Blogs
Unauthenticated SSRF in RustDesk Lets Anyone Port-Scan Your Internal Network
Background RustDesk is an open-source remote desktop tool written in Rust. It is basically the self-hosted alternative to TeamViewer or AnyDesk, and it has gotten pretty popular because you can run your own relay and rendezvous server. That self-hosted server model is actually the interesting part …
Open Redirect in Prowlarr Login Lets Attackers Redirect Users After Authentication
Background Prowlarr is an open-source indexer manager for the *arr ecosystem (Radarr, Sonarr, Lidarr, etc.). It acts as a centralized proxy for torrent and Usenet indexers, so a typical homelab setup has it sitting alongside a media server stack with direct access to download clients and a lot of …
Finding an Authentication Bypass and Credential Disclosure in Seerr Using Claude and Bitwarden's AI Security Plugins
Background I’ve been running Seerr at home for a while now. It’s a self-hosted media request manager, forked from Jellyseerr/Overseerr, and it’s the kind of app that gets exposed to the internet pretty regularly since family members need to be able to submit requests. That always …
CSS Injection in dashdot's Single-Widget Embed Mode
If you run a home lab or a self-hosted setup, there is a good chance you have come across dashdot. It is a slick, glassmorphism-style server monitoring dashboard that shows you CPU load, RAM usage, network stats, and more in real time. It also has a handy single-widget embed mode, where you can pull …
Custom PC Volume Knob Project
Recently, the Elgato Stream Deck Plus was released. My friends and I were looking at the device and really wanting the knobs to control just the volume of our PC volume. However, I didn’t want to buy the whole device just for a knob. This is the journey I made to DIY my volume knob. This post …
Adafruit Feather Huzzah 8266 DS18B20 Wing
I recently had my barn freezer go out. While it’s always inconvenient, I had just bought half of a cow, which is quite costly. A good majority of the meat had gone bad, and we didn’t know it for a day or so. To ensure this didn’t happen again, I tried to see if I could use my nerd …



