Back to directory
WRITEUP #2242

Zuckerpunch - Abusing Self Hosted Github Runners at Facebook

OtherCI/CD
byMarcus Young
Bounty
10,000
Program
Meta / Facebook
Published
Sep 6, 2022
Added to HackDex
Sep 15, 2022
Read Full Writeuphttps://marcyoung.us/post/zuckerpunch/
▸ RELATED WRITEUPS
Github Actions Exploitation: Dependabot
OtherCI/CD
GitHub Actions Exploitation: Self Hosted Runners
OtherCI/CD
Data Theft in Salesforce: Manipulating Public Links
OtherSOQL injection
When Certificates Fail: A Story of Bypassed MFA in Remote Access
Other2FA / MFA bypass
SSTI in Bug Bounty Program: The Time I Played with Handlebars and Broke Stuff
OtherSSTI

Built with ❤️ by Shubham Rawat