> For the complete documentation index, see [llms.txt](https://research.sfoffo.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://research.sfoffo.com/readme.md). # Home

Sfoffo's Research Blog

Welcome to my space for documenting offensive security research.
Here I share vulnerability findings, write-ups, and practical insights that highlight techniques, pitfalls, and lessons learned from real-world security testing.

## Latest Articles

		Cover image
Beyond a Fly in the Wild	Breaking down WildFly’s defenses and the alternative file upload attack paths adversaries may pursue when direct code execution isn’t possible.	wildfly.png	Beyond a Fly in the Wild
CVE-2024-42845 - Invesalius3 RCE	Remote Code Execution in DICOM import due to unsafe use of eval in coordinates parsing.	invesalius.png	CVE-2024-42845 - Invesalius3 RCE
Streamlining CVE Research using GitHub	Highlighting GitHub's vulnerability reporting workflow and the CVEs discovered during this process.	github-security-advisory.png	Streamlining CVE Research using GitHub

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://research.sfoffo.com/readme.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `build a script that syncs our docs to a CMS` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.