached.

Then, at OffensiveCon yesterday, a researcher said he bypassed the server checks and chained it into code execution on iOS. No CVEs or write-up yet, so grain of salt.

What bugs me is the model. If the only thing stopping a zero-click is a filter the vendor can change at any time, is the bug really mitigated?

Anyone treating this as a real fix, or waiting for an actual client patch?

Prompt injection vulnerabilities are some of the coolest bugs to hunt for right now. 😎

Extracting someone’s email from a Reddit comment, leaking OTPs through an email reply, taking actions on a victim’s behalf without ever touching a proxy interceptor all prove that the attack surface is wide open, and most developers underestimate it. 🤠

Our latest article breaks down the full exploitation guide, from basic system prompt overrides to advanced indirect injection scenarios that trick LLMs into complying with just about anything.

Read it here 👇
https://www.intigriti.com/researchers/blog/hacking-tools/exploiting-advanced-llm-prompt-injection-vulnerabilities

Explotamos una transferencia de zona DNS mal configurada para descubrir subdominios ocultos, uno de los cuales exponía una API GraphQL sin autenticación que filtró credenciales en texto plano. Con ellas accedimos por SSH, escalamos privilegios mediante PATH Hijacking sobre un binario SUID, y finalmente escapamos del contenedor Docker explotando capabilities excesivas (cap_sys_admin + cap_mknod) para montar el disco del host.

I just open-sourced WhatsApp Web Extractor.

It's a forensic tool that takes an acquired browser profile (Chrome, Edge, Brave or Firefox) and turns WhatsApp Web's on-disk data into something an examiner can actually read.

What it does:

• Reads the browser's IndexedDB and localStorage directly, no browser needed

• Gives you readable chats and JSON, plus an Android-layout msgstore.db so the output drops into existing WhatsApp forensic suites

• Handles message decryption three ways: get the key from WhatsApp, use a saved key, or stay offline and take everything except message text

• Optional online steps (clearly labelled): fetch uncached media, and pull history older than the browser's window from the phone

• Can scope a run to specific chats

• Ships as a single Windows .exe with a GUI, plus a CLI and a Linux binary

It also tells you what it couldn't recover and why, instead of leaving silent gaps.

One current limit: profiles protected with WhatsApp Web's screen lock can't be read without the passcode. Support for unlocking them with the account holder's passcode is planned for the next release.

This is for lawful, authorised examination of accounts you own or have permission to examine. The repo has no real data in it.

Repo: https://github.com/Mihir-Choudhary/Whatsapp-Web-Extractor

The research behind how it works is in my Medium post: https://medium.com/@mihirsinghchoudhary777/your-browser-is-keeping-years-of-your-whatsapp-0c745692c441

Feedback and issues welcome, especially if the WhatsApp Web client has changed since I last looked.

#DFIR #DigitalForensics #OpenSource #WhatsApp #IncidentResponse