Linux and Windows shellcode enrichment utility. Contribute to TheSecondSun/Shellab development by creating an account on GitHub.

Video Introduction This week’s retired box is Fighter, which brought a lot of pain into my life.  Having just started my HTB journey over the past couple of weeks, I have challenged myself to…

This blog series focuses on examining the collection of device data by various popular mobile applications. This data is often collected…

Irongeek's Information Security site with tutorials, articles and other information.

1 vote and 0 comments so far on Reddit

Statement from Press Secretary Tyler Houlton on recent media reports of a potential supply chain compromise.

Posted by Ivan Fratric, Google Project Zero Around a year ago, we published the results of research about the resilience of modern bro...

1 vote and 0 comments so far on Reddit

serviceFu
In a recent assessment our team found itself in a somewhat new situation that resulted in a useful tool we wanted to share with the community. The assessment started with us gaining initial access into a customer's network. This particular customer…

4 votes and 0 comments so far on Reddit

Tenable Research has discovered several vulnerabilities in RouterOS, an operating system used in MikroTik routers, the most critical of which would allow attackers to potentially gain full system a

Google has announced that they are closing the consumer functionality of Google+ due lack of adoption and an API bug that leaked the personal information of up to 500,000 Google+ accounts.

4 votes and 1 comment so far on Reddit

IntroductionBelow we’ve outlined the delivery phase of some recent attacks by KeyBoy, a group of attackers believed to operate out of China. They were first identified in 2013 targeting governments and NGOs in South East Asia. Their primary targeting continues…

Active Directory Assessment and Privilege Escalation Script - hausec/ADAPE-Script

Gwendal Le Coguic, web developer and security researcher

Have you ever encountered a website that runs `jQuery(location.hash)`? It turns out this allows you to perform a powerful timing attack that can extract almost any secret from the HTML.

Providing a web browser that you can depend on year after year is one of the core tenant of the Firefox security strategy. We put ...

A spam campaign we observed in September indicates attackers are angling towards a more sophisticated form of phishing. The campaign uses hijacked email accounts to deliver URSNIF as part of or as a response to an existing email thread.

All devices from Xiongmai, a Chinese OEM who manufactures white-label video surveillance equipment, come with an always-on cloud feature called XMEye P2P cloud.