One of the many areas of this field that I really enjoy is the "cat and mouse" game played between RedTeam and BlueTeam, each forcing the other to up their game. Often we see some awesome tools being released to help defenders detect malware or shellcode…

Errata Or Nah? Over the last 2-3 years, Microsoft has inserted various methods of virtualization introspection detection (big brain words) into the workings of patchguard. It shouldn’t come as surprise that this has happened, as subverting kernel patch protection…

#Sysmon 11 is out with a new Event type and several improvements! I’ve published a blog post detailing all new features here: https://t.co/kHcnnX1Ue6 #DFIR #Sysinternals #ThreatHunting

A TCP reset attack is executed using a single packet of data, no more than a few bytes in size. A spoofed TCP segment, crafted and sent by an attacker, tricks two victims into abandoning a TCP connection, interrupting possibly vital communications between…

Instant messaging apps have become the de-facto standard of real-time, text-based communications. The acquisition of instant messaging chats and communication histories can be extremely important for an investigation. In this article, we compare the five…

Hooking C/C++ code in Android application using Frida with introduction and explainations in every step - noob friendly

We are excited to announce that the Rust/WinRT project finally has a permanent and public home on GitHub: https://github.com/microsoft/winrt-rs Rust/WinRT follows in the tradition established by C++/WinRT of building language projections for the Windows Runtime…

A few months ago I came across a curious design pattern on Google Scholar. Multiple screens of the web application were fetched and rendered using a combination of location.hash parameters and XHR to retrieve the supposed templating snippets from a relative…

Buy artik.blue for 100 on GoDaddy via ExpiredDomains.com. This premium expired .blue domain is ideal for establishing a strong online identity.

Chapter 1: Down the rabbit hole


To start this journey I'll cover some backstory on the Flutter stack and how it works.

What you probably already know: Flutter was built from the ground up with its own render pipeline and widget library, allowing it to…

On 8 January 2020, Mozilla released an advisory regarding a vulnerability in Firefox. On 17 January, Microsoft reported that 0-day attacks exploiting a vulnerability in Internet Explorer (IE) had been seen in the wild. JPCERT/CC confirmed attacks exploiting…

A bug caused 30 minutes of work on an email to disappear. However, I was able to recover it by poking around in the process memory using gdb/gcore. Here’s how.

Mutex analysis is an often overlooked and useful tool for malware author fingerprinting, family classification, and even discovery.

This is an exploit for CVE-2020-0674 that runs on the x64 version of IE 8, 9, 10, and 11 on Windows 7. - maxpl0it/CVE-2020-0674-Exploit

Heading into the research talks at BAR 2019 now. Up first is B2R2: Building an Efficient Front-End for Binary Analysis, our best paper winner.

ELF file viewer/editor for Windows, Linux and MacOS. - horsicq/XELFViewer