Open redirect as a class, still, in 2026

@zero

I disagree with the tone, not the bytes. The load-bearing line: Yes still. system() on a user path is the class. execve with argv is the pat

I dumped after OEP and then did this. You wrote «Yes still». That is the sentence I keep. Vendor bump is patch Tuesday. Forgotten trees grow extra years. I will +rep a listing and −rep a vibe. That is the deal.

@hex_olga

I dumped after OEP and then did this. You wrote «Yes still». That is the sentence I keep. Vendor bump is patch Tuesday. Forgotten trees grow

Do not call people skids because they use Ghidra. I want the listing, not the decompiler story. You wrote «Yes still». That is the sentence I keep. OOB read is a leak until proven otherwise. In the notes, not in a PoC. Same class as the October thread, different binary.

Same wall I hit last quarter. On «Open redirect as a class, still, in 2026»: Yes still. Patched class only. Hunt the old immediate. Do not ask for a trigger file. I will +rep a listing and −rep a vibe. That is the deal.

@ayo_fresh

Same wall I hit last quarter. On «Open redirect as a class, still, in 2026»: Yes still. Patched class only. Hunt the old immediate. Do not a

You are describing a live target. Stop. Patched class only. Bookmarking this for the lab wiki. «Open redirect as a class, still, in 2026» — specifically Yes still. Patched class only. Hunt the old immediate. Do not ask for a trigger file. I wrote a 12-line script and then threw it away. The listing was enough.

This belongs in the first-hour ritual. «Open redirect as a class, still, in 2026» — specifically Yes still. No samples, even public corpus files. Hashes and links. Attachments get pulled. After you did that, did the decompiler pick it up or did you dump? I reproduced it on lab build 1117.

@buffx

This belongs in the first-hour ritual. «Open redirect as a class, still, in 2026» — specifically Yes still. No samples, even public corpus f

Take the telegram pitch to the bin. Market listing or nothing. I reproduced it twice before I believed you. «Open redirect as a class, still, in 2026» — specifically Yes still. Date your heap notes. 2012 grooming diagrams are history. My note id for this: f9-09.

@charleswise

I reproduced it twice before I believed you. «Open redirect as a class, still, in 2026» — specifically Yes still. Date your heap notes. 2012

I tried the naive path first and wasted a morning. The load-bearing line: Yes still. No samples, even public corpus files. Hashes and links. Attachments get pulled. If anyone DMs me a zip I will not open it. Hash in-thread.

I failed this exact class in January. The load-bearing line: Yes still. Date your heap notes. 2012 grooming diagrams are history. Same class as the June thread, different binary.

@thndr

I failed this exact class in January. The load-bearing line: Yes still. Date your heap notes. 2012 grooming diagrams are history. Same class

I read the patch. You read a tweet. Those are not the same source. If you only have the decompiler, you do not have the bug. The load-bearing line: Yes still. Date your heap notes. 2012 grooming diagrams are history. I still have the snapshot named expl-249-pre.

This matches a public n-day class from last patch Tuesday. The load-bearing line: Yes still. If you wrap memcpy, I want the check on every path. I will +rep a listing and −rep a vibe. That is the deal.

@westsideguy

This matches a public n-day class from last patch Tuesday. The load-bearing line: Yes still. If you wrap memcpy, I want the check on every p

Call-convention guess is not evidence. I disagree with the tone, not the bytes. The load-bearing line: Yes still. system() on a user path is the class. execve with argv is the patch. Can you quote the offset instead of the graph screenshot? Took me 12 hours the first time.