alt Hacker NewsThis one's pretty bad but there are some preconditions.
Requires a "rewrite" directive with a questionmark in the replacement string, and then a subsequent "set" directive that references a regex capture group (e.g. set $var $1).
Also the POC assumes ASLR is disabled.
Replies
dsr_ • yesterday at 5:42 PM
Does any distro disable ASLR by default?
If you were to do it by hand, nginx doesn't come to mind as a likely candidate.
➕ show 1 reply
codedokode • yesterday at 11:08 PM
I think "rewrite" is rarely used nowadays? Isn't it something from old days of PHP and Apache?
➕ show 2 replies
Example: https://github.com/DepthFirstDisclosures/Nginx-Rift/blob/mai...