From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <ammarfaizi2@gnuweeb.org>
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on gnuweeb.org
X-Spam-Level: 
X-Spam-Status: No, score=-1.2 required=5.0 tests=ALL_TRUSTED,DKIM_SIGNED,
	DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,URIBL_BLOCKED autolearn=ham
	autolearn_force=no version=3.4.6
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=gnuweeb.org;
	s=default; t=1682580660;
	bh=JVbhE5K4YiS/zR7trLOHPtOckJo1Lpgi/J2cQe3syio=;
	h=Date:From:To:Cc:Subject:References:In-Reply-To;
	b=ZXZxQ1Y2OpILcjUuElSXb3F/GDzNlXM3FhosYEjyKttqwtVt8Cs8nf8bV9sGgirAS
	 bDoAErdkb7u9XBl34kD0YBux1Qdc78UiEovMA6K5WFKhI06BcFomyA+juqtpsz81yG
	 IvYhk3airvR9eq07DK6pEFu8607x6TDyCCO+I1xMQ8v8Wbx7qP1xyJyCABA/+b/eva
	 7WmtjCVi2tSCE4YRO7oNUdMWzShYx0FA1BXtWxjks20bxj8Rqi416UbWqy1Iu5ubUB
	 MqDyh2sjABmVr+p7Q3D19rq0xdAr9P29lNEmrYWFcw7yk7ls7Knu/HtSVIHo+eQsNY
	 yUcHUuALfvHJg==
Received: from biznet-home.integral.gnuweeb.org (unknown [182.253.183.137])
	by gnuweeb.org (Postfix) with ESMTPSA id 1B22D2458D8;
	Thu, 27 Apr 2023 14:30:58 +0700 (WIB)
Date: Thu, 27 Apr 2023 14:30:55 +0700
From: Ammar Faizi <ammarfaizi2@gnuweeb.org>
To: Alviro Iskandar Setiawan <alviro.iskandar@gnuweeb.org>
Cc: Michael William Jonathan <moe@gnuweeb.org>,
	GNU/Weeb Mailing List <gwml@vger.gnuweeb.org>
Subject: Re: Another CF ticketing system vuln
Message-ID: <ZEokr8Y8diCcigSY@biznet-home.integral.gnuweeb.org>
References: <CAOG64qNYdsJNUkG=5M8ZYPdHFN0AA0vCn56QcVcAV+4HCKkYhg@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CAOG64qNYdsJNUkG=5M8ZYPdHFN0AA0vCn56QcVcAV+4HCKkYhg@mail.gmail.com>
X-Bpl: hUx9VaHkTWcLO7S8CQCslj6OzqBx2hfLChRz45nPESx5VSB/xuJQVOKOB1zSXE3yc9ntP27bV1M1
List-Id: <gwml.vger.gnuweeb.org>

On Thu, Apr 27, 2023 at 02:24:55PM +0700, Alviro Iskandar Setiawan wrote:
> I found a new vulnerability.
> 
> This one requires a bit of computational work, but still easy if you
> use your brain hard enough. Details in the attachment.
> 
> gcc -Wall -O2 gwcfdump_v4.c -o gwcfdump_v4 -lpthread -lcurl -ljson-c;
> ./gwcfdump_v4;

You're crazy. The rest is saving those into HTML files and you get a
perfect score. I'm honestly sick of this shit.

-- 
Ammar Faizi