• 2 Posts
  • 83 Comments
Joined 10 months ago
cake
Cake day: January 24th, 2024

help-circle


  • I use macvtaps in my homelab for vulnerable VMs because no matter how I set up the bridges or what guide I followed it just broke networking every time on a headless server that’s a massive pain to fix.

    Wish I knew about macvtaps from the get-go, it was a dead giveaway that bridges are some demonic shit on Linux as every guide was different, and for every guide there was always some people on Reddit saying how it didn’t work for them at all.

    I haven’t found myself missing hard-corpo software in a while but in that moment I really wished I was just using VMware on windows where creating a bridge interface takes one click instead of janky virsh syntax and messing with ifconfig etc.












  • None. Dashy’s authentication was famously literally security theatre even with Keycloak. You could just pause the load in browser and have full access to the config. Because it let you iframe whatever you could now do so with local services to enum. Somehow Jellyfin is unbustable though. So it’s a bit of a crapshoot. Look at past vulnerabilities. Stuff like XSS unless stored you don’t need to worry about, clickjacking, tab nabbing etc. On the other hand anything that’s arbitrary file read, SQLI, RCE, LFI, RFI, SSRF etc. I would look at seriously. E.g. don’t make your 13ft public because it can be used to literally enumerate your entire private network.