Security research, CTF write-ups and offensive tooling notes.https://34zy.red/en-ushttps://34zy.red/writeups/cross-domain-idor-mass-disclosure-2026/https://34zy.red/writeups/cross-domain-idor-mass-disclosure-2026/A server-side authorization failure allowed an authenticated low-privilege user to enumerate records outside the assigned domain.Tue, 06 Oct 2026 00:00:00 GMThttps://34zy.red/writeups/evse-jtag-reflash-2026/https://34zy.red/writeups/evse-jtag-reflash-2026/Hardware debug access and unauthenticated control commands combined into a full firmware reprogramming and control-plane risk.Tue, 06 Oct 2026 00:00:00 GMThttps://34zy.red/writeups/medical-ultrasound-kiosk-boundary-2026/https://34zy.red/writeups/medical-ultrasound-kiosk-boundary-2026/A physical authenticated workflow escaped its kiosk boundary while a token parser processed data before signature verification.Tue, 06 Oct 2026 00:00:00 GMThttps://34zy.red/writeups/mobile-firebase-to-ato-2026/https://34zy.red/writeups/mobile-firebase-to-ato-2026/How embedded application secrets became a cross-system compromise path from a mobile client to cloud data and account takeover.Tue, 06 Oct 2026 00:00:00 GMThttps://34zy.red/writeups/unsigned-evse-firmware-2026/https://34zy.red/writeups/unsigned-evse-firmware-2026/An embedded charging station accepted engineering-grade firmware without a reliable authenticity and integrity chain.Tue, 06 Oct 2026 00:00:00 GMThttps://34zy.red/writeups/saml-replay-auth-bypass/https://34zy.red/writeups/saml-replay-auth-bypass/A simple SAML assertion replay attack that bypasses WordPress authentication, leveraging the WP Simple SAML plugin and an insecure assertion storage.Mon, 14 Sep 2026 00:00:00 GMThttps://34zy.red/writeups/enterprise-idor-impersonation-2025/https://34zy.red/writeups/enterprise-idor-impersonation-2025/Object identifiers and an impersonation workflow were not consistently bound to the caller's authorization context.Sun, 07 Dec 2025 00:00:00 GMThttps://34zy.red/writeups/enterprise-upload-xss-ato-2025/https://34zy.red/writeups/enterprise-upload-xss-ato-2025/An upload filter bypass allowed active content to persist in an enterprise application and execute in a trusted user context.Sat, 06 Dec 2025 00:00:00 GMThttps://34zy.red/writeups/web-xml-entity-expansion-dos-2025/https://34zy.red/writeups/web-xml-entity-expansion-dos-2025/An XML upload path processed recursive entity declarations without safe parser limits, creating a resource-exhaustion denial of service.Fri, 05 Dec 2025 00:00:00 GMThttps://34zy.red/writeups/ad-adminsdholder-persistence-2025/https://34zy.red/writeups/ad-adminsdholder-persistence-2025/Excessive delegation on the Active Directory AdminSDHolder object created a persistence path affecting protected administrative accounts.Thu, 04 Dec 2025 00:00:00 GMThttps://34zy.red/writeups/healthtech-svg-upload-stored-xss-2025/https://34zy.red/writeups/healthtech-svg-upload-stored-xss-2025/A file-import workflow trusted client-controlled extension and content metadata, allowing an uploaded SVG to execute when later rendered.Wed, 03 Dec 2025 00:00:00 GMThttps://34zy.red/writeups/medical-safety-parameter-integrity-2025/https://34zy.red/writeups/medical-safety-parameter-integrity-2025/A privileged helper wrote safety-relevant device parameters without an integrity check, allowing local tampering with configuration values.Tue, 02 Dec 2025 00:00:00 GMThttps://34zy.red/writeups/medical-dicom-unauthenticated-dos-2025/https://34zy.red/writeups/medical-dicom-unauthenticated-dos-2025/A medical imaging service accepted deeply nested DICOM sequences without an effective parser-depth limit, allowing remote resource exhaustion.Mon, 01 Dec 2025 00:00:00 GMThttps://34zy.red/writeups/xml-entity-expansion-dos/https://34zy.red/writeups/xml-entity-expansion-dos/Finding sur un endpoint d'import XML : payload Billion Laughs encapsulé dans du JSON pour passer les filtres, résolution récursive d'entités sans borne, déni de service déclenchable par un simple compte authentifié.Tue, 01 Jul 2025 00:00:00 GMThttps://34zy.red/writeups/firebase-firestore-bac-ato-chain/https://34zy.red/writeups/firebase-firestore-bac-ato-chain/Chaîne critique sur une application mobile : credentials fixés dans l'APK, mots de passe stockés en clair, aucun contrôle d'accès par UID sur /users. Lecture de tous les comptes, ATO et accès au backend.Sun, 15 Jun 2025 00:00:00 GMThttps://34zy.red/writeups/wordpress-elementskit-missing-auth/https://34zy.red/writeups/wordpress-elementskit-missing-auth/Divulgation publique : le endpoint Mailchimp subscribe du plugin WordPress ElementsKit Lite est exposé sans authentification ni nonce, permettant l'injection non authentifiée d'abonnés à grande échelle.Sun, 15 Jun 2025 00:00:00 GMThttps://34zy.red/writeups/arm-uboot-secure-boot-uart-root/https://34zy.red/writeups/arm-uboot-secure-boot-uart-root/0-day matériel : le verified boot HAB signe le noyau mais pas les bootargs. Injection de init=/bin/bash via la console U-Boot exposée sur l'UART, shell root sans authentification.Thu, 01 May 2025 00:00:00 GMThttps://34zy.red/writeups/medical-kiosk-utilman-system/https://34zy.red/writeups/medical-kiosk-utilman-system/Finding sur un dispositif médical en mode kiosque : détournement d'Utilman via IFEO pour un shell SYSTEM pré-authentification, rendu persistant en écrivant dans la couche de commit du Unified Write Filter.Tue, 01 Apr 2025 00:00:00 GMThttps://34zy.red/writeups/docmgmt-traversal-rfi-ssrf/https://34zy.red/writeups/docmgmt-traversal-rfi-ssrf/Finding critique sur une application de gestion documentaire : un paramètre de page non validé permet la lecture de fichiers (web.config et ses credentials), l'inclusion de contenu distant, et un déni de service par SSRF récursif, sans authentification.Mon, 08 Jan 2024 00:00:00 GMThttps://34zy.red/writeups/dorksearch-reflected-xss/https://34zy.red/writeups/dorksearch-reflected-xss/Divulgation publique : entrée utilisateur réfléchie sans encodage sur Dorksearch, exécution de JavaScript arbitraire chaînée à un open redirect pour voler la session de chercheurs en sécurité.Mon, 08 Jan 2024 00:00:00 GMThttps://34zy.red/writeups/edi-stored-xss/https://34zy.red/writeups/edi-stored-xss/Finding sur une plateforme EDI : un champ de profil accepte du HTML arbitraire, stocké et réexécuté chez tout utilisateur qui consulte le profil. Vol de session automatique, propagation possible et ciblage des admins.Mon, 08 Jan 2024 00:00:00 GMThttps://34zy.red/writeups/grr-xst-xss-open-redirect/https://34zy.red/writeups/grr-xst-xss-open-redirect/Divulgation publique : méthode HTTP TRACE activée (XST) permettant de lire des en-têtes normalement masqués, combinée à un XSS reflété et un open redirect pour le vol de session et le phishing.Mon, 08 Jan 2024 00:00:00 GMThttps://34zy.red/writeups/rh-login-reflected-xss/https://34zy.red/writeups/rh-login-reflected-xss/Finding sur une application RH : le paramètre de redirection de la page de connexion est réinjecté sans encodage dans un champ caché, permettant l'exécution de JavaScript et le vol de credentials par phishing.Mon, 08 Jan 2024 00:00:00 GMT