Ftp on Łukasz Pastuszak - security noteshttps://lukaszpastuszak.dev/tags/ftp/Recent content in Ftp on Łukasz Pastuszak - security notesHugoen-usSun, 06 Sep 2026 00:00:00 +0000Forgehttps://lukaszpastuszak.dev/writeups/forge/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/forge/An 'upload from URL' feature is an SSRF read primitive; a redirect from the attacker's server bypasses the loopback blacklist and reaches an internal FTP for the SSH key, and pdb.post_mortem in a sudo script gives root.