Going Beyond Coverage-Guided Fuzzing with Structured Fuzzing
Explore advanced vulnerability discovery techniques combining structured and coverage-guided fuzzing, enhancing automated security testing for complex data formats.
He Said, She Said – Poisoned RDP Offense and Defense
Explore RDP vulnerabilities in client-side attacks, focusing on Microsoft's Terminal Services Client. Learn offensive techniques and defensive strategies for securing RDP connections.
Messaging Layer Security - Towards a New Era of Secure Group Messaging
Explore secure group messaging protocols, focusing on Messaging Layer Security (MLS) for corporate settings. Learn about encryption, scalability challenges, and the future of secure communication.
Transparency in the Software Supply Chain - Making SBOM a Reality
Explore the concept of Software Bill of Materials (SBOM) and its potential to enhance transparency in the software supply chain, discussing benefits, challenges, and implementation strategies.
HTTP Desync Attacks - Smashing into the Cell Next Door
Explore techniques for HTTP request splicing, enabling remote attackers to manipulate web infrastructure, exploit visitors, and breach system isolation. Learn detection, case studies, and mitigation strategies.
Office in Wonderland
Explore novel techniques abusing Microsoft Office features for offensive purposes, including new vulnerabilities, attack vectors, and security impacts of the suite's architectural design.
Behind the Scenes - The Industry of Social Media Manipulation Driven by Malware
Unveiling the structured industry behind social media manipulation, from IoT botnets to reseller panels and residential proxies. Explores ecosystem, automation, and economic impacts.
iOS Dual Booting Demystified
Explore iOS dual booting, secure boot process, and custom firmware loading. Learn reverse engineering techniques and system components for advanced iOS understanding.
Selling 0-Days to Governments and Offensive Security Companies
Explore the intriguing world of vulnerability brokerage, including the process, market dynamics, and ethical considerations of selling 0-day exploits to governments and security firms.
New Vulnerabilities in 5G Networks
Explore new vulnerabilities in 5G networks, focusing on operator infrastructure and end-device security. Learn about MC Catcher capabilities, mobile network mapping, and potential risks for cellular and IoT devices.
Testing Your Organization's Social Media Awareness
Explore automated social media intelligence gathering techniques to identify potential targets within organizations and learn strategies for enhancing social media awareness and protection.
Preloading Insecurity in Your Electron
Explore vulnerabilities in Electron-based apps, focusing on BrowserWindow preload as an attack surface. Learn how XSS can lead to RCE and discover security implications for developers.
ClickOnce and You're in - When Appref-ms Abuse is Operating as Intended
Explore .appref-ms file abuse for malicious purposes, including deployment methods, user perspective, and techniques to enhance and mask nefarious capabilities.
Attacking Electric Motors for Fun and Profit
Explore electric motor vulnerabilities and attacks bridging cyber and physical realms. Learn about security risks, attack methods, and protective measures for this critical technology.
Biometric Authentication Under Threat - Liveness Detection Hacking
Explore techniques for bypassing biometric authentication systems, including facial and voiceprint recognition, through liveness detection hacking and specific attack methods.
Legal GNSS Spoofing and Its Effects on Autonomous Vehicles
Explore GNSS spoofing's impact on autonomous vehicles, legal challenges in vulnerability assessment, and potential attack scenarios, with recommendations for enhancing system security.
Monsters in the Middleboxes - Building Tools for Detecting HTTPS Interception
Explore HTTPS interception detection tools and insights, uncovering security vulnerabilities in middleboxes and enhancing network protection strategies.
Attacking and Defending Blockchains - From Horror Stories to Secure Wallets
Explore blockchain security failures, risks, and best practices for crypto wallets. Learn about smart contract vulnerabilities, custom cryptography pitfalls, and potential exploits in popular Bitcoin software.
Perfectly Deniable Steganographic Disk Encryption
Explore self-concealing, deniable encryption techniques similar to VeraCrypt's hidden volume feature, covering design, implementation, and forensic analysis considerations.
DIFUZE - Android Kernel Driver Fuzzing
Explore Android kernel driver fuzzing with DIFUZE, a tool for identifying vulnerabilities in third-party driver code. Learn techniques to improve Android security infrastructure and discover potential weaknesses.
CLKscrew - Exposing the Perils of Security-Oblivious Energy Management
Explore CLKSCREW attack: software-based fault attacks exploiting energy management vulnerabilities, enabling security breaches without physical access to devices or specialized equipment.