The general method of browser render process exploit is: after exploiting the vulnerability to obtain user mode arbitrary memory read/write primitive, the vtable of DOM/js object is tampered to hijack the code execution flow. Then VirtualProtect is called…

Overcoming obfuscation in binaries has always been an interesting topic for me, especially in combination with malware. Over the last weeks I’ve been playing around with Virtualised Code Prot…

I ran command line macOS tools, such as Bash and Geekbench, on a jailbroken iPhone by replacing iOS’s dyld shared cache (all of iOS’s code) with macOS’s. However, graphical apps will never work: macOS’s WindowServer won’t start, since iOS’s drivers are too…

Overview Performing lateral movement in an OpSec safe manner in mature Windows environments can often be a challenge as defenders hone their detections around the indicators generated by many of...

Previously on Dead Ends in Cryptanalysis, we talked about length-extension attacks and precisely why modern hash functions like SHA-3 and BLAKE2 aren’t susceptible. The art and science of sid…

Learn how NoSQL Injection works, with example strings to inject to test for injections.

Mistune is a remote exploit demostrated at TianfuCup 2020. It consists of two bugs that were introduced by iOS 3 and iOS 6 respectively

Here's a brief history of malware — from it's simple and benign beginnings, a massive and diabolical industry was born. Read more at the Lastline company blog.

Hey Cyberpunks , I hope you all are doing great in your life and if not, then you are at the right place to at least remove the queries of…

Introduction Virtualization technology has been an IT cornerstone for organization for years now. It revolutionized the way organizations can scale up IT

Understanding how netsh & portproxy works and how to implement it on our own code

Leveraging the HackSysExtreme Vulnerable Driver to understand the Windows kernel pool, the impacts of kLFH, and bypassing kASLR from low integrity via out-of-bounds read vulnerabilities.

Your new best friend: Introducing BloodHound Community Edition!

Perform all your vim insert mode completions with Tab - ervandew/supertab

In the May 2021 Microsoft update, Microsoft patched an HTTP.sys vulnerability that has the ability to become a wormable remote code execution exploit.  This vulnerability is being tracked as CVE-2021-31166.  A proof of concept quickly emerged showing a denial…

polkit is a system service installed by default on many Linux distributions. It’s used by systemd, so any Linux distribution that uses systemd also uses polkit.

First release of the Wildland client reference implementation!

Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection. - ayoubfaouzi/al-khaser

Early fingerpointing at Western governments for a hack against the Russian government was misplaced. Our taxes didn't pay for this one.