Trying to learn security research and getting overwhelmed by all the details?
I just published a guide showing my process for step-by-step analysis of a security feature: windows-internals.com/an-exercise-in…
Alexandre Borges has published over 700 pages of free security, malware and vulnerability research.
A complete Malware Analysis Series covering Windows, macOS, iOS, Linux and shellcode. An Exploiting Reversing Series covering Windows kernel exploitation, Hyper-V, Chrome, and a three-part deep dive on CVE-2024-30085.
No paywall. No course. Just research. Free as in beer.
exploitreversing.com
Author: @ale_sp_brazil#ReverseEngineering#MalwareAnalysis#InfoSec
0days-in-the-Wild — Real Zero-Day Exploits Analyzed by Google Project Zero 💀🔥
Want to study how real-world zero-days happen?
• Tracks vulnerabilities actively exploited in the wild
• Includes detailed Root Cause Analysis (RCA) reports
• Covers browser, mobile, OS, and enterprise software exploits
• Shows exploitation trends, bug classes, and attack techniques
• Maintained by Google Project Zero researchers
Instead of learning from theoretical examples, this repository lets you study actual zero-days that attackers used against real targets.
🔗 github.com/googleprojectz…#ZeroDay#ThreatIntelligence#GoogleProjectZero#CyberSecurity#InfoSec#RedTeam
Security research reporting is kinda the only situation where an individual has any power over a corporation. What goes unsaid: the researcher could easily sell exploits on the grey market and get rich. Most report out of morals, lowk a refusal to contribute to cyberwarfare. Vendors relying on those morals to bully are happily prodding good people until they crack
Not that ‘responsible’ disclosure shit again 🙄
No vendor uses that term unless they want to call someone irresponsible.
Even if someone drops 0day, patch & move on. Going after a researcher is a great way to turn 1 bad relationship into many terrible relationships.
x86 segmentation maps memory references through segment registers.
It is still used in modern x86-64 for FS/GS, especially thread-local storage and kernel per-CPU data.
In sandboxing, segmentation can restrict untrusted code to a fixed memory region.
MIT 6.858.
Plugin Contest winners used it. Binarly built award-winning Rust bindings with it. BinSync added an idalib mode for headless pipeline support...
... Now it's your turn.
We're hosting a free virtual workshop on idalib — IDA as a library. Call IDA's analysis engine directly from your own code, automate workflows without launching the GUI, and integrate IDA into any toolchain you're already running.
Free. Virtual. Hands-on.
👉 2dgu4h.share-eu1.hsforms.com/2D4ZYPjdCRFODE…
eBPF is kinda insane and nobody talks about it enough
Netflix uses it to trace flow logs across their whole fleet without tcpdump eating the CPU.
Cloudflare drops millions of malicious packets per second with XDP, before the kernel even bothers building an skb.
that's the trick btw: XDP runs at the driver layer, so you reject junk traffic before the network stack wastes a single cycle on it.
Google GKE dataplane v2 is built on Cilium/eBPF, and Google wrote about pushing it to 65,000-node clusters, which is frankly a stupid-big number.
Netflix found a noisy-neighbor disk latency bug in prod that classic tools just couldn't see, because the latency was hiding between syscall and disk.
practical tip most people miss: you don't need to write raw BPF bytecode like it's 2016.
grab bpftrace, write a one-liner, get histograms of syscall latency in 10 seconds.
and boom, you can see your prod read sizes live. no recompiles, no restarts, no downtime.
the wild part is it's basically a tiny VM running sandboxed inside the kernel and the verifier won't even let you crash the thing.
observability without the observer effect, finally.
btw, I am building pktz - github.com/immanuwell/pktz - eBPF-powered network traffic monitor, per process, per connection, live.
#ebpf#networking#cilium#devops#k8s#kubernetes#sre#cloud
This blog walks through bypassing ASLR and NX on ARM64 with two bugs that only work together. One leaks a memory address. The other turns that address into a shell. Either alone is harmless.
Full walkthrough: 8ksec.io/arm64-reversin…
Follow @8kSec for more practical security content
AI is good at identifying other weird machines. This is an interesting example of the not-so-trivial bug discovered by Mythos in the Linux epoll (event poll) subsystem.
We live in interesting times.
Last month Linux patched a core uaf in the epoll subsystem, we rarely see these kind of bugs.
As i like these kind of bugs, i wrote a few words about it here: guysrd.github.io
One of the long-standing challenges in C++ RE has always been vtable REconstruction. AI now solves this, and you actually get richer context than you'd ever get from manual recovery.
Previously, HexRaysCodeXplorer plugin was born to ease that pain back in the day, but now I need to rethink how to make it truly effective in this new reality.
Uninitialized data use, race conditions (TOCTOU), Use-After-Free (UAF), type confusion & info leaks: Vulnerabilities 1002 ost2.fyi/Vulns1002 by @XenoKovah teaches real CVEs, not fake toy examples. Real exploit walkthroughs included. Level up your 'sploity sense!
Oh, yes. Now we can understand things faster and get a lot of data to figure things out with more information in mind.
Specially when learning complex stuff
@S1r1u5_ To me it feels like there’s more time and bandwidth to execute complex ideas. Pain of tedious time sucking parts largely alleviated. Reminds me of studying math when WolfRamAlpha got rly good. Students that used it to cheat + never learned to derive the equations didnt make it
I don’t play CTFs for a while and now I’m hearing colleagues and other competitors discussing the problem of solving the competition using AI. It seems so weird smh
Process Explorer has no driver file in its directory. It embeds the driver, and the 64-bit variant, as custom PE resources inside its own binary. Here's how that works: trainsec.net/library/window…
This talk is not about C++. This talk is about something more fundamental than C++. This talk is about the hardware. I want to talk about CPU caches because this is what is ultimately going to determine the performance of your program - Scott Meyers
You are in for a treat with an opener like this!
CPU Caches and Why You Care
youtu.be/WDIkqP4JbkE.
wrote an article about the write() syscall explaining how a simple write call in Linux works all the way down to the electron level.
Your binaries do not get saved the moment you call write(). They get saved when electrons are physically trapped inside the SSD.
Check that out.
Before I started learning binary exploitation, a segfault just meant the program crashed and I needed to fix something.
Now when I see a segfault I immediately want to know what address it tried to access, whether I put that address there, and how far into the buffer I was when it happened.
The crash is not the end of the conversation anymore. It is the start of one.
That shift in how you read a crash is actually what separates someone who is debugging from someone who is exploiting. The program is giving you information either way. What changes is what questions you are asking when you receive it.
pwndbg makes this very visible. You can see exactly where execution stopped, what the stack looks like at that moment, what registers are holding and where they are pointing. Nothing is hidden. You only have to know what you are looking at.
Learning to read a crash properly is probably the most transferable skill in this entire process.
#pwncollege#BinaryExploitation#InfoSec
Something nobody really talks about with buffer overflows is how much of the work is just reading.
Reading the disassembly to understand what the binary expects. Reading the stack in pwndbg to know where you actually are. Reading the crash to figure out what you controlled and
7K Followers 2K Following✨my opinions are on my own✨ ex gamedev, offsec, mobile hacker, rev engineer, Android&iOS. (pt/en/es/de/ch/no) - au + ah/sd. acesse @tramoia_sh
10K Followers 392 Followingtrabalho com cybersegurança tenho 15+ anos em TI; gosto de web hacking e ai hacking também faço textos sobre tecnologia sob demanda.
22K Followers 276 FollowingI find and exploit 0day, develop OSes, hypervisors and emulators, design massively parallel data structures and code, and do precision machining! Optimization❤️
10K Followers 20 FollowingA Singapore company that discovers vulnerabilities to help customers mitigate the risks of cyber attacks. Organisers of @offbyoneconf
89K Followers 16 FollowingTrendAI Zero Day Initiative™ (ZDI) is a program designed to reward security researchers for responsibly disclosing vulnerabilities.
797 Followers 106 FollowingEE student • Mathematics enthusiast & researcher
Building computer vision, audio recognition, and embedded systems from scratch.
Interested in signal processing
34K Followers 316 Following@Intel is at the forefront of silicon-level #security innovation working across the ecosystem to help protect customers from emerging threats.
2K Followers 143 FollowingJust a guy who likes anime, fighting games, hypervisors and reverse engineering. Member of @the_secret_club. Do not DM me about game cheats.
2K Followers 142 FollowingSecurity Professional and Researcher with over a decade of experience. I'm fairly low profile, but share useful info from time to time.
11K Followers 174 FollowingSoftware developer.
Posting about things that I've met during reading source code of different systems.
Author of linux-insides.
8K Followers 1K Following👩🏻🏫 Professora Livre-Docente em Estatística e Ciência de Dados 💻
Aprenda comigo direto da sala de aula USP: https://t.co/BkkGMYGAiG