Although the Android base is open source, many different constructors customize it with their own UIs and APIs. All these additions represent an extra attack surface that can change from one phone model to another. We tried to automatically fuzz the closed…

Last March, experts from the Spanish cybersecurity company Tarlogic shared their findings regarding a vulnerability in communications bluetooth used every day

A brand-new Burp Suite extension for discovering DNS vulnerabilities in web applications.

A collection of interesting and diverse Android malware samples

We always assume prepared statements and ORMs are enough to protect us from SQL injection, but be careful not to misuse their APIs! Let's look into a real-world case and see what we can learn from it.

In this blog post, we unpack a malicious sample sha256: 2c05efa757744cb01346fe6b39e9ef8ea2582d27481a441eb885c5c4dcd2b65b . The core…

With the rise of internet and increasing risks of getting hacked, it's more than necessary nowadays that we have an extra layer of security on our accounts, since password alone is not enough. Thus, using Phone numbers for 2FA sounds much more secure, but…

Do you know all of the default Windows 7 file formats? I’ve certainly seen a few in my time, though I can’t say I’ve seen a corpus of all the samples in one place.

Overview During a recent adversary simulation, the MDSec ActiveBreach red team were performing a ransomware scenario, with a key objective set on compromising the organisation’s backup infrastructure. As part of...

This article, the first of a two-part series, provides insights on how abusers and cybercriminals use residential proxies and CAPTCHA-solving services to enable bots, scrapers, and stuffers, and proposes security countermeasures for organizations.

Explore Android SELinux internals in Part 1. Learn how SELinux provides mandatory access control on Android devices and discover bypass techniques.

Recently, I had the privilege to write a detailed analysis of CVE-2023-34362, which is series of several vulnerabilities in the MOVEit file transfer application that lead to remote code execution. One of the several vulnerabilities involved an ISAPI module…

Triton is a library for doing Symbolic Execution, useful for doing common CTF challenges and analyzing obfuscations. TritonDSE is a library built on top of Triton which provides easy and customizable Dynamic Symbolic Execution Capabilities

Local privilege escalation vulnerability in Netskope Client Service allowing USER to SYSTEM escalation through chained vulnerabilities.

We’ll walk through the hooks of a particular AV (Sophos AV) and determine why many of the public methods fail, and how we created our Rust PoC to work against the self-protection techniques of similar hooking engines.

An unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process.

Because we can!