Archive

Red Teamer & Low-Level Developer. Deep dives into Windows Internals, Kernel Exploitation, Driver Analysis, and Red Team techniques.

Technical deep dive into ClickFix tradecraft, a sophisticated social engineering driven initial access technique. Covers delivery methods, execution specializations, payload analysis, and detection strategies based on OrangeCon 2026 research.

Map how Claude built two FreeBSD kernel exploit chains, escaping a jail past KASLR and SMEP/SMAP, with a human still in the loop.

Contribute to SmtimesIWndr/gdid-reversal development by creating an account on GitHub.

Ransomware affiliates have long since abused Cloudflared tunnels to maintain persistent access to compromised environments. These tunnels can be utilized as a strong indicator of compromise when examined at-scale.

Static analysis of Browser Guard 3.1.5 (15M+ installs): Zstd-encoded on-disk databases, the heuristic rule engine that scans the live DOM, the Hubble false-positive service, the package update protocol, and a debug URL interface left in production. With reimplementations in C# and Python.

CAPE's agent exposes unauthenticated localhost routes to the sample under analysis, enough to fingerprint the sandbox, plant bogus network IOCs on VirusTotal, and shut the whole analysis down with a single request.

A use-after-free in OpenVPN's tls-crypt-v2. The safety check meant to stop the server sending a client freed memory has a blind spot, so during a routine key renegotiation OpenVPN frees a buffer it's about to send — and hands whatever now sits in that memory to the client.

Analyzing and writing a PoC for CVE-2025-38352.

Overview Since February 2026, the XLAB large-scale network threat perception system has detected a new malware family active in cyberspace that adopts a Loader + Core (two-stage loading) architecture. Currently, the family has spawned multiple variants, with the main core functionality being the execution of large-scale Distributed Denial-of-Service (DDoS) attacks. It also possesses strong cross-platform adaptability and continuous evolution capabilities. Although the family's current activi

A novel and powerful twist on an old classic.

Say you handed me your phone, what’s the worst I could do in 10 seconds?

How to detect malware that runs on Linux systems without writing on disk

Tenebris-Gate is used to encrypt shellcode and bypass detection through layered evasion techniques.

Vulnerability discovery is an orchestration problem, not a frontier-model problem.

How Reddit accidentally leaked its spamurai system.

Technical analysis of a combination of two legitimate CivetWeb features producing arbitrary remote code execution.

Trying to coerce useful work out of LLMs without the harness is like supervising a room full of drunk toddlers, each convinced they're helping, none of them checking with each other and falling over the next.

Move past basic credential harvesting. Discover how modern attackers use ClickFix, BitB, and OAuth consent phishing—and how to train your users with Huntress SAT.

A single response-content-type query parameter on a public bucket object turns a forced image/png into text/html, which is stored XSS on the target's own origin. MinIO hands it to you for free. S3 takes one extra step.

Essential Kubernetes security best practices — pod security, RBAC, network policies, and runtime protection for containerized workloads.

SpecterOps reverse engineered Cortex XDR with LLMs to extract YARA rules, ML models, and behavioral detections.

Deep dive into Beacons: what they are, how they run in memory, the evolution of loaders (including prepended/Kayn styles), and the security implications defenders need to know.

Part 2: How the Red Agent bypassed backend resolvers to expose an entire airline booking database in fifteen minutes

At WWDC 2025, Apple announced macOS 26 Tahoe. One of the new features in macOS Tahoe is a new disk image format: ASIF. Designed for use with virtual machines (its documentation lives under the Virtualization framework), ASIF takes a lot of inspiration from existing virtual disk formats. Practically, that means it’s another sparse virtual disk format, and functions very similar to sparse VMDK, VHDX or QCOW2 files (for the uninitiated, it allow you to store a large disk, or file, in a smaller, “sparse” manner).