Archive

Vulnerability intelligence that predicts avenues of attack with speed and accuracy.

A deep dive into Google's NTLMv1 rainbow tables. Learn how rainbow tables are structured and can be used to recover NT hashes from NTLMv1 responses.

Background

Learn how attackers exploit tokenization, embeddings and LLM attention mechanisms to bypass LLM security filters and hijack model behavior.

Launch Linux processes from a Windows application using the WslLaunch API. Pavel walks through the call, the missing import library, and what the returned process handle actually points to.

Alt title: Bullying LLMs into submission to find 0days at scale

Malware Analysis Crash Course Jae Young Kim and Nick Harbour FLARE Learning Hub Contents Contents Introduction Prerequisite Knowledge Setting Up Ackknowledgements About the Authors Chapter 1: x86 Basics Assembly and Disassembly Data Types x86 Registers Instruction Basics MOV NOP Hacking Assembly...

Table of Contents Introduction What is WinGet? WinGet as a PowerShell Execution Proxy The Limitations of Using winget.exe Directly Building YAML Payloads Removing winget.exe from the Equation How the COM API Technique Works The Interop Layer What the Process Tree Looks Like Bypassing EDR Solutions CrowdStrike Falcon Microsoft Defender for...

TL;DR

This is the technical write up of a severe vulnerability I reported to Telegram’s Bug Bounty program on March 9th, 2024.  Telegram fixed…

Learn how a classic SSRF vulnerability on ideas.starbucks.com was turned into full internal network enumeration using a curated list of non-resolvable hostnames - and why that hostname intelligence is the real edge.

Rust for Malware Developmentis a comprehensive, open-source reference repository maintained by Whitecat18 (Smukx) that implements over 60 distinct offensive security techniques entirely in Rust. Targe...

How pwn.ai turned a routine client pentest into multiple ImageMagick zero-days. By autonomously researching the product’s internals for days, it found a path from a single image upload to file leaks, security policy bypasses, and remote code execution across a wide range of default and real-world configurations.

I had $100 in unused Google Cloud credits from my Google One Ultra plan and figured I’d put them toward something interesting. Over the long weekend I ended up building an automated pipeline that scans thousands of Windows kernel drivers for exploitable vulnerabilities, specifically looking for ones that can be used in BYOVD (Bring Your Own Vulnerable Driver) attacks. On its first real run on a massive driver pack, it successfully flagged a zero-day in an ASUS driver.

Contribute to Zierax/My-Recon-Methology development by creating an account on GitHub.

This blog provides an in-depth analysis of the malicious “msimg32.dll” used in Qilin ransomware attacks, which is a multi-stage infection chain targeting EDR systems.

Once you gain a foothold on a Windows host, the next objective is often to compromise additional machines. The fastest way to achieve this is by harvesting credentials and other secrets for reuse. However, nowadays, most known techniques for collecting Windows secrets and credentials are detected and blocked by EDR

How to systematically extract struct field offsets from Apple's stripped XNU kernelcache using static analysis alone.

Author: Dr. Xiang Fu Roadmap: You need to first follow Tutorials 1 to 4 to set up the lab configuration. Then each tutorial addresses an ...

Executive Summary The EXPMON system detected a highly-sophisticated PDF exploit targeting Adobe Reader users. Based on our analysis, the sam...

I’ve had a number of people ask me what approaches I have taken to secure that initial foothold on a machine/network during a pentest engagement. Well, the blunt and honest answer to that question is…it depends 😸 Initial access comes in many forms and depending on the type of pentest engagement, you will be afforded or NOT afforded various types of “lures” you can use to acquire that first foothold. Most clients are open to the pentest team exhausting all their resources and offensive tooling to truly assess the client’s security controls. If not they should be. Because in a real world attack, you better believe the threat actor will not hold back! In today’s post, I’ll be going over a very traditional approach to achieving initial access using email as our attack vector of choice. I’ll go over various ways to send the email (gui and non-gui) and using attachments versus links. I’ll also explain how to contend with MOTW (Mark of the Web) and SmartScreen security restrictions on your downloaded payloads for the modern Windows 11 environment.

High-Scale Driver Vulnerability Research with Agent Swarms

CVE-2026-34197 is an ActiveMQ RCE flaw exploiting Jolokia to execute remote commands. Learn how it works, affected versions, and detection steps.

CVE-2026-34980 + CVE-2026-34990: two CUPS vulnerabilities, discovered by an autonomous LLM pipeline, chainable from unaut'd remote print job to root file (over)write.

Censys ARC discovered a previously undocumented, Russian-origin remote access toolkit dubbed "CTRL." Learn about the malware and how it works.

Samsung Internet on the Galaxy S25 shipped a six-month-old version of V8, exposing it to publicly known bugs. Learn how we exploited a bytecode interpreter vulnerability to achieve renderer RCE and universal XSS in the browser.

The article demonstrates how to analyze Windows shellcode in Ghidra by identifying API-hashing routines, resolving hidden Windows API calls, and extracting C2 infrastructure without relying on automated emulation tools.