https://cyberroute.github.io/post/ Recent content in Posts on cyberroute Hugo -- gohugo.io en-us cyberroute@proton.me (Alessandro Bresciani) cyberroute@proton.me (Alessandro Bresciani) Thu, 11 Dec 2025 10:10:12 +0200 https://cyberroute.github.io/post/2025-12-11-localstack-hack/ Thu, 11 Dec 2025 10:10:12 +0200cyberroute@proton.me (Alessandro Bresciani) https://cyberroute.github.io/post/2025-12-11-localstack-hack/ CVE Identifiers Update (October 22, 2026): both CVEs are now published on the NVD. CVE Description CVSS 3.1 CWE CVE-2025-65200 Remote Code Execution via XSS to CloudFormation Chain 9.6 Critical (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) CWE-79 CVE-2025-69723 Reflected Cross-Site Scripting (XSS) Vulnerability 6.1 Medium (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) CWE-79 What is LocalStack and how to quickly start it? LocalStack is a popular open-source platform that emulates AWS services locally, allowing developers to build and test cloud infrastructure without touching real AWS accounts. https://cyberroute.github.io/post/2025-10-14-cors/ Tue, 14 Oct 2025 10:10:31 +0200cyberroute@proton.me (Alessandro Bresciani) https://cyberroute.github.io/post/2025-10-14-cors/ Exploiting CORS Misconfigurations Introduction During a recent security assessment, I discovered a CORS (Cross-Origin Resource Sharing) misconfiguration that allowed complete bypass of the Same-Origin Policy. This vulnerability enabled an attacker to steal sensitive user information including API keys, email addresses, and session tokens from authenticated users. In this guide, I’ll walk you through the complete exploitation process using PortSwigger’s Web Security Academy lab as a practical example. Lab: CORS vulnerability with basic origin reflection https://cyberroute.github.io/post/2024-03-11-bruter/ Mon, 11 Mar 2024 10:10:31 +0200cyberroute@proton.me (Alessandro Bresciani) https://cyberroute.github.io/post/2024-03-11-bruter/ Introduction Bruter is a lightweight application built as an experimental project while learning the Go programming language. Though inspired by the popular Xray tool from GitHub, Bruter introduces its own set of features, tailored specifically for web server testing and configuration validation. Whether you’re a seasoned web administrator or a beginner in cybersecurity, Bruter offers a streamlined way to assess various aspects of web servers with a user-friendly interface. In this blog post, we’ll explore what Bruter does, how it works, and why it might be an essential addition to your web server auditing toolkit. https://cyberroute.github.io/post/2024-02-25-scanme/ Sun, 25 Feb 2024 00:00:00 +0000cyberroute@proton.me (Alessandro Bresciani) https://cyberroute.github.io/post/2024-02-25-scanme/ Introduction: In today’s interconnected world, understanding network security is essential. One essential tool in a security professional’s arsenal is a port scanner. You probably thinking what? are you reinventing the wheel? Well not exactly I am building a deeper understanding of what happens under the hood. There are plenty of tools out there that you can use for network scanning starting from the most famous and popular nmap, you can become a master at using them but have you ever tried to read them and understand the engineering behind? https://cyberroute.github.io/post/2024-02-23-rdpscan/ Fri, 23 Feb 2024 00:00:00 +0000cyberroute@proton.me (Alessandro Bresciani) https://cyberroute.github.io/post/2024-02-23-rdpscan/ This is the very first article that I am publishing on this blog, I wanted to share this experience with folks that are passionate like myself about Security at 360 degrees and also share my thought process to actually produce the correct solution. The assignment received has been pretty interesting and at the same time challenging given that I consider myself a wannabe Security Researcher :D. Without further ado, let’s get into it!