bmdyy/tudo
·1653 words·8 mins
An OSWE-style source code review of the tudo web app, ending in a single all-in-one exploit script.
OSWE
ATutor account take over using type juggling
·1138 words·6 mins
Abusing PHP loose comparison in ATutor’s password reset flow to take over an arbitrary account.