https://lukaszpastuszak.dev/tags/api/Recent content in Api on Łukasz Pastuszak - security notesHugoen-usSun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/node/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/node/A leaky Express API exposes hashes and a hidden admin, a password-protected backup yields MongoDB credentials reused for SSH, a Mongo-driven scheduler runs exec() as another user, and a SUID binary falls to a ret2libc buffer overflow (plus several unintended blacklist bypasses).