https://mrlsecurity.com/MRLSecurity: A personal brand project by Filip Leliukh, a seasoned cybersecurity speacialist. Here I leave quality content, researches and my footnotes. 2025-08-24T23:39:45+03:00 Filip Leliukh https://mrlsecurity.com/ Jekyll © 2025 Filip Leliukh /assets/img/favicons/favicon.ico /assets/img/favicons/favicon-96x96.png 2024-12-10T12:00:00+02:00 2025-08-24T23:39:23+03:00 https://mrlsecurity.com/posts/HTB-Unrested-Zabbix-SQLInjection/ filip

Start The machine spawns with generated credentials, for me there were: matthew / changedpasswd Begin with nmap and see that the machine has default web and zabbix agent’s ports opened: When reaching web it declares to have Zabbix 7.0.0 running on it. This version was found to have 2 recently discovered CVEs: app’s privilege escalation and SQL injection, both affecting API endpoints. C...

2024-07-03T10:00:00+03:00 2024-08-20T13:37:07+03:00 https://mrlsecurity.com/posts/jinja2-filter-bypass/ filip

Case study If the following chars are banned from injection ( "{{", "}}", ".", "_", "[", "]","\\", "x"), it is still possible to perform SSTI, because symbols as %, {, } and ( , ) are still accessible. In Jinja2/Flask it is possible to initialize variables for templates, and deliver payload parts through different methods(i.e., GET parameters, HTTP headers, cookies). This might help avoid filt...

2024-06-24T10:00:00+03:00 2024-12-16T13:55:18+02:00 https://mrlsecurity.com/posts/oswe-in-2024/ filip

My Experience On the 24th of June, I received my OSWE certification from OffSec, formerly known as Offensive Security. It’s a solid certification for a web penetration tester position. Before I delve into the details, let’s start by discussing the key aspects of the course, my experience, and the exam itself. To give you a sense of the course and the exam’s difficulty, here’s a bit of my back...

2024-04-02T14:10:00+03:00 2024-07-05T19:16:44+03:00 https://mrlsecurity.com/posts/Prototype-Pollution/ filip

Introduction I have prepared material on the Prototype pollution topic for today’s posts based on my notes from 2023 for a speech. It might be already deprecated partially, or there are some new materials or approaches on this topic, and maybe I’ll update this page one day. Nevertheless this note contains a lot of basics that less probable to change over time, so I hope you’ll find it useful. ...

2024-03-31T09:10:00+03:00 2024-03-31T09:10:00+03:00 https://mrlsecurity.com/posts/No-Treshold/ filip

Yet another realistic scenario showing a problem of custom realization on MFA function. But suppose you are familiar with possible scenarios at PortSwigger Academy on the “Vulnerabilities in multi-factor authentication” topic and read the given code carefully. In that case, the exploitation won’t take much time. A good exercise for web application pentesters and application security engineers. ...