Carolina Trigo @hacknlearn

Trying to learn security research and getting overwhelmed by all the details? I just published a guide showing my process for step-by-step analysis of a security feature: windows-internals.com/an-exercise-in…

C God’s programming language.

Alexandre Borges has published over 700 pages of free security, malware and vulnerability research. A complete Malware Analysis Series covering Windows, macOS, iOS, Linux and shellcode. An Exploiting Reversing Series covering Windows kernel exploitation, Hyper-V, Chrome, and a three-part deep dive on CVE-2024-30085. No paywall. No course. Just research. Free as in beer. exploitreversing.com Author: @ale_sp_brazil #ReverseEngineering #MalwareAnalysis #InfoSec

0days-in-the-Wild — Real Zero-Day Exploits Analyzed by Google Project Zero 💀🔥 Want to study how real-world zero-days happen? • Tracks vulnerabilities actively exploited in the wild • Includes detailed Root Cause Analysis (RCA) reports • Covers browser, mobile, OS, and enterprise software exploits • Shows exploitation trends, bug classes, and attack techniques • Maintained by Google Project Zero researchers Instead of learning from theoretical examples, this repository lets you study actual zero-days that attackers used against real targets. 🔗 github.com/googleprojectz… #ZeroDay #ThreatIntelligence #GoogleProjectZero #CyberSecurity #InfoSec #RedTeam

Security research reporting is kinda the only situation where an individual has any power over a corporation. What goes unsaid: the researcher could easily sell exploits on the grey market and get rich. Most report out of morals, lowk a refusal to contribute to cyberwarfare. Vendors relying on those morals to bully are happily prodding good people until they crack

Katie🌻Moussouris (she/her/she-ra/she-hulk) 🪷 @k8em0

a week ago

Not that ‘responsible’ disclosure shit again 🙄 No vendor uses that term unless they want to call someone irresponsible. Even if someone drops 0day, patch & move on. Going after a researcher is a great way to turn 1 bad relationship into many terrible relationships.

3 43 300 46K 17

x.com/i/article/2060…

x86 segmentation maps memory references through segment registers. It is still used in modern x86-64 for FS/GS, especially thread-local storage and kernel per-CPU data. In sandboxing, segmentation can restrict untrusted code to a fixed memory region. MIT 6.858.

Plugin Contest winners used it. Binarly built award-winning Rust bindings with it. BinSync added an idalib mode for headless pipeline support... ... Now it's your turn. We're hosting a free virtual workshop on idalib — IDA as a library. Call IDA's analysis engine directly from your own code, automate workflows without launching the GUI, and integrate IDA into any toolchain you're already running. Free. Virtual. Hands-on. 👉 2dgu4h.share-eu1.hsforms.com/2D4ZYPjdCRFODE…

eBPF is kinda insane and nobody talks about it enough Netflix uses it to trace flow logs across their whole fleet without tcpdump eating the CPU. Cloudflare drops millions of malicious packets per second with XDP, before the kernel even bothers building an skb. that's the trick btw: XDP runs at the driver layer, so you reject junk traffic before the network stack wastes a single cycle on it. Google GKE dataplane v2 is built on Cilium/eBPF, and Google wrote about pushing it to 65,000-node clusters, which is frankly a stupid-big number. Netflix found a noisy-neighbor disk latency bug in prod that classic tools just couldn't see, because the latency was hiding between syscall and disk. practical tip most people miss: you don't need to write raw BPF bytecode like it's 2016. grab bpftrace, write a one-liner, get histograms of syscall latency in 10 seconds. and boom, you can see your prod read sizes live. no recompiles, no restarts, no downtime. the wild part is it's basically a tiny VM running sandboxed inside the kernel and the verifier won't even let you crash the thing. observability without the observer effect, finally. btw, I am building pktz - github.com/immanuwell/pktz - eBPF-powered network traffic monitor, per process, per connection, live. #ebpf #networking #cilium #devops #k8s #kubernetes #sre #cloud

This blog walks through bypassing ASLR and NX on ARM64 with two bugs that only work together. One leaks a memory address. The other turns that address into a shell. Either alone is harmless. Full walkthrough: 8ksec.io/arm64-reversin… Follow @8kSec for more practical security content

AI is good at identifying other weird machines. This is an interesting example of the not-so-trivial bug discovered by Mythos in the Linux epoll (event poll) subsystem.

Shift @Shiftreduce

2 weeks ago

We live in interesting times. Last month Linux patched a core uaf in the epoll subsystem, we rarely see these kind of bugs. As i like these kind of bugs, i wrote a few words about it here: guysrd.github.io

4 78 294 43K 198

One of the long-standing challenges in C++ RE has always been vtable REconstruction. AI now solves this, and you actually get richer context than you'd ever get from manual recovery. Previously, HexRaysCodeXplorer plugin was born to ease that pain back in the day, but now I need to rethink how to make it truly effective in this new reality.

Sploity sense is getting good thanks to OST2 and Chompie’s blogposts lmao

OpenSecurityTraining2 @OpenSecTraining

2 weeks ago

Uninitialized data use, race conditions (TOCTOU), Use-After-Free (UAF), type confusion & info leaks: Vulnerabilities 1002 ost2.fyi/Vulns1002 by @XenoKovah teaches real CVEs, not fake toy examples. Real exploit walkthroughs included. Level up your 'sploity sense!

2 13 75 4K 37

Oh, yes. Now we can understand things faster and get a lot of data to figure things out with more information in mind. Specially when learning complex stuff

chompie @chompie1337

a week ago

@S1r1u5_ To me it feels like there’s more time and bandwidth to execute complex ideas. Pain of tedious time sucking parts largely alleviated. Reminds me of studying math when WolfRamAlpha got rly good. Students that used it to cheat + never learned to derive the equations didnt make it

2 1 39 3K 4

I don’t play CTFs for a while and now I’m hearing colleagues and other competitors discussing the problem of solving the competition using AI. It seems so weird smh

Process Explorer has no driver file in its directory. It embeds the driver, and the 64-bit variant, as custom PE resources inside its own binary. Here's how that works: trainsec.net/library/window…

This talk is not about C++. This talk is about something more fundamental than C++. This talk is about the hardware. I want to talk about CPU caches because this is what is ultimately going to determine the performance of your program - Scott Meyers You are in for a treat with an opener like this! CPU Caches and Why You Care youtu.be/WDIkqP4JbkE.

Vivek Galatage @vivekgalatage

2 weeks ago

Cache Design, Management, and Tradeoffs by Onur Mutlu (@_onurmutlu_) youtu.be/_CzOaPRjt4Q

3 20 157 25K 154

wrote an article about the write() syscall explaining how a simple write call in Linux works all the way down to the electron level. Your binaries do not get saved the moment you call write(). They get saved when electrons are physically trapped inside the SSD. Check that out.

@

57 years ago

0 0 0 0 0

Before I started learning binary exploitation, a segfault just meant the program crashed and I needed to fix something. Now when I see a segfault I immediately want to know what address it tried to access, whether I put that address there, and how far into the buffer I was when it happened. The crash is not the end of the conversation anymore. It is the start of one. That shift in how you read a crash is actually what separates someone who is debugging from someone who is exploiting. The program is giving you information either way. What changes is what questions you are asking when you receive it. pwndbg makes this very visible. You can see exactly where execution stopped, what the stack looks like at that moment, what registers are holding and where they are pointing. Nothing is hidden. You only have to know what you are looking at. Learning to read a crash properly is probably the most transferable skill in this entire process. #pwncollege #BinaryExploitation #InfoSec

𝕡𝕨𝕟𝕚𝕖 @0day_ninja

2 weeks ago

Something nobody really talks about with buffer overflows is how much of the work is just reading. Reading the disassembly to understand what the binary expects. Reading the stack in pwndbg to know where you actually are. Reading the crash to figure out what you controlled and

0 3 27 3K 5

@tetsuoai amazing