Archive

Introduces the Search Connector Description schema that is used by Windows Explorer libraries and federated search providers.

In this post, I will introduce the "cookie sandwich" technique which lets you bypass the HttpOnly flag on certain servers. This research follows on from Bypassing WAFs with the phantom $Version cookie

JP (Translated by ChatGPT) In this article, I'll explain the intended solution for the "Tanuki Udon" challenge presented in SECCON CTF 13. TL;DR An XS-Leaks attack using Speculation Rules can be performed when the following conditions are met: The attacker can inject Speculation Rules into the victi…

Exploring the DOMPurify library: Hunting for Misconfigurations (2/2)

Technical analysis of CVE-2025-31201, a PAC bypass in libRPAC

Master AD attacks with Impacket: Kerberos exploitation, credential dumping, and lateral movement techniques for red teams.

In Microsoft Teams - "Attackers didn’t break in — they joined the meeting..."

We explain how we built a fuzzer for network applications that we tried to make as efficient and as effective as possible. We utilized custom mutators and input passing over shared memory and found that it gave us a huge speed and coverage boost compared to other network fuzzers.

(PhantomPersist) Written by: Grant Smith (S1n1st3r) - President @ Phantom Security Group

The WP GDPR Compliance plugin allows unauthenticated users to execute any action and update any database value. This vulnerability is due to the lack of proper validation in the Includes/Ajax.php file.

Real-world methods and payloads for testing email field security

Disclaimer: This article is intended for security professionals conducting authorized testing within the scope of a contract. The author is not responsible for any damage caused by the application of the provided information. The distribution of malicious programs, disruption of system operation, and violation of the confidentiality of correspondence are pursued by law. Introduction Many security researchers are familiar with the frustrating experience of discovering an XSS vulnerability that requires complex actions within an account, effectively making it only reproducible on the attacker’s account and thus losing its practical value.

breakpoint of no return

Learn how the OverlayFS vulnerability CVE-2023-0386 works, how to detect it and how to reproduce it.

Microsoft will be introducing Administrator Protection into Windows 11. This post explores security considerations for red teamers.

Active Directory remains the backbone of most corporate network environments. Despite being a mature technology with decades of security research behind it, ...

It is a sad truth in IT security that some vulnerabilities never quite want to die and time and time again, vulnerabilities that have long been fixed get revived and come right back at you. While researching relay attacks, the bane of Active …

Methodology

Shellcode reflective DLL injection (sRDI) still stands as a relatively stealthy technique in the Windows malware scene despite its age. What differentiates it from simpler DLL injection methods is that it doesn’t leave apparent traces to the targeted system’s disk, which is why it has a chance to bypass basic defensive solutions relying on e.g. signature detection. Steps Execution is passed to the loader from a separate injector, that injects the shellcode containing both loader and payload into the target process’s memory space (e.g. with VirtualAlloc). The reflective loader parses the process’s kernel32.dll to calculate the addresses of the functions required for relocation and execution. The loader allocates a continuous region of memory to load its own image into. The loader relocates itself into the allocated memory region with the help of its headers. The loader resolves the imports and patches them into the relocated image’s Import Address Table according to the previously gotten function addresses. The loader applies appropriate protections on each relocated section. The loader calls the relocated image’s entry point DllMain with DLL_PROCESS_ATTACH. Implementation The complete implementation can be found from a Gitea repository. The following explanations focus on the loader itself as the supporting components (process injector, shellcode generator, and payload) are basically just pasted from existing implementations mentioned in the references.

Key takeaways  Proofpoint identified a new, rebranded stealer based on ACR Stealer called Amatera Stealer.   It is delivered via web injects featuring sophisticated attack

The Qualys Threat Research Unit (TRU) has discovered two linked local privilege escalation (LPE) flaws. The first (CVE-2025-6018) resides in the PAM…

Research By: Artyom Skrobov, Slava Makkaveev Introduction Check Point Researchers have identified a susceptibility to advanced phishing attacks in certain modern Android-based phones, including models by Samsung, Huawei, LG and Sony. In these attacks, a remote agent can trick users into accepting new phone settings that, for example, route all their Internet traffic through a […]

A behind-the-scenes look at HelloTDS: the stealthy infrastructure driving FakeCaptcha scams, malware and more across millions of devices

Check Point Research uncovers Stealth Falcon's cyber espionage campaign exploiting a Microsoft Zero Day Vulnerability

According to Kaspersky, Librarian Ghouls APT continues its series of attacks on Russian entities. A detailed analysis of a malicious campaign utilizing RAR archives and BAT scripts.

Kaspersky GReAT experts describe the new features of a Mirai variant: the latest botnet infections target TBK DVR devices with CVE-2024-3721.