https://lukaszpastuszak.dev/tags/password-reuse/Recent content in Password-Reuse on Łukasz Pastuszak - security notesHugoen-usSun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/goodgames/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/goodgames/Union-based SQL injection dumps an MD5 admin hash, password reuse reaches an internal Flask panel, SSTI gives RCE in a container, and a shared bind-mount plus a SUID bit escapes to root on the host.https://lukaszpastuszak.dev/writeups/node/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/node/A leaky Express API exposes hashes and a hidden admin, a password-protected backup yields MongoDB credentials reused for SSH, a Mongo-driven scheduler runs exec() as another user, and a SUID binary falls to a ret2libc buffer overflow (plus several unintended blacklist bypasses).https://lukaszpastuszak.dev/writeups/postman/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/postman/An unauthenticated Redis instance gives an RDB write primitive for an SSH key, an encrypted id_rsa.bak cracks to a reused password for Matt, and Webmin 1.910 (CVE-2019-12840) command injection gives root.