Appsec on phinguin123 http://phinguin.dev/tags/appsec/ Recent content in Appsec on phinguin123 Hugo en-us 2026 phinguin Wed, 01 Jul 2026 20:01:00 +0900 Pen-Testing My Own Upload Endpoint http://phinguin.dev/blog/accidentally-safe-isnt-safe/ Wed, 01 Jul 2026 20:01:00 +0900 http://phinguin.dev/blog/accidentally-safe-isnt-safe/ Tried to path-traverse my own homework upload API. It held up, but only because of a timestamp prefix I never meant as a security thing. I Pulled /etc/passwd Off My Own Server http://phinguin.dev/blog/reading-my-own-etc-passwd/ Mon, 29 Jun 2026 20:48:00 +0900 http://phinguin.dev/blog/reading-my-own-etc-passwd/ An nginx 400 felt like a fix. send_from_directory felt like a fix. Then a different endpoint handed me /etc/passwd, and the real question was how bad that actually is.