Archive

How a missing @PreAuthorize line in GeoNetwork led to unauthenticated Remote Code Execution across government geospatial infrastructure in 39 countries.

Introduction What if I told you six thousand of your employees were two steps removed from gaining full control over your IT infrastructure. If we told you this was related...

Analysis of server-side data associated with The Gentlemen ransomware group identified the complete TukTuk C2 project structure, DLL side-loading configurations, EDR neutralization research, vulnerable driver materials, and data assessed to have been exfiltrated from multiple organizations.

PwnEye can compromise cameras through ONVIF and RTSP. It can play the stream, deface a camera, move it and get a shell.

Learn Basic Concepts of Linux. Best site to learn Linux from beginner to Advanced.

Prove or reject unauthenticated remote OS command execution as the PaperCut service account on stock PaperCut NG/MF 25.0.11 via a pre-auth Release Station / MFD card-ID flow reaching the external card-lookup runtime, then replay identically on stock 25.0.12 to confirm the fix blocks the chain. This maps to the PaperCut NG/MF URGENT Security Bulletin of 27 Aug 2026 active exploitation, all versions affected . Whether a stock remote mechanism exists is an open question; card-ID SQL injection and JDBC URL injection are unproven hypotheses only.

AmberWolf Security Research Blog

Technical analysis of 39+ open-source AI pentesting agents — architecture, benchmark aggregation across 8 frameworks, and tool chaining from recon to exploit.

Security research by R3dpars3c documenting a Universal XSS vulnerability in Google Translate.

Multiple critical vulnerabilities at Plausible Analytics: pre-auth Storybook RCE, registration bypass with cross-tenant IDORs and stored XSS, and SSO verification SSRF to PostgreSQL RCE.

We found PavinLoader being used across ClickFix, fake software, and RenPy campaigns to deliver Amatera Stealer and other malware.

a collaborative hunt: finding access tokens, Copilot chat logs, and other private information inside Microsoft employee diagnostic data

Vulnerability intelligence that predicts avenues of attack with speed and accuracy.

Losing access to VirusTotal Intelligence at the start of the year was surprisingly productive. Unable to hunt for interesting new malware, I stopped adding to my “TODO” pile and finally worked through my backlog from last year. That led to a detailed examination of BeheMOF as well as the discovery of this malware. Upon closer inspection, a sample that did not seem too noteworthy at first turned out to have a distinctive design once I looked under the hood: a passive backdoor that opens no obvious listening port and carries no payload inside itself. It waits in memory doing nothing at all until one specifically crafted network packet reaches the machine, which is why I am calling it SLEEPWALKER.

AmberWolf Security Research Blog

A single static Go binary that decrypts and unpacks FortiOS firmware end to end, plus the FortiOS 7.4 config-secret key nobody had published before this.

New Loader Hiding Shellcode in Plain English Words

How I registered a Linux machine with Apple's private services, received an existing Find My People key over IDS, and decrypted the live location without a Mac.

I remember watching Simon Scannell's REcon 2023 talk, You Have Become the Very Thing You Swore to Destroy, and being deeply impressed by how he turned ClamAV's own detection logic into an oracle for exploiting a service with no direct output channel. I remember hoping that, someday, I might have the

Introduction Running Tailscale as a network layer for C2 traffic is not a new idea. What makes this implementation different is that the entire Tailscale daemon runs inside the implant process with no driver, no service, no disk state, and no child processes. Traffic relays over standard WebSockets that are indistinguishable at the edge from […]

Abstract We all know AI can find bugs. After a decade of research, I asked a harder question: can an autonomous system invent new attack techniques, and use them to hack live websites at scale? Buildi

Hunting Exchange Server 0day like a detective It has been a while since my last blog post, not because I didn’t do anything (or I?), I just don’t have any time/ any motivation to start new blog …

HiveMQ Platform 4.54.0 Data Hub custom module upload extracts ZIP entries with path.resolve() and no containment checks. Using the shipped default…

Learn how Chromium browser extensions can be silently sideloaded to establish persistent C2 access and how to detect it with Sysmon.

The first open source Mythic C2 agent with a full in-memory BOF loader for macOS and Linux, including Apple Silicon. No fork and runs, no baked in capabilities.

Unlocking _everything_ on the CPU with DRAM scrambling - xoreaxeaxeax/skitter-creek-bath-salts