Blogs

AdGuardHome: Unauthenticated API Access via HTTP/2 Cleartext (h2c) Upgrade
AdGuardHome: Unauthenticated API Access via HTTP/2 Cleartext (h2c) Upgrade

AdGuardHome is a self-hosted DNS-level ad blocker that a lot of people, myself included, run on their home networks. It sits in front of all your DNS traffic and blocks ads, trackers, and malware domains before they even get a chance to load. It is common on home routers, Raspberry Pis, and small …

Unauthenticated SSRF in RustDesk Lets Anyone Port-Scan Your Internal Network
Unauthenticated SSRF in RustDesk Lets Anyone Port-Scan Your Internal Network

Background RustDesk is an open-source remote desktop tool written in Rust. It is basically the self-hosted alternative to TeamViewer or AnyDesk, and it has gotten pretty popular because you can run your own relay and rendezvous server. That self-hosted server model is actually the interesting part …

Open Redirect in Prowlarr Login Lets Attackers Redirect Users After Authentication
Open Redirect in Prowlarr Login Lets Attackers Redirect Users After Authentication

Background Prowlarr is an open-source indexer manager for the *arr ecosystem (Radarr, Sonarr, Lidarr, etc.). It acts as a centralized proxy for torrent and Usenet indexers, so a typical homelab setup has it sitting alongside a media server stack with direct access to download clients and a lot of …

Finding an Authentication Bypass and Credential Disclosure in Seerr Using Claude and Bitwarden's AI Security Plugins
Finding an Authentication Bypass and Credential Disclosure in Seerr Using Claude and Bitwarden's AI Security Plugins

Background I’ve been running Seerr at home for a while now. It’s a self-hosted media request manager, forked from Jellyseerr/Overseerr, and it’s the kind of app that gets exposed to the internet pretty regularly since family members need to be able to submit requests. That always …

CSS Injection in dashdot's Single-Widget Embed Mode
CSS Injection in dashdot's Single-Widget Embed Mode

If you run a home lab or a self-hosted setup, there is a good chance you have come across dashdot. It is a slick, glassmorphism-style server monitoring dashboard that shows you CPU load, RAM usage, network stats, and more in real time. It also has a handy single-widget embed mode, where you can pull …

Custom PC Volume Knob Project
Custom PC Volume Knob Project

Recently, the Elgato Stream Deck Plus was released. My friends and I were looking at the device and really wanting the knobs to control just the volume of our PC volume. However, I didn’t want to buy the whole device just for a knob. This is the journey I made to DIY my volume knob. This post …