This is the part 1 for Triaging a Windows system with Powershell. On a Windows machine, Event Logs play an important role in determining a…

The current blog is in continuation of Part 1 of Windows Triaging with Powershell. Part 1 described how the Powershell functions can be…

The Android permission management system has already suffered from several vulnerabilities in the past. Such weaknesses can grant dangerous permissions to a malevolent application, an example being CALL_LOG, which gives access to all incoming and outgoing…

Microsoft shares new details about techniques of a distinct Russian state-sponsored threat actor, now elevated to the name Cadet Blizzard.

In this intrusion, dated May 2023, we observed Truebot being used to deploy Cobalt Strike and FlawedGrace (aka GraceWire & BARBWIRE) resulting in the exfiltration of data and the deployment of …

Background The discovery and analysis of vulnerabilities is a critical aspect of cybersecurity research. Today, we will dive into CVE-2023-1829, a vulnerability in the cls_tcindex network traffic classifier found by Valis. We will explore the process of exploiting…

Introduction TurboRand is a v8 exploitation during the TyphoonCTF 2023, this challenge (a.k.a TruboFan is no Fun) centred around a TurboFan (V8’s optimising compiler) type confusion bug. For the challenge we provided contenders with multiple files: Looking…

This is a summary of a Server Side Template Injection vulnerability found and used as RCE.

Microsoft discovered an attack using a patched version of OpenSSH to take control of impacted devices and install cryptomining malware.

Jormungandr is a kernel implementation of a COFF loader, allowing kernel developers to load and execute their COFFs in the kernel. - GitHub - Idov31/Jormungandr: Jormungandr is a kernel implementa...

Although the Android base is open source, many different constructors customize it with their own UIs and APIs. All these additions represent an extra attack surface that can change from one phone model to another. We tried to automatically fuzz the closed…

Last March, experts from the Spanish cybersecurity company Tarlogic shared their findings regarding a vulnerability in communications bluetooth used every day

A brand-new Burp Suite extension for discovering DNS vulnerabilities in web applications.

A collection of interesting and diverse Android malware samples

We always assume prepared statements and ORMs are enough to protect us from SQL injection, but be careful not to misuse their APIs! Let's look into a real-world case and see what we can learn from it.

In this blog post, we unpack a malicious sample sha256: 2c05efa757744cb01346fe6b39e9ef8ea2582d27481a441eb885c5c4dcd2b65b . The core…

With the rise of internet and increasing risks of getting hacked, it's more than necessary nowadays that we have an extra layer of security on our accounts, since password alone is not enough. Thus, using Phone numbers for 2FA sounds much more secure, but…