https://lukaszpastuszak.dev/tags/password-bruteforce/Recent content in Password-Bruteforce on Łukasz Pastuszak - security notesHugoen-usSat, 04 Jul 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/makesense/Sat, 04 Jul 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/makesense/A password dictated in a public audio recording gives a restricted WordPress login, a client-side AES-GCM key hardcoded in JavaScript enables stored XSS that creates an administrator, the Theme File Editor yields a webshell, reused wp-config.php credentials give SSH as walter, and a root OCR service that writes recognized text to a chosen file turns an image into PHP code execution as root.