While performing research on Infoblox's NetMRI network automation and configuration management solution, we discovered 5 vulnerabilities.

This case demonstrates that effective smartphone espionage doesn't always require expensive zero-day exploits or the development of sophisticated, custom and undetected spyware. Instead, attackers can achieve significant intelligence gains using older, off…

Still Using Cards? You’re the Weakest Link in the Payment Chain

This is the personal website of Egidio Romano, a very curious guy from Sicily, Italy. He's a computer security enthusiast, particularly addicted to webapp security.

From rate limits to no limits: How IPv6's massive address space and a crafty botguard bypass left every Google user's phone number vulnerable

CVE-2025-47934 allows attackers to spoof arbitrary signatures and encrypted emails that appear as valid in OpenPGP.js. The only requirement is access to a single valid signed message from the target author ("Alice"). Since this undermines the core principle…

proofnet ist spezialisiert auf Security PenTests im Connected Car Umfeld.

It is a sad truth in IT security that some vulnerabilities never quite want to die and time and time again, vulnerabilities that have long been fixed get revived and come right back at you. While researching relay attacks, the bane of Active …

Découvrez le rôle des comptes machines dans Active Directory en pentest et les attaques possibles (Shadow Credentials, RBCD, Silver Ticket).

breakpoint of no return

You just can't finish off Zuckerberg.

One important subject to discuss when talking about vulnerability management is the day you open the valve on a code scanning tool that generates an enormous number of security findings. This has been a problem in information security since the early 2000s…

GitHub Device Code phishing: A new attack vector targeting developers. Learn how attackers abuse OAuth flows to compromise organizations and steal source code.

What if you could influence an LLM's output not by breaking its rules, but by bending its probabilities? In this deep-dive, we explore how small changes in user input (down to a single token) can shift the balance between “true” and “false”, triggering radically…

What would it look like giving LLM's command line access to Nmap. Explore the possibilities in the security tools space.

Disclaimer: This article is intended for security professionals conducting authorized testing within the scope of a contract. The author is not responsible for any damage caused by the application of the provided information. The distribution of malicious…

Back in April, I shared a walkthrough on how to make a Ghidra script for spotting suspicious malloc calls. I then put that script to the…

How Leonard Leo's 2021 sale of an electronics firm enabled tech giants to subvert the 2024 election.

GoClipC2: A covert Windows clipboard-based C2 channel for VDI/RDP environments. Bypasses network monitoring with encrypted Base64 messaging.