Download the Writeup Illustration Romain Flamand – Flamingo Studio – [email protected] Abstract Secure elements are small microcontrollers whose main purpose is to generate/store secrets and then execute cryptographic operations. They undergo the highest…

Patch Diffing CVE-2024-20696 Windows Libarchive Remote Code Execution Vulnerability

Analysis of CVE-2024-30078, a Windows Wi-Fi driver vulnerability. Detailed root cause analysis and exploitation constraints.

Automation tool to testing and confirm the xss vulnerability. - iamunixtz/LazyXss

Introduction As we know, Windows has a proprietary hybrid kernel, written in C, C++, and Asm, called ntoskrnl.exe (also ntkrnlpa.

Part I: IntroductionWindows ApplicationsWindows applications normally perform operations by interacting with the Windows Application Program Interface (WinAPI). The WinAPI then performs some processing of parameters to normalize them or calculate additional…

I am currently working on an emulation environment similar to Qiling.
Unlike Qiling, it emulates the entire user-space, not just the target application.
As Qiling reimplements all APIs (kernel32, vcruntime, …) outside the emulator, it gains a lot of speed…

Long time no see! After 3 years of no new blog posts and also no conference talks from my side, I decided it’s time to write again. I’ll start easy with a fun story that happened a while …

URGENT: Critical security advisory for Kibana users. Update to version 8.15.1 now to mitigate vulnerabilities CVE-2024-37288 and CVE-2024-37285.

Reverse engineering VPN client software to hijack session cookies.

Bytecode Injection (Part 3) With all the basics out of the way, this blog post shows the first bytecode - based exploitation technique on Android: bytecode injection! This opens the door to many interesting exploits, where injected bytecode can function as…

Discover critical Feeld app vulnerabilities from our pentest. See how flaws in security controls expose personal data and learn key fixes.

We layout the different levels of maturity your organization may be at in their Security Canary Maturity, as well as discussing the value in maturity models themselves.

Bytecode Reuse Attack (Part 4) As last blog post on bytecode - based exploitation on Android, the next step following bytecode injection is discussed, namely: bytecode reuse.
To answer the question about why an attacker needs bytecode reuse, although there…

Welcome back to another watchTowr Labs blog. Brace yourselves, this is one of our most astounding discoveries.


Summary

What started out as a bit of fun between colleagues while avoiding the Vegas heat and $20 bottles of water in our Black Hat hotel rooms…

Explore Cleafy's analysis of a newly discovered TrickMo variant, revealing enhanced malware capabilities and critical endpoints used for storing stolen credentials and data from victims. Here is the latest threat analyst report.