Hacking

ARMO reveals how io_uring enables rootkits to bypass major Linux security tools like Falco, and Defender. Learn about the Curing rootkit and detection strategies.

curl-impersonate: A special build of curl that can impersonate Chrome & Firefox - lwthiker/curl-impersonate

A Unified Platform for Adversary Emulation and Red Team Operations - FunnyWolf/Viper

Astral-PE is a low-level mutator (headers obfuscator) for native Windows PE files (x32/x64) - DosX-dev/Astral-PE

ArgFuscator.net is an open-source, stand-alone web application that helps generate obfuscated command lines for common system-native executables. - wietze/ArgFuscator.net

📌 This is a cross-post from DEVCORE. The research was first published at Black Hat Europe 2024. Personally, I would like to thank splitline, the co-author of this research & article, whose help

Userland exec PoC to be used as attack vector technique - hardenedlinux/userland-exec

This tool extracts and displays data from the Recall feature in Windows 11, providing an easy way to access information about your PC's activity snapshots. - xaitax/TotalRecall

.NET deserialization hunter.

ROP-based sleep obfuscation to evade memory scanners - Kudaes/Shelter

Microsoft recently published an article that documented how the HAFNIUM threat actor leveraged a flaw in how scheduled tasks are stored in the registry to hide their presence.

Websites are riddled with timing oracles eager to divulge their innermost secrets. It's time we started listening to them. In this paper, I'll unleash novel attack concepts to coax out server secrets

In this blog post, we document Linux process injection techniques, and explain how to detect and mitigate them.

This post aims at giving an overview of what SELinux is, how it is implemented, and how to bypass it, from the point of view of Android kernel exploitation.

An x64 position-independent shellcode stager that verifies the stage it retrieves prior to execution - Octoberfest7/Secure_Stager

A tool for testing for certificate validation vulnerabilities of TLS connections made by a client device or an application. - aapooksman/certmitm

Recent investigation by Bitsight TRACE has discovered multiple critical 0-day vulnerabilities across six ATG systems from five different vendors.

Dynamically invoke arbitrary unmanaged code.

Authors: Boudewijn Meijer && Rick Veldhoven Introduction As defensive security products improve, attackers must refine their craft. Gone are the days of executing malicious binaries from di…

In this blog post, I will explain a vulnerability in the Microsoft Windows Desktop Windows Manager (DWM) Core library that I analyzed when the exploit for Core Impact was being developed. This vulnerability allows an unprivileged attacker to execute code as a DWM user with Integrity System privileges (CVE-2024-30051).

We explain how mainframes work, potential attack vectors, and what to focus on when pentesting such systems.

A list of online news & info sources in the InfoSec/Cybersecurity space - foorilla/allinfosecnews_sources

Introduction This is the first post of a series which regards development of malicious software. In this series we will explore and try to implement multiple techniques used by malicious applications to execute code, hide from defenses and persist. Let’s create a C++ application that will run malicious shellcode while trying to not be caught by AV software. Why C++ and not C# or PowerShell script? Because it’s much more difficult to analyze compiled binary when compared to managed code or script. For the purpose of this and following articles we will use MS Visual Studio 2017 or 2019 on Windows 10.

A stealthy process stomping method compatible with UNIX-like systems with anti-forensic enhancements for Linux.