Archive

In this post, I’ll talk about the new WiFi related features that have been recently implemented into bettercap, starting from how the EAPOL 4-way handshake capturing has been automated, to a whole new

Gsuite is an immensely powerful tool for account administration. It allows the administrator to control just about anything regarding the user accounts in his organization, from determining how one can login and which apps he can access, to which contacts are allowed and what Email headers should be applied. This last

DLL Hijacking is a popular technique for executing malicious payloads. This post lists nearly 300 executables vulnerable to relative path DLL Hijacking on Windows 10 (1909), and shows how with a few lines of VBScript some of the DLL hijacks can be executed with elevated privileges, bypassing UAC.

In this post I'll look at some use-after-free vulnerabilities in Chrome which were the result of object lifetime misassumptions based on objects being kept alive unexpectedly in audio callbacks.

A vulnerability in Bitdefender Antivirus allowed any website to run arbitrary code with user's privileges. This was caused by issues very similar to ones found in other antivirus products before.

This is 🍊 speaking

Introduces the Search Connector Description schema that is used by Windows Explorer libraries and federated search providers.

In this post, I will introduce the "cookie sandwich" technique which lets you bypass the HttpOnly flag on certain servers. This research follows on from Bypassing WAFs with the phantom $Version cookie

JP (Translated by ChatGPT) In this article, I'll explain the intended solution for the "Tanuki Udon" challenge presented in SECCON CTF 13. TL;DR An XS-Leaks attack using Speculation Rules can be performed when the following conditions are met: The attacker can inject Speculation Rules into the victi…

Exploring the DOMPurify library: Hunting for Misconfigurations (2/2)

Technical analysis of CVE-2025-31201, a PAC bypass in libRPAC

Master AD attacks with Impacket: Kerberos exploitation, credential dumping, and lateral movement techniques for red teams.

In Microsoft Teams - "Attackers didn’t break in — they joined the meeting..."

We explain how we built a fuzzer for network applications that we tried to make as efficient and as effective as possible. We utilized custom mutators and input passing over shared memory and found that it gave us a huge speed and coverage boost compared to other network fuzzers.

(PhantomPersist) Written by: Grant Smith (S1n1st3r) - President @ Phantom Security Group

The WP GDPR Compliance plugin allows unauthenticated users to execute any action and update any database value. This vulnerability is due to the lack of proper validation in the Includes/Ajax.php file.

Real-world methods and payloads for testing email field security

Disclaimer: This article is intended for security professionals conducting authorized testing within the scope of a contract. The author is not responsible for any damage caused by the application of the provided information. The distribution of malicious programs, disruption of system operation, and violation of the confidentiality of correspondence are pursued by law. Introduction Many security researchers are familiar with the frustrating experience of discovering an XSS vulnerability that requires complex actions within an account, effectively making it only reproducible on the attacker’s account and thus losing its practical value.

breakpoint of no return

Learn how the OverlayFS vulnerability CVE-2023-0386 works, how to detect it and how to reproduce it.

Microsoft will be introducing Administrator Protection into Windows 11. This post explores security considerations for red teamers.

Active Directory remains the backbone of most corporate network environments. Despite being a mature technology with decades of security research behind it, ...

It is a sad truth in IT security that some vulnerabilities never quite want to die and time and time again, vulnerabilities that have long been fixed get revived and come right back at you. While researching relay attacks, the bane of Active …

Methodology

Shellcode reflective DLL injection (sRDI) still stands as a relatively stealthy technique in the Windows malware scene despite its age. What differentiates it from simpler DLL injection methods is that it doesn’t leave apparent traces to the targeted system’s disk, which is why it has a chance to bypass basic defensive solutions relying on e.g. signature detection. Steps Execution is passed to the loader from a separate injector, that injects the shellcode containing both loader and payload into the target process’s memory space (e.g. with VirtualAlloc). The reflective loader parses the process’s kernel32.dll to calculate the addresses of the functions required for relocation and execution. The loader allocates a continuous region of memory to load its own image into. The loader relocates itself into the allocated memory region with the help of its headers. The loader resolves the imports and patches them into the relocated image’s Import Address Table according to the previously gotten function addresses. The loader applies appropriate protections on each relocated section. The loader calls the relocated image’s entry point DllMain with DLL_PROCESS_ATTACH. Implementation The complete implementation can be found from a Gitea repository. The following explanations focus on the loader itself as the supporting components (process injector, shellcode generator, and payload) are basically just pasted from existing implementations mentioned in the references.