https://blog.devploit.dev/Real-world infosec, no hype. 2026-07-13T07:15:28+00:00 Daniel Púa https://blog.devploit.dev/ Jekyll © 2026 Daniel Púa /assets/img/favicons/favicon.ico /assets/img/favicons/favicon-96x96.png 2026-07-13T00:00:00+00:00 2026-07-13T00:00:00+00:00 https://blog.devploit.dev/posts/five-cves-hidden-in-npm-dependencies/ Daniel Púa

A month ago, I shared on LinkedIn that MITRE had assigned me five CVEs across three npm packages. I could not share the IDs or technical details at the time. Now I can. The interesting part is not that these packages contain five completely unrelated bugs. They all fail at the same boundary: data controlled by an attacker becomes a filesystem path or a memory allocation without being constrain...

2026-07-02T00:00:00+00:00 2026-07-13T07:14:35+00:00 https://blog.devploit.dev/posts/google-messages-avatarcontentprovider-contacts-bypass/ Daniel Púa

What happens if an app without READ_CONTACTS asks Google Messages for Android to load a Contacts photo for it? The vulnerability I found did exactly that: before it was fixed, Messages read the protected photo using its own permissions, rendered it as a PNG, and handed the image bytes back to the unprivileged caller. That was the bug. It was not a full Contacts database leak, but it was still...

2025-04-14T00:00:00+00:00 2026-07-13T07:14:35+00:00 https://blog.devploit.dev/posts/defcon-quals-2025-memorybank/ Daniel Púa

Introduction As a web hacking enthusiast, I typically focus on web-based CTF challenges. However, due to the lack of such challenges in DEFCON Quals 2025, I decided to tackle the Memory Bank challenge, which, though not strictly web-based, shared some similarities in nature. In this white-box CTF challenge, we had full access to the application code, allowing us to understand and exploit the ...