The novel Chinese shellcode "BendyBear" is one of the most sophisticated, well-engineered and difficult-to-detect samples employed by an APT.

XXE Out of Band testing, explaining how to execute XXE OOB attacks over HTTP & FTP. Additional explanation on XXE RCE.

Security expert Dhiraj Mishra analyzed the popular instant messaging app Telegram and identified some failures in terms of handling the users' data.

Improperly generated ISNs (Initial Sequence Numbers) in nine TCP/IP stacks could be abused to hijack connections to vulnerable devices, according to new research from Forescout.

Spike shows just how useful and hard to detect these simple programs can be.

Some tips for when designing hardware and PCBs with simple RF sections and components. These concepts have aided me well when designing 4-layer embedded systems PCBs.

Topics: critical trace lengths, stackups, controlled impedance traces (microstrip, stripline)…

That’s not the first time I get a Chinese hardware that has some proprietary protocol that does not follow a single standard. It’s funny…

The recent Laravel CVE enables remote attackers to exploit a RCE flaw in websites using Laravel. I’ve read the article about the…

This post identifies systemic endpoint detection and response issues and examines how attackers can bypass any EDR product.

Insiders guide to ethical web hacking and bug bounty hunting with Ben Sadeghipour (@NahamSec)

P4wnP1 is a highly customizable USB attack platform, based on a low cost Raspberry Pi Zero or Raspberry Pi Zero W. - RoganDawes/P4wnP1

This repo contains a proof-of-concept for 📱🚀👑⚡, a deserialization vuln for local escalation of privilege to system_server in Android 10. This proof-of-concept only activates a privileged intent. - ...