Practically-Exploitable Cryptographic Vulnerabilities in Matrix
Uncover critical cryptographic vulnerabilities in Matrix's federated communication standard, compromising confidentiality and authentication claims against malicious servers.
The Hacker's Guide to Policyland
Comprehensive overview of UK cybersecurity policy priorities, initiatives, and development process. Learn how to influence outcomes and engage with government efforts in this field.
Select Bugs From Binary Where Pattern Like CVE Days
Explores static code analysis techniques for vulnerability detection in binary code, focusing on pattern extraction and efficient searching across large codebases, with practical examples.
Abusing CNC Technologies
Explore vulnerabilities in modern CNC machines, including network security risks, code leaks, and potential for sabotage. Learn about countermeasures to protect critical industrial assets.
Blind VCC Glitching Technique to Bypass the Secure Boot of Qualcomm MSM8916 Mobile SoC
Explore a blind VCC glitching technique to bypass secure boot mechanisms on mobile SoCs, demonstrated on Qualcomm MSM8916/APQ8016. Learn practical application and see a live demo of this effective method.
The Aftermath of a Social Engineering Pentest - Are We Being Ethically Responsible?
Explore ethical challenges and solutions in handling social engineering pentest aftermath, focusing on responsibility, consequences, and improving security culture.
Searching for RPC Functions to Coerce Authentications in Microsoft Protocols
Automated discovery of RPC functions in Microsoft protocols to find authentication coercion vulnerabilities, with focus on parsing documentation and generating proof-of-concept code.
Strengthening Cyber Resiliency in a Time of Geopolitical Crises - Applying Threat Intelligence and Active Defense to Protecting Critical Information Infrastructures
Explore strategies for enhancing cyber resilience during geopolitical crises, focusing on threat intelligence and active defense to protect critical information infrastructures.
Unwinding the Stack for Fun and Profit
Explore stack-based buffer overflow exploitation techniques, bypassing modern mitigations by leveraging exception handling mechanisms to resurrect old exploits and achieve successful attacks.
Cybersecurity - The Next Generation
Exploring cybersecurity's evolution, challenges, and future direction. Discusses lessons from the past, current trends, and strategies for shaping the industry's destiny in an increasingly connected world.
IAM The One Who Knocks
Exposing hidden risks in multi-cloud IAM, detailing access flaws, misconfigurations, and inconsistencies that can lead to unintended access and privilege escalation across cloud providers.
I Am Whoever I Say I Am - Infiltrating Identity Providers Using a 0-Click Exploit
Explore unauthenticated remote code execution in popular IAM solutions, covering past attacks, audit approaches, and vulnerability chaining for infiltrating identity providers.
Leveraging the Apple ESF for Behavioral Detections
Explore Apple's Endpoint Security Framework for macOS threat detection. Learn to utilize ESF data for basic and advanced behavioral-based detections, comparing old and new detection methods.
Let's Dance in the Cache - Destabilizing Hash Table on Microsoft IIS
Explore Microsoft IIS's Dynamic Hashing algorithm and its vulnerabilities. Learn about potential collision attacks on hash tables in web server architecture and their implications for cybersecurity.
Invisible Finger - Practical Electromagnetic Interference Attack on Touchscreen-based Devices
Uncover vulnerabilities in touchscreen devices through electromagnetic interference attacks, exploring practical methods to compromise security and user interaction on smartphones and tablets.
Kubernetes Privilege Escalation - Container Escape Equals Cluster Admin
Explore Kubernetes security vulnerabilities, privilege escalation techniques, and container escape risks. Learn to identify powerful system pods and implement mitigations to protect your cluster from potential attacks.
Internal Server Error - Exploiting Inter-Process Communication in SAP's HTTP Server
Explore SAP's HTTP server vulnerabilities and learn advanced exploitation techniques for memory corruption in the Internet Communication Manager, with real-world examples and demonstrations.
Industroyer2 - Sandworm's Cyberwarfare Targets Ukraine's Power Grid Again
Detailed analysis of Industroyer2 malware targeting Ukraine's power grid, comparing it to the original Industroyer and exploring its communication with ICS hardware using industrial protocols.
Cautious - A New Exploitation Method! No Pipe but as Nasty as Dirty Pipe
Unveils a novel exploitation technique surpassing Dirty Pipe, enabling arbitrary file overwriting and privilege escalation through double-free vulnerabilities, applicable across affected kernel versions.
Controlling the Source - Abusing Source Code Management Systems
Explore vulnerabilities in Source Code Management systems, including reconnaissance, user role manipulation, and repository takeover. Learn attack scenarios and defensive strategies for GitHub, GitLab, and Bitbucket.
Do Not Trust the ASA, Trojans
Explore vulnerabilities in Cisco ASA firewalls, including ASDM package verification issues and FirePOWER module exploits. Learn to create malicious packages and gain root access.