s where the magic happens.

As you can see, inside this function there is effectively a call to TpAllocTimer() and to TpSetTimer(), which is similar to saying that it is calling CreateThreadpoolTimer() and SetThreadpoolTimer() inside it. As we can see the function that we are queuing is not directly the callback we have given to the function, it is setting RtlpTpTimerCallback() as the callback. If you didn’t realize yet what all of this means, is that we are using CreateThreadpoolTimer() to queue a function that receives its arguments in the second position, RtlpTpTimerCallback(), that will execute another function with its arguments in the first position.

So the only thing that we still need to understand is how the callback information is passed to RtlpTpTimerCallback(), and after some reversing I ended with the following structure, that surprise surprise, IT WORKS!

Now we can call functions that receive their arguments in the first position and at the same time we are able to close our pools, and leave no threads running, win win. Is important to note that this function is not exported in Ntdll, so I decided to find it by its byte form inside the dll.

So this is the end, and with everything reviewed, I think I gave the core ideas that came throw my mind while developing this POC, and why everything was done in the way I did it. Download

The Beautiful Art Of Finding Subdomains

A plethora of subdomain finding tools is available on the web, leaving bounty hunters with options to choose from. But before we dive any…Continue reading on Medium »
Read more...

hacking: security in practice
Same actor from the Uber hack may have hacked Rockstar Games to exfiltrate GTA 5 and 6 source code

https://external-preview.redd.it/YQocgsdyy8ZxfybAqc_oULTTkXYHNRia9SFSpQbD_kY.jpg?width=108&crop=smart&auto=webp&s=f60f3b9489716424e1727bb2b3cfe0d16eeb4504 submitted by /u/florilsk
[link] [comments]

hacking: security in practice
Open source password manager

What is the best open source password manager from your point of view?

Ive seen Keepass and Bitwarden, dont know if there are others..

Preferably one that could be synced across all devices and accept Mac + windows + mobile.

submitted by /u/Plokeer_
[link] [comments]

hacking: security in practice
GTA 6 Leaker And Supposed Hacker

So recently as of 11 or 10 hours ago from this post, a hacker on the GTA forums website had leaked what appears to be a pre alpha build of GTA6. At first the community was happy to see some footage of the new game, however, the hacker is now threatening to leak to source code of GTA6 and other rockstar titles unless he negotiates with the company. This could delay or cancel the release of a game the community has already waited 9 years for. This hacker also claims to have hacked Uber recently. Considering this hacker has probably already committed a felony and breached cybersecurity laws, is there anything we can do to somehow give his location to authorities. Below is a link to his profile with posts talking about hacking Uber and also posts of him leaking the game and asking to negotiate for money, thanks.

https://gtaforums.com/profile/1297108-teapotuberhacker/

Another note, I understand the rules prohibit illegal activities but I believe this still abides by guide lines as the location of the individual I want revealed is an illegal hacker who has breached cybersecurity laws. This should be considered a service to the community.

submitted by /u/Prawn_Pizza
[link] [comments]

Cool Recon techniques every hacker misses! Episode 2
https://infosecwriteups.com/cool-recon-techniques-every-hacker-misses-episode-2-8024e8338756?source=rss------bug_bounty-5

Welcome to the 2nd Episode of Cool Recon Techniques. We are back with some more cool recon techniques which we think hackers out there…Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/cool-recon-techniques-every-hacker-misses-episode-2-8024e8338756?source=rss------bug_bounty-5)

The Beautiful Art Of Finding Subdomains
https://medium.com/@michaelbisuga/the-beautiful-art-of-finding-subdomains-99e178a253bf?source=rss------bug_bounty-5

A plethora of subdomain finding tools is available on the web, leaving bounty hunters with options to choose from. But before we dive any…Continue reading on Medium » (https://medium.com/@michaelbisuga/the-beautiful-art-of-finding-subdomains-99e178a253bf?source=rss------bug_bounty-5)

Screen Broadcasting Possible or Not?
https://www.reddit.com/r/Pentesting/comments/xho6o3/screen_broadcasting_possible_or_not/

submitted by /u/Saajaadeen (https://www.reddit.com/user/Saajaadeen)
[link] (https://i.redd.it/jqn5biijuno91.jpg) [comments] (https://www.reddit.com/r/Pentesting/comments/xho6o3/screen_broadcasting_possible_or_not/)

Bug Bounty { How I found an Sensitive Information Disclosure( Reconnaissance ) }

Hello everyone, Welcome Back!Continue reading on Medium »
Read more...

Hacking on Medium
VulnHub-Kioptrix: Level 1.1 (#2)

https://cdn-images-1.medium.com/max/600/1*QPGkCrXe0vC8iTg4lnR4Cg.png
Descripción de la máquina: Kioptrix Level 1.1 (#2) es una máquina Linux disponible en VulnHub. Esta máquina virtual es la primera de una…

Continue reading on Medium »

Hacking on Medium
Common Attacks: Write-up [TryHackMe]

https://cdn-images-1.medium.com/max/1900/1*3S4OTk69uwVD35sIjHX-hw.png
Welcome to the Common Attacks room from the TryHackMe write-up. I hope you find this write-up exciting and easy to follow.

Continue reading on DevOps.dev »