Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fo...

Time rules for certain user file interactions are documented in the SANS red poster, tested on a Windows 10 1903 system. This blog post looks at these same user interactions with files on a Windows 11 22H2 system, with some further testing conducted on a…

Precision targeting of critical infrastructure industries indicates espionage-related activity by an unattributed Chinese-speaking threat group.

With a CVSS rating of 9.9, the vulnerability fixed in SAP Security Note #3242933 affects SAP Manufacturing Execution and is considered significant.

developers can enroll in the Google Play Services beta and use Chrome Canary. Both features will be generally available on stable channels

glibc malloc singly linked list uses pointer mangling to prevent easy overwrites. The article explains how this works and how to defeat it.

Acknowledgements My understanding of EDRs would not be possible without the help of many great security researchers. Below are some write-ups and talks that really helped me gain the understanding needed and hit the ground running on the research that will…

Strikeout's hacker blog and public note taking. Hack the planet!

Faking a heap_info structure in glibc malloc to get a WRITE-WHERE primitive.

Demystifying the Windows Common Log File System Driver Privilege Escalation Zero-Day Vulnerability (CVE-2022-37969)

Teaching page of Shervine Amidi, Adjunct Lecturer at Stanford University.

The Microsoft Threat Intelligence Center (MSTIC) has identified evidence of a novel ransomware campaign attributed to IRIDIUM targeting organizations in the logistics and transportation industry in Ukraine and Poland utilizing a previously unidentified ransomware…

While tracking the Lazarus attack group, the ASEC analysis team discovered that the attackers were using the DLL Side-Loading attack technique (T1574.002) by abusing legitimate applications in the initial compromise stage to achieve the next stage of their…

Leakless glibc heap exploitation technique for code execution. Overwriting the symbol resolution process.

On Friday 14th of October 2022 Alex Plaskett (@alexjplaskett) and Cedric Halbronn (@saidelike) presented Toner Deaf – Printing your next persistence at Hexacon 2022. This talk demonstrated re…

RedEye is a visual analytic tool supporting Red & Blue Team operations - cisagov/RedEye