TL;DR An overview of a fuzzing project targeting the Hyper-V VSPs using Intel Processor Trace (IPT) for code coverage guided fuzzing, built upon WinAFL, winipt, HAFL1, and Microsoft’s IPT.sys....

Analyze HTTP and DNS requests and create custom DNS records for your subdomain.

Breaking and fixing the Bluetooth standard. One More Time.
Paper Slides Toolkit CVE-2023-24023 BT SIG note

Security experts

Unmasking the Dark Art of Vectored Exception Handling: Bypassing XDR and EDR in the Evolving Cyber Threat Landscape - Download as a PDF or view online for free

Contribute to AbstractEngine/pentest-muse-cli development by creating an account on GitHub.

Debugging an application can provide the insight needed troubleshoot a subtle bug in your software. Normally, when debugging, you have source code and data type information (aka symbols) to help navigate your application. In the world of Reverse Engineering…

Update Note Due to the recent events at MGM, which included the compromise of MGM’s Okta tenant, and the surge in attacks of Okta Admins, we have updated the threat-hunting article, adding a few relevant queries to increase visibility surrounding compromised…

A technical deep dive on how to poison the DNS name resolution of an entire country!

This post continues a long, wonky discussion of Schnorr signature schemes and the Dilithium post-quantum signature. You may want to start with Part 1. In the previous post I discussed the intuition…

This post is the first in a two-part series on DNS rebinding in web browsers. In this post, I will talk about a bug we found in our own product which allowed us to retrieve low-privileged AWS credentials using DNS rebinding. In the next post, I will share…

Introduction to malware sandboxes fingerprinting

We provide details about CVE-2023-49103 and CVE-2023-49105

In December 2022, we observed an intrusion on a public-facing MSSQL Server, which resulted in BlueSky ransomware. First discovered in June 2022, BlueSky ransomware has code links to Conti and … Read More

With a significant daily influx of vulnerabilities, the assessment and assignment of CVSS base scores demand considerable time, expertise, and human resources.

Presenting capabilities of DefectDojo in context of Vulnerability Management for DevSecOps and traditional application security engineers.

A critical argument injection vulnerability has been identified in the administrative web interface of the Atos Unify OpenScape products Session Border Controller, Branch, and BCF. This allows an unauthenticated attacker to gain root access to the appliance…