Updated: 2 May 2026 With Technitium DNS Server , you can not just consume DNS-over-HTTPS (DoH), DNS-over-TLS (DoT), or DNS-over-QUIC...

So I’ve been doing quite a lot of Wargames & CTFs and I was looking to research a “real” production application.

TL;DR: Can we use GPUs to get 10x performance/dollar when fuzzing embedded software in the cloud? Based on our preliminary work, we think the answer is yes! Fuzzing is a software testing technique that supplies programs with many randomized inputs in an attempt…

Intro The Ryuk threat actors went from a phishing email to domain wide ransomware in 5 hours. They escalated privileges using Zerologon (CVE-2020-1472), less than 2 hours after the initial phish. They used tools such as Cobalt Strike, AdFind, WMI, and PowerShell…

On October 20, VMware released a  security patch  addressing six vulnerabilities in VMware ESXi, Workstation, Fusion, and NSX-T. Two of those bugs fall into the category of Time-of-check Time-of-use (TOCTOU) race conditions. Now that the patch is out, I wanted…

Exploiting Android deep links and exported components By Kyle B3nac @b3nac

I recently watched a series of really good videos from Brad Duncan, the man behind malware-traffic-analysis.net, and my initial takeaway was that setting up Wireshark properly will lead to a much b…

Bypassing NTFS permissions to read any files as unprivileged user. - ioncodes/CVE-2020-16938

This is a blog post I wanted to write for a while now, but somehow never got the time for it, and I also knew that it will require lots of time, so I kept delaying it. I finally kicked my ass, sat down, and wrote it.
The goal of the post is to cover many…

wsb-detect enables you to detect if you are running in Windows Sandbox ("WSB") - LloydLabs/wsb-detect

The vulnerability, codenamed “Bad Neighbor”, is a bug in the IPv6 Neighbor Discovery Protocol, particularly it’s improper handling of ICMPv6 Router Advertisement Packets. While publicly available proof of concept (PoC) code results in a denial of service…

Writeup of a hard RE challenge hosted by the National Cyber-Security Center of Hungary featuring PIE binary to SO lib transformation.

Explicit intents have a set receiver (the name of an app package and the class name of a handler component) and can be delivered only to a predetermined component (activity, receiver, service). With implicit intents, only certain

  by Mitja Kolsek, the 0patch Team   [Update 1/22/2021: This vulnerability did not get patched by December 2020 or January 2021 Extended Se...

Intro Defending an Active Directory environment, particularly a large one, is a daunting task. Telemetry generated by Active Directory itself as well as the hosts connected to it are critical…

Academic papers related to fuzzing, binary analysis, and exploit dev, which I want to read or have already read - 0xricksanchez/paper_collection

Bugcrowd Founder Casey Ellis talks about COVID-19's impact on bug bounty hunters, bug bounty program adoption and more.

A few months ago, I discovered a remote code execution issue in the Discord desktop application and I reported it via their Bug Bounty Prog...