https://stokreef.com/blog Writeups, exploits and bug bounty reports by Paul Stokreef (Taxanehh). en Thu, 29 Oct 2026 12:00:00 GMT https://stokreef.com/blog/invoiceplane-rate-limiter-namespace-collision https://stokreef.com/blog/invoiceplane-rate-limiter-namespace-collision Thu, 29 Oct 2026 12:00:00 GMT bounty InvoicePlane keeps five different rate-limit counters in a single database column. Four of them use structured, hashed keys. The login lockout writes whatever you typed in the email box, so you can type someone else's counter and fill it up for them. https://stokreef.com/blog/edgeos-operator-to-root-rce https://stokreef.com/blog/edgeos-operator-to-root-rce Wed, 07 Oct 2026 12:00:00 GMT bounty An EdgeOS operator has no shell and no sudo. Its session cookie, however, ends up concatenated into a command that runs as root, so prefixing that cookie with a bit of shell syntax turns a GUI-only account into a root shell on the router. https://stokreef.com/blog/edgeos-snmp-ifalias-command-injection https://stokreef.com/blog/edgeos-snmp-ifalias-command-injection Wed, 07 Oct 2026 12:00:00 GMT bounty Setting an interface alias over SNMP is supposed to change a label. EdgeOS hands that label straight to a single-string Perl system() call inside single quotes, so one apostrophe in the value turns an SNMP SET into shell commands on the router. https://stokreef.com/blog/edgeos-dhcp-squidguard-root-rce https://stokreef.com/blog/edgeos-dhcp-squidguard-root-rce Wed, 07 Oct 2026 12:00:00 GMT bounty A DHCP client is allowed to pick its own hostname. EdgeOS writes that hostname into /etc/hosts, /etc/hosts outranks DNS for the router itself, and squidGuard fetches its blacklist over plain FTP from a hardcoded host. Four reasonable decisions that add up to unauthenticated root. https://stokreef.com/blog/tudctf-2025-nothing-app https://stokreef.com/blog/tudctf-2025-nothing-app Wed, 26 Nov 2025 12:00:00 GMT writeup An Android app that shows nothing but a black screen still tries to phone home. The whole challenge lives in one decompiled method: lift the rotate-and-XOR routine out of MainActivity, rewrite it in Python, and the flag falls out. https://stokreef.com/blog/tudctf-2025-pizzanos-domi https://stokreef.com/blog/tudctf-2025-pizzanos-domi Wed, 26 Nov 2025 12:00:00 GMT writeup The proxy rate-limits HTTP requests, not GraphQL operations. Aliasing hundreds of coupon checks into a single request turns a seven-hour brute force into minutes, and the backend then happily stacks the same coupon six times. https://stokreef.com/blog/tudctf-2025-yearn-for-the-signs https://stokreef.com/blog/tudctf-2025-yearn-for-the-signs Wed, 26 Nov 2025 12:00:00 GMT writeup The flag is written on a Minecraft sign buried in a compressed region file. You never need the game: scan the .mca for zlib streams, decompress them, and read the sign text straight out of the NBT.