Joshua Rogers’ Scribbles
Joshua Rogers is an Australian technologist, sysadmin, security engineer, and pentester sharing long-form writeups on hacking, binary web and infra security, programming, technology, politics, and life itself.
- Posts
- 119 from 14 Apr 2022 to 22 Oct 2026
- Posting
- weekly (27 in the last year)
- Kind
- personal blog
- Feed
- https://joshua.hu/feed.xml
2026 22
- Automatically re-requesting a team and user review on GitHub review dismissal
- RCE (kind of) in Transmission BitTorrent’s daemon
- Lessons from using sanitizers as an oracle for LLM vulnerability triage
- Being silly is the whole point
- A natural life
- HtmlSanitizer bypass via a second body tag
- Two parse5 bugs: text turning into HTML, and a two-character crash
- 4 jsoup vulnerabilities
- Design taste in the age of LLMs: visualizing CVE data
- On self-imposed constraints and shame
- 33 Vulnerabilities in cJSON
- Hacking fun with zip-slips, tar-slips, symlinks, hardlinks, collisions, and more
- Magic Switch: Share a Magic Keyboard & Trackpad Between Two Macs (Free)
- Exploring "Bus Tours" of Nintendo and Sega: The Nintendo Challenger, Campus Challenge, and More.
- Some Thoughts on Cross-Cultural Video Game and Music
- Video Game History Around The World: An Essay.
- Video Games Around The World: South Africa
- Always 'Copy Clean Link' when possible on Firefox, with userChrome.css
- Making Firefox's right-click not suck, even more, with userChrome.css
- Making Firefox's right-click not suck with about:config
- wtf is NS_ERROR_INVALID_CONTENT_ENCODING? investigating shared dictionaries and ChatGPT breakage in Firefox
- From gixy-ng to Gixy-Next: rescuing the nginx security scanner, Gixy, from AI slop
2025 41
- My 2025 Bug Bounty Stories
- A helicopter story
- Another AI slop story: ChatGPT vs. Human
- AI slop security engineering: Okta's nextjs-auth0 troubles
- Gixy-Next: an overview of a Gixy fork with updated, improved, and new checks
- Retrospective: AI-powered security engineers and source code scanners
- One-Way Sandboxed Iframes: Creating a Read-Only Iframe Sandbox That Can't Read Back
- Network Security: Absurdity of Shared NICs with BMCs and Management Networks
- body: A bash script to get the middle of a file, instead of head | tail
- CCBot: Chrome Checker Bot for Chrome Security Releases
- ipgrep: grepping for ip addresses
- Flattening Arrays, Tail Call Recursion, and Stack Overflows in JavaScript
- Breaking decompilers with single-function, and no-main() C codebases
- Securely Validating Domain Names with Regular Expressions
- Swapping/Remapping the silcrow (§) key for a tilde on international Macbooks
- Bypassing Zscaler, Kandji MDM, and Apple Business Manager for Fun and Lulz
- Two infinite loop / DoS vulnerabilities in image-size
- NXDOMAIN'd: Catching unregistered domains for fun and profit
- Hacking with AI SASTs: An overview of 'AI Security Engineers' / 'LLM Security Scanners' for Penetration Testers and Security Teams
- A Comparison of Tools to Detect ReDoS-vulnerable Expressions
- Proxy Services, Hijacked Companies, and the Rabbit-Hole of Fake Hosting Companies and Big Sky Services
- nginx 'allow' and 'deny' directives with 'return'
- nginx's proxy_pass DNS caching problem
- On Iranian Censorship, Bypasses, Browser Extensions, and Proxies
- A small solution to DNS rebinding in Python
- Hello, Kafka Support Here, How Can I Help You? GitHub Edition
- Losing Sight and Vision of Your Mission and Culture: Part 3.5
- POV: You land at Melbourne Airport
- wtf Google: cacheable rss feeds are dead, and Atom feeds are delayed
- On being an illegal immigrant, hacking an unlimited Schengen visa, and becoming Polish
- Losing Sight and Vision of Your Mission and Culture: Part 3
- Identifying ReDoS Vulnerabilities in Nginx Configurations Using Gixy-Next
- LLMs are destroying art: the art of code, literature, and culture.
- Can Nginx Configurations Be Vulnerable to ReDoS Expressions?
- Extracting TLS Session Keys in Burp Proxy à la SSLKEYLOGFILE
- proxy_pass: nginx's Dangerous URL Normalization of Paths
- Debugging failures of HTTP/2 in Burp, mitmproxy, and browsers
- CodeQL on MacOS
- NodeJS, nvm, yarn, and npm on MacOS in 2025
- Updating FreeBSD's datetime without DNS
- Feedburner's Caching Problem
2024 27
- Some Thoughts on "Fixing Security Issues"
- Webcam support on a Macbook running FreeBSD using PCI passthrough
- Losing Sight and Vision of Your Mission and Culture: Part 2
- Crawling every Debian .deb package in history from snapshot.debian.org, learning the .deb format, and finding rate-limiting bypasses
- A Full Guide: FreeBSD 13.3 on a MacBook Pro 11.4 (Mid 2015) (A1398)
- Comparing different versions of AWK with WebAssembly
- An automatic captive-portal resolver and DNS white-lister for DNS over TLS with Unbound
- BCM43602: Debugging a Wifi chipset causing a whole-system hang with FreeBSD's bhyve VM
- Exclusive i3 keysyms for specific programs. or: Binding Escape on imagemagick's import
- Encrypted NTP using NTS and chrony on FreeBSD
- Encrypted DNS over TLS on FreeBSD with Unbound, and Blocking Unencrypted DNS Traffic
- Cute color progression for my battery status indicator
- Fuzzing scripting languages' interpreters' native functions using AFL++ to find memory corruption and more
- On using private browsing mode for half a year
- Supply chain attacks and the many (other) different ways I've backdoored your dependencies
- A DoS Attack in RuneScape: In 3-Dimensions!
- The End of Yubikeys as 2-Factor-Authentication? Google Breaks 2FA with Yubikeys in Favor of Passkeys
- Mounting and reading an ext4 drive on MacOS
- A RuneScape Hacker's Dream: An Authenticator and PIN Bypass
- Credential Stuffing Done Right: Some Tips
- Automatically Generating a Well-Tuned Fuzzing Campaign With AFL++
- SSH-Snake Update: Multi-IP Domain Resolution
- Firefox now automatically trusting the operating system's root store for TLS certificates - update: it does so only for user-added ones
- On the Google Account Persistence Exploit
- LDAP Watchdog: Real-time LDAP Monitoring for Linux and OpenLDAP
- SSH-Snake: Automatic traversal of networks using SSH private keys
- Fuzzing with memfd_create(2) and fmemopen(3)
2023 26
- Bash and SSH fun: SSH is eating my stdin! Or: why does my Bash script not continue after returning from a function?
- No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability
- SSH Adventures Continued: Invalid CVE-2018-15473 Patches
- Losing Sight and Vision of Your Mission and Culture
- More fun with bash: bash, ssh, and ssh-keygen version quirks
- Dumping bash variable values from memory using gdb
- Playing with SSH: carriage returns on stderr output
- Fuzzing glibc's libresolv's res_init()
- Revisiting My Old Blog
- Revisiting the past: Security recommendations of a 17-year-old Joshua
- How to DoS MySQL/MariaDB and PostgresSQL Servers With Fewer Than 55kb of Data
- 55 Vulnerabilities in Squid Caching Proxy and 35 0days
- root with a single command: sudo logrotate
- Fuzzing with multiple servers in parallel: AFL++ with Network File Systems
- CVE-2023-4863: Fallout hits Facebook; probably much much more
- Nagios Plugins: Hacking Monitored Servers with check_by_ssh and Argument Injection: CVE-2023-37154
- Tracking a secret LoginTime LDAP attribute with Operational Attributes
- Slack login is broken with noscript
- My Wrocław tourism tips and recommendations
- Improve nmap's service scanning with this 1 weird trick!
- Speeding up nmap service scanning 16x
- 5 Tips For Port Service Scanning 16x Faster: Part 1
- Describing All Kubernetes Pods of All Namespaces for Fun and Profit
- Stealing All of Hashicorp Vault's Secrets Using Login Enumeration
- Achieving persistence with a hidden SSH backdoor
- Attacking a temperamental ten-year-old Jenkins server