GitHub Gist: instantly share code, notes, and snippets.

Cybersecurity experts are warning that zero-day exploits, which can be used to compromise devices before anyone is aware they’re vulnerable, have become more common as nation-state hackers and cybercriminals find sophisticated ways to carry out their attacks.

Study of an Android runtime (ART) hijacking mechanism for bytecode injection through a step-by-step analysis of the packer used to protect the DJI Pilot Android application.

LPE exploit for CVE-2024-0582 (io_uring). Contribute to ysanatomic/io_uring_LPE-CVE-2024-0582 development by creating an account on GitHub.

Intro This blog post reflects our exploration of the Dirty Pipe Vulnerability in the Linux kernel. The bug was discovered by Max Kellermann and described here . If you haven’t read the original publication yet, we’d suggest that you read it first (maybe also…

by Krzysztof Okupski Introduction In our previous post on platform security (see here ) we provided a brief introduction into platform secu...

ImageIO is Apple’s Framework that handles image parsing, which exposes 0click attack surface

Security research on GPTs and LLMs has only just begun. It’s already become a meme to force customer service chatbots to start programming…

Update:

A detail guide on how to capture the flag using return oriented programming buffer overflow challenge on ROP Emporium.

Key Takeaways We provide a range of services, one of which is our Threat Feed, specializing in monitoring Command and Control frameworks like Cobalt Strike, Metasploit, Sliver, Viper, Mythic, Havoc, Meterpreter, and more. For example, the Cobalt Strike server…

xz/liblzma Backdoor: Open Source Nuke? Maybe Not That Bad! Story Background On March 29, 2024, a report exposing a backdoor in the upstream source code of the controversial open-source project, the xz software package, was made public on the oss-security…

When I announced my Black Ops 3 integrity bypass, someone commented that my research was not impressive and I should try analyzing Denuvo instead.
That kinda stuck with me, so I did what everyone would do and spent the last 5 months of my free time reverse…

An IBIS hotel check-in terminal leaked room door key codes of almost half of the rooms.

# Nightmare: One Byte to ROP // Deep Dive Edition ## Introduction In this write-up, we'll discuss ho

notes, honeypot, and exploit demo for the xz backdoor (CVE-2024-3094) - amlweems/xzbot

CVE-2024-3094 is a malicious code vulnerability in versions 5.6.0 and 5.6.1 of XZ Utils, enabling an SSH authentication bypass in certain Linux distributions