https://peertube.eqver.se/videos/watch/037885c5-f9f7-4b73-94c9-1b6e99876ea8 A DEF CON 30 talk about how a seemingly hardened bug bounty target — KASM Workspaces, an enterprise Docker-based VDI solution — was ultimately compromised. At first, the target appeared nearly untouchable: no source code, no obvious vulnerabilities, tightly secured architecture. But after reversing Python binaries, the real hunt began. The speakers walk through the full exploit chain: NGINX configuration injection via the Host header, filter bypass using ISO-8859-1 encoding, SSRF → LFI → extraction of KASM Agent secrets → command execution as root inside Docker and eventual breakout to the host. Fri, 24 Jul 2026 11:35:47 GMT https://validator.w3.org/feed/docs/rss2.html PeerTube - https://peertube.eqver.se https://peertube.eqver.se/client/assets/images/icons/icon-512x512.png https://peertube.eqver.se/videos/watch/037885c5-f9f7-4b73-94c9-1b6e99876ea8 All rights reserved, unless otherwise specified in the terms specified at https://peertube.eqver.se/about and potential licenses granted by each content's rightholder.