Information Collection of Third-Party SDKs
Innovative static taint analyzer for third-party SDKs, addressing challenges in user data protection and privacy policy compliance. Achieves high accuracy in identifying undisclosed information collection behaviors.
The Ransomware Protection Full Of Holes
Exposé des failles de la protection contre les ransomwares de Windows, démonstration de méthodes de contournement et d'attaques à distance, avec vidéos à l'appui.
Suborner - Windows Bribery for Invisible Persistence
Discover a stealthy Windows persistence technique that creates invisible machine accounts, evades detection, and impersonates existing users. Learn about the Suborner Attack's implementation and effectiveness.
Unlocking KeeLoq - A Reverse Engineering Story
Reverse engineering KeeLoq systems: extracting firmware, decrypting transmissions, and integrating with home automation. Practical approach to exploiting known vulnerabilities in remote keyless entry systems.
Adventures in Security Research
Explore defensive security, journalism protection, and diverse tech challenges with insights on gun hacking, malware analysis, and mission-driven work from a seasoned security expert.
Breaking Web3 - Exploitation Techniques for Cryptocurrency Hacking
Exploration of common vulnerabilities in Web3 projects, covering blockchain topology, node exploitation, DoS attacks, social engineering, and smart contract vulnerabilities in cryptocurrency systems.
One-Click to Completely Takeover a MacOS Device
Explore vulnerabilities in MacOS security features and learn how to bypass them for a one-click takeover of both Apple Silicon and Intel Mac devices. Includes live demo and expert insights.
EDR Evasion Primer for Red Teamers
Insights on EDR inner workings and evasion techniques for red teamers, covering test lab results, reverse engineering findings, and successful attack methodologies to circumvent endpoint protection.
Exploiting a Limited UAF on Ubuntu 22.04 to Achieve LPE
Detailed exploration of exploiting a Linux kernel vulnerability in Ubuntu 22.04 to achieve local privilege escalation, focusing on advanced exploitation techniques and bypass methods.
E'rybody Gettin' TIPC - Demystifying Remote Linux Kernel Exploitation
Demystifying remote Linux kernel exploitation through a stack overflow vulnerability in a network module, offering insights into the exploit development process and low-level kernel internals.
Attacking WPA3 - New Vulnerabilities And Exploit Framework
Uncovers critical vulnerabilities in WPA3, including DoS attacks and traffic interception. Presents a new Wi-Fi testing framework for researchers to identify and exploit these weaknesses in various devices.
Random Walk Through A Few Million Things
Explore IoT security challenges in enterprises, examining millions of devices to reveal vulnerabilities, default credentials, and outdated firmware. Gain insights into the current state of IoT security.
Exploiting Race Condition Vulnerabilities in Web Applications
Explore race condition vulnerabilities in web apps, their impact, and exploitation techniques. Learn about detection challenges, real-world scenarios, and a new penetration testing tool for identifying these elusive security flaws.
Getting Clear Text Passwords From An IdP & More
Explore privilege escalation in Okta, including methods to obtain clear text passwords and impersonate super-admins. Learn about knowledge graphs for trust analysis in vulnerability discovery and research collaboration.
Advanced Code Obfuscation With MBA Expressions
Explore advanced code obfuscation techniques using Mixed Boolean-Arithmetic expressions to increase data-flow complexity and conceal sensitive data, with practical applications in building robust obfuscation primitives.
Cracking Kyocera Printers
Explore vulnerabilities in Kyocera printers, including remote DoS, file reading, password leakage, and pre-auth RCE. Learn how these security flaws can be exploited to access office networks and monitor confidential documents.
Simulating Execution in Malicious Text Detection
Innovative approach to malicious text detection using simulated execution, combining static and dynamic analysis techniques for improved accuracy and efficiency in identifying obfuscated threats.
Web3 + Scams = It's A Match
Explore 35+ types of cryptocurrency scams, from traditional replicas to novel Web3-specific schemes. Learn about pump and dump, rug pull, and unique scams like proof of weak hands and NFT airdrops.
Template Injection on Hardened Targets
Explore advanced template injection techniques for hardened Python and JavaScript environments. Build custom tools to tackle increasingly complex challenges in containerized web applications.
Building an Army of Bots by Hijacking a Twitter Handle
Revealing security vulnerabilities in mobile apps that expose Twitter API keys, allowing potential account takeovers and unauthorized actions. Explores causes, impacts, and prevention techniques.
Faking at Level 1 - How Digital Twins Save Your PLCs
Explore digital twin technology for safely testing and identifying vulnerabilities in industrial control systems without risking operational infrastructure.