Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

The author of this post had read Bypassing File Upload Restrictions To Exploit Client-Side Path Traversal. Upon reading this post, they found that many of the tricks weren't working. They mainly relied on tricking a parser to think something was a different datatype than it really was. Because this, they decided to read the source code of libmagic and found how it decides if something is a JSON file or not.

If a JSON file has 500 levels of nesting, it treats it as plaintext. It turns out, that most languages for detecting file types have this limitation—the call range from 64 to thousands. In the case of libmagic, and many of its wrappers, anything over these amounts will simply return the type as plain-text. Little quirks can go a long ways!