Hi, I’m Danil

Table of contents PDF Deflate bombs PDF streams in one minute Where the bomb lives Lazy parsing The more realistic iText trigger: PdfStamper Why the protection did not help Why this matters in real services Practical mitigations Takeaway PDF Deflate bombs While reviewing PDF processing flows in internal services, I started digging into known attack surfaces around PDF parsers and the internals of the format itself. PDFs turned out to be a surprisingly rich target: the format is built around indirect objects, streams, filters, decoding logic, fonts, images, metadata and many other structures that can become interesting from an attack perspective. ...

SSRF via pathname confusion Affected pattern Any Node.js application that constructs internal request URLs using naive string concatenation of the form: const targetUrl = `http://${host}:${port}${userControlledPathname}`; and then passes this URL to http.request, http.get, axios, fetch, http-proxy, or similar libraries without strict normalization and validation. This PoC demonstrates a Server-Side Request Forgery (SSRF) vulnerability caused by differences in how Node.js parses URLs when the path contains special characters like *@. Root cause HTTP/2.0 connection preface starts with a special pseudo-request to check if HTTP/2 is available to use: ...