An infostealer comes to town: Dissecting a highly evasive malware targeting Italy https://blog.cluster25.duskrise.com/2022/12/22/an-infostealer-comes-to-town
Diving into an Old Exploit Chain and Discovering 3 new SIP-Bypass Vulnerabilities https://www.trendmicro.com/en_us/research/22/l/diving-into-an-old-exploit-chain-and-discovering-3-new-sip-bypas.html
Trend Micro
Diving into an Old Exploit Chain and Discovering 3 new SIP-Bypass Vulnerabilities
More than two years ago, a researcher, A2nkF demonstrated the exploit chain from root privilege escalation to SIP-Bypass up to arbitrary kernel extension loading. In this blog entry, we will discuss how we discovered 3 more vulnerabilities from the old exploit…
Dissecting FortiGate Images for fun and non-profit https://www.divd.nl/2022/12/26/dissecting-fortigate-images-for-fun-and-no-profit/
Pass-the-Challenge: Defeating Windows Defender Credential Guard https://research.ifcr.dk/pass-the-challenge-defeating-windows-defender-credential-guard-31a892eee22
Medium
Pass-the-Challenge: Defeating Windows Defender Credential Guard
In this blog post, we present new techniques for recovering the NTLM hash from an encrypted credential protected by Windows Defender…
🔥1
A tale of a simple Apple kernel bug https://pwning.systems/posts/easy-apple-kernel-bug/
pwning.systems
A tale of a simple Apple kernel bug
Earlier this year, I discovered a flaw in XNU, which is the kernel that Apple uses on both macOS and iOS. While it's not a particularly complicated flaw, I wanted to explain how I discovered it and how it works, both so that I can motivate others and so that…
CVE-2022-42046 Proof of Concept of wfshbr64.sys local privilege escalation via DKOM https://github.com/kkent030315/CVE-2022-42046
GitHub
GitHub - kkent030315/CVE-2022-42046: CVE-2022-42046 Proof of Concept of wfshbr64.sys local privilege escalation via DKOM
CVE-2022-42046 Proof of Concept of wfshbr64.sys local privilege escalation via DKOM - kkent030315/CVE-2022-42046
A brief analysis of Hornet Ransomware https://rixed-labs.medium.com/a-brief-analysis-of-hornet-ransomware-ec958e9cf310
Medium
A brief analysis of Hornet Ransomware
Hey readers, hope everyone is having a good time. Once again I decided to write blogs for the community on topics I stumble upon. I hope…
G-3PO: A Protocol Droid for Ghidra (A Script that Solicits GPT-3 for Comments on Decompiled Code) https://medium.com/tenable-techblog/g-3po-a-protocol-droid-for-ghidra-4b46fa72f1ff
Medium
G-3PO: A Protocol Droid for Ghidra
(A Script that Solicits GPT-3 for Comments on Decompiled Code)
Page Cache and basic file operations https://biriukov.dev/docs/page-cache/3-page-cache-and-basic-file-operations/
Viacheslav Biriukov
Page Cache and basic file operations
Page Cache and basic file operations # Last updated: Oct 2025 Contents
File reads Reading files with read() syscall Reading files with mmap() syscall File writes Writing to files with write() syscall File writes with mmap() syscall Dirty pages Synchronize…
File reads Reading files with read() syscall Reading files with mmap() syscall File writes Writing to files with write() syscall File writes with mmap() syscall Dirty pages Synchronize…
Executable and Linkable Format 101 - Part 1 Sections and Segments https://www.intezer.com/blog/research/executable-linkable-format-101-part1-sections-segments/
Intezer
Executable and Linkable Format 101 Part 4: Dynamic Linking
In part four of our ELF 101 blog series, we explain the dynamic linking process, including its purpose, how it works and the different linking modes.
👍2
Executable and Linkable Format 101. Part 2: Symbols https://www.intezer.com/blog/malware-analysis/executable-linkable-format-101-part-2-symbols/
Intezer
Executable and Linkable Format 101. Part 2: Symbols
In our previous post, we focused on understanding the relationship between sections and segments, which serve as the foundation for understanding the ELF file format.
👍3
Chrome Browser Exploitation, Part 3: Analyzing and Exploiting CVE-2018-17463 https://jhalon.github.io/chrome-browser-exploitation-3/
Jack Hacks
Chrome Browser Exploitation, Part 3: Analyzing and Exploiting CVE-2018-17463
Welcome to the third and final installment of the “Chrome Browser Exploitation” series. The main objective of this series has been to provide an introduction to browser internals and delve into the topic of Chrome browser exploitation on Windows in greater…
A bunch of OLD-School RCE tricks… https://www.hexacorn.com/blog/2023/01/01/a-bunch-of-old-school-rce-tricks/
Proof-of-concept app to overwrite fonts on iOS using CVE-2022-46689 https://github.com/ginsudev/WDBFontOverwrite
GitHub
GitHub - ginsudev/WDBFontOverwrite: Proof-of-concept app to overwrite fonts on iOS using CVE-2022-46689.
Proof-of-concept app to overwrite fonts on iOS using CVE-2022-46689. - ginsudev/WDBFontOverwrite
Executable and Linkable Format 101 Part 3: Relocations https://www.intezer.com/blog/malware-analysis/executable-and-linkable-format-101-part-3-relocations/
Intezer
Executable and Linkable Format 101 Part 3: Relocations
This post is part of Intezers blog series about executable and linkable formats. In this post, we will introduce the concept of ELF relocations and their relationship with symbols. Later we will explain more advanced concepts, such as dynamic linking.
Using an Android emulator for API hacking https://zerodayhacker.com/using-an-android-emulator-for-api-hacking/
Zero Day Hacker - Teaching myself ethical hacking. Here's what I've learned, from day zero onward.
Using an Android emulator for API hacking - Zero Day Hacker
This article explains how to install Android Studio and set up the Android emulator to proxy its traffic through Burp Suite. This lets you monitor traffic from Android apps.
👍1
Kubernetes Scaling: The Event Driven Approach https://medium.com/@toonvandeuren/kubernetes-scaling-the-event-driven-approach-bdd58ded4e3f
Medium
Kubernetes Scaling: The Event Driven Approach
So, we've all heard of Kubernetes by now. It's a container orchestration platform that's currently taking over the world (and cloud)…
Executable and Linkable Format 101 Part 4: Dynamic Linking https://www.intezer.com/blog/malware-analysis/executable-linkable-format-101-part-4-dynamic-linking/
Intezer
Executable and Linkable Format 101 Part 4: Dynamic Linking
In part four of our ELF 101 blog series, we explain the dynamic linking process, including its purpose, how it works and the different linking modes.