Introduction - Educational Malware Development I

Stack strings — A common obfuscation technique used in malware, and how to deal with them using IDAPython

Generate evasive JavaScript for bypassing next-generation firewalls and antivirus scanners in a few simple clicks...

Claroty develops a unique technique that impersonates Synology’s DS920+ network-attached storage device. Learn more.

Istio egress controls can be bypassed, and are not suitable for restricting egress networking for Kubernetes pods. This advisory details an example bypass using setuid() in a compromised pod.

We expose significant flaws in PowerShell Gallery's policy package names and owners, that open potential supply chain attacks on the registry's user base. 

Upon initiating browser sync, users trigger a process that shares vital data across devices. By default, this synchronization...

RedRays' comprehensive SAP security analysis reveals critical vulnerabilities across 10,000 public IP addresses. Discover the severity distribution, insights into the most pressing vulnerabilities, and RedRays' innovative, accessible solutions for SAP security.

Learn about HTTP security headers and how to configure them for securing web applications.

How I hacked a bunch of companies via machine learning attacks.

Secure GitHub Actions with new research showing high-risk practices and get expert tips to prevent overly permissive workflows in your CI/CD pipeline.

A group noscriptd MoustachedBouncer committing espionage against foreign embassies in Belarus has been identified by ESET Research.

The Sysdig Threat Research Team recently discovered a new operation, dubbed LABRAT, a stealthy cryptojacking and proxyjacking campaign.

TLDR; Linker noscripts can be used to generate shellcode via C in a fairly platform agnostic way. This allows offensive developers to use the full capabilities of the Linux Toolchain, sans library code (until a dynamic loader for library calls can be devised)

Dongge Liu, Jonathan Metzman, Oliver Chang, Google Open Source Security Team  Since 2016, OSS-Fuzz has been at the forefront of automated v...

proofnet ist spezialisiert auf Security PenTests im Connected Car Umfeld.