Patch Analysis: When a Fix Doesn’t Go Far Enough
An analysis of an incomplete remediation in FileBrowser Quantum where tokenized download URLs remained exposed, resulting in an authentication bypass despite a prior security fix.
SECURITY RESEARCH NOTEBOOK
RubberDucky.codes
Security research, experiments, and notes from breaking software.
Featured Research
Latest Writing
New CVE? Don’t Fucking Test It on Production Servers
Running public exploit code against production is not “testing.” It is how you turn vulnerability validation into an incident.
Unlimited Login Attempts: When Authentication Lacks Abuse Controls
Analysis of an authentication flow that processes consecutive failed login attempts without rate limiting, account lockout, or progressive backoff delays.
The Clock Doesn't Lie: Timing Attacks in Authentication Flows
A timing side-channel in JSONAuth allows unauthenticated attackers to enumerate valid usernames based on response time differences.
Session Tokens and Password Changes: A Reauthentication Gap in Filebrowser Quantum
Analysis of a password change flow that accepts a valid session token without requiring current-password reauthentication.
Patch Analysis: When a Fix Doesn’t Go Far Enough
An analysis of an incomplete remediation in FileBrowser Quantum where tokenized download URLs remained exposed, resulting in an authentication bypass despite a prior security fix.
Testing Password Reset Flows for Token Reuse and Host Poisoning
Step-by-step methodology for validating reset flow token handling, expiry controls, and host header trust boundaries.