Tag Index

"Tianfu Cup 2023" Chrome use-after-free
“To live is to fight, to fight is to live! - IBM ODM Remote Code Execution
4 exploits, 1 bug - Exploiting CVE-2024-20017 4 Different Ways
15 bugs in Realtek Jungle SDK
21 compilers and 3 orders of magnitude in 60 minutes
30 Years of Decompilation and the Unsolved Structuring Problem - Part 1
30 Years of Decompilation and the Unsolved Structuring Problem - Part 2
2023 CTF Challenge And Write-Up Database
2023 Firmware Security Thread
A Catastrophe For Control - Understanding the ScreenConnect Authentication Bypass
A Deep Dive into the CoSoSys EndPoint Protector Exploit - Remote Code Execution
A Handful of Imagination GPU Vulnerabilities
A journey through KiUserExceptionDispatcher
A LibAFL Introductory Workshop
A review of zero-day in-the-wild exploits in 2023
A Trick, The Story Of CVE-2024-26230
Accessory Authentication
Achieving Remote Code Execution in Steam - a journey into the Remote Play protocol
Address Sanitizer for Bare-metal Firmware
AMD Radeon DirectX 11 Driver Arbitrary Write
An Introduction to Chrome Exploitation - Maglev Edition
Analyzing Forest Blizzard’s custom post-compromise tool for exploiting CVE-2022-38028 to obtain credentials
Analyzing Modern DRMs
angr for real-world use cases
ARLO - I'm Watching You
Attack of the clones - Getting RCE in Chrome's renderer with duplicate object properties
Attacking Android Binder - Analysis and Exploitation of CVE-2023-20938
BadgeLife @ Off-By-One Conference 2024
Breaking Barriers and Assumptions - Techniques for Privilege Escalation on Windows - Part 3
Breaking Bitlocker - Bypassing the Windows Disk Encryption
Breaking SIP with Apple-Signed Packages
Buffer Overflow in Via H264 Processing
Buffer-overflow in Skia
Bugs of Yore - A Bug Hunting Journey on VMware's Hypervisor
Bypassing ARM's Memory Tagging Extension with a Side-Channel Attack
Bypassing Veeam Authentication CVE-2024-29849
Bytecode Breakdown - Unraveling Factorio's Lua Security Flaws
C++ Unwind Exception Metadata - A Hidden Reverse Engineering Bonanza
Chaining N-days to Compromise All - Part 1 — Chrome Renderer RCE
Chaining N-days to Compromise All - Part 2 — Windows Kernel LPE (a.k.a Chrome Sandbox Escape)
Chaining N-days to Compromise All - Part 4 — VMware Workstation Information leakage
Chaining N-days to Compromise All - Part 6 — Windows Kernel LPE - Get SYSTEM
Chaining N-days to Compromise All -Windows Driver LPE - Medium to System
CodeQL zero to hero part 3 - Security research with CodeQL
corCTF 2024 - trojan-turtles writeup
CVE-2020-27786 (Race Condition + Use-After-Free)
CVE-2022-22265 Samsung npu driver
CVE-2023-6345 - Integer overflow in Skia
CVE-2023-26322 - Xiaomi Pro 13 isUrlMatchLevel Permissive List of Allowed Inputs Remote Code Execution Vulnerability
CVE-2023-34992 - Fortinet FortiSIEM Command Injection Deep-Dive
CVE-2023-36049 - Microsoft .NET CRLF Injection Arbitrary File Write & Deletion Vulnerability
CVE-2023-42942 - xpcroleaccountd Root Privilege Escalation
CVE-2023-46263 - Ivanti Avalanche Arbitrary File Upload Vulnerability
CVE-2024-0204 - Fortra GoAnywhere MFT Authentication Bypass Deep-Dive
CVE-2024-1212 - Unauthenticated Command Injection In Progress Kemp LoadMaster
CVE-2024-1283 - Cross-{Cache, Bucket} Browser Exploit
CVE-2024-2389 - Command Injection Vulnerability In Progress Flowmon
CVE-2024-3832 - Object corruption on wasm functions installation
CVE-2024-3914 - V8 UAF
CVE-2024-4367 - Arbitrary JavaScript execution in PDF.js
CVE-2024-4761 - v8 missing check of WasmObject type cast causes type confusion and OOB access
CVE-2024-4947 - Type Confusion in V8
CVE-2024-5274 - A Minor Flaw in V8 Parser Leading to Catastrophes
CVE-2024-20697 - Windows Libarchive Remote Code Execution Vulnerability
CVE-2024-21115 - An Oracle VirtualBox LPE Used To Win Pwn2Own
CVE-2024-22058 Ivanti Landesk LPE
CVE-2024-25938 - Foxit Reader Barcode widget Calculate event use-after-free vulnerability
CVE-2024-27815 - A Buffer Overflow in the XNU Kernel
CVE-2024-27822 - macOS PackageKit Privilege Escalation
CVE-2024-28183 OTA Anti-Rollback Bypass via TOCTOU in ESP-IDF
CVE-2024-29510 – Exploiting Ghostscript using format strings
CVE-2024-29511 - Abusing Ghostscript's OCR device
CVE-2024-29824 Deep Dive - Ivanti EPM SQL Injection Remote Code Execution Vulnerability
CVE-2024-30043 - Abusing URL Parsing Confusion To Exploit XXE On SharePoint Server And Cloud
CVE-2024-37079 - VMware vCenter Server Integer Underflow Code Execution Vulnerability
CVR - The Mines of Kakadûm
Deploying Rust in Existing Firmware Codebases
Dissecting the CVE-2024-38106 Fix
DJI - The ART of obfuscation
Do a firmware update for your AirPods...now
Driving forward in Android drivers
Emulating RH850 architecture with Unicorn Engine
Etiquette for dropping PoCs in 2024? A Linux LPE
Evernote RCE - From PDF.js font-injection to All-platform Electron exposed ipcRenderer with listened BrokerBridge Remote-Code Execution
Exploit Development - Windows Kernel Exploitation - Debugging Environment and Stack Overflow
Exploit GSM
Exploitation 4011 - Windows Kernel Exploitation
Exploited V8 Bugs in 2024
Exploiting a SpiderMonkey - From Integer Range Inconsistency to Bound Check Elimination then RCE
Exploiting American Conquest
Exploiting Android's Hardened Memory Allocator
Exploiting Issue-1472121
Exploiting the NT Kernel in 24H2 - New Bugs in Old Code & Side Channels Against KASLR
Exploiting V8 at openECSC
exploits.club Weekly Newsletter 20 - Special @_manfp Edition
Exploring AMD Platform Secure Boot
Exploring Counter-Strike - Global Offensive Attack Surface
FAQ - The tragedy of low-level exploitation
Finding Gadgets for CPU Side-Channels with Static Analysis Tools
FireFox OOB Read via clipboard component
Flipping Pages - An analysis of a new Linux vulnerability in nf_tables and hardened exploitation techniques
From object transition to RCE in the Chrome renderer
From Pwn2Own Automotive - Taking Over the Autel Maxicharger
Fuzz Everything, Everywhere, All at Once
Fuzzer Development - Sandboxing Syscalls
Fuzzer Development 3 - Building Bochs, MMU, and File I0
Fuzzer Development 4 - Snapshots, Code-Coverage, and Fuzzing
Fuzzware Goes Open-Source
Gaining kernel code execution on an MTE-enabled Pixel 8
Ghidra nanoMIPS ISA module
Ghostrace - Exploiting and Mitigating Speculative Race Conditions
Ghostwrite CPU Vulnerability
Glitching in 3D - Low Cost EMFI Attacks
Google Chrome V8 CVE-2024-0517 Out-of-Bounds Write Code Execution
Hacking a 2014 Tablet...in 2024
Hacking Exchange from the Outside In
Hardware and firmware reverse engineering primer - dissecting an FPV and video surveillance platform
Heap Buffer Overflow In ANGLE
Heap exploitation, glibc internals and nifty tricks
Hi, My Name Is Keyboard
HITCON CTF QUAL 2024 Pwn Challenge Part 1 - Halloween and v8sbx
How an old bug in Lighttpd gained new life in AMI BMC, including Lenovo and Intel products
How we found and fixed an eBPF Linux Kernel Vulnerability
Hunting Bugs in Nginx JavaScript Engine (njs)
iMessage with PQ3 -The new state of the art in quantum-secure messaging at scale
Inside The iOS Bug That Made Deleted Photos Reappear
Inside the LogoFAIL PoC - From Integer Overflow to Arbitrary Code Execution
Introducing Java fuzz harness synthesis using LLMs
Introducing LLM-based harness synthesis for unfuzzed projects
Introduction To Windows Secure Channel RCE - CVE-2024-28148
iOS - A Journey In The USB Networking Stack
ioxide - N_GSM 0 day
IPC Fuzzing with Snapshots
Ivan Frantic's MacOS Video Decoder Bugs
Jailbreaking an Electric Vehicle in 2023
Jailbreaking RabbitOS - Uncovering Secret Logs, and GPL Violations
Jailbreaking The Apple HomePod - Fun With Checkm8 And Smart Speakers
Java Deserialization Tricks
Keynote - Rust in the Linux kernel
kfd write-ups
Leveraging Binary Ninja IL To Reverse a Custom ISA - Cracking The "Pot Of Gold" 37C3
Linux - UAF in the tipc_buf_append()
Linux Kernel - Vulnerability in the eBPF verifier register limit tracking
Linux Kernel CodeQL Queries
Linux Kernel GSM Multiplexing Race Condition Local Privilege Escalation Vulnerability
Linux Kernel Int Overflow Leading To Priv Esc
Listen Up - Sonos Over-The-Air Remote Kernel Exploitation and Covert Wiretap
LLVM's 'RFC - C++ Buffer Hardening' at Google
Making Mojo Exploits More Difficult
Mali GPU Kernel LPE
Meta Bug Bounty - Fuzzing "netconsd" for fun and profit
Mind the Patch Gap - Exploiting an io_uring Vulnerability in Ubuntu
Missing signs - how several brands forgot to secure a key piece of Android
mistymntncop - CVE-2022-4262 PoC
Modern Anti-Abuse Mechanisms in Competitive Video Games at Black Hat 2024
Modern Cryptographic Attacks - A Guide For The Perplexed
Molding Lies Into Reality - Exploiting CVE-2024-4358
Multiple Vulnerabilities in the Deep Sea Electronics DSE855
Nintendo hacking 2023-2008
Nintendo Switch Game Hacking Resources
nix libX11 - Uncovering and Exploiting a 35-year-old Vulnerability
No Way, PHP Strikes Again - CVE-2024-4577
NVIDIA GPU Compiler Driver Shader Functionality out-of-bounds read vulnerability
One Year of Mobile VRP - Reward Increases and Lessons Learned
OpenSSH Backdoors
Operation Mango - Scalable Discovery of Taint-Style Vulnerabilities in Binary Firmware Services
Oracle VM VirtualBox 7.0.10 r158379 Escape (CVE-2023-22098 PoC)
OSS-Fuzz Gen
OST2 Introductory Course To HyperDbg
Palo Alto - Putting The Protecc In GlobalProtect (CVE-2024-3400)
Pixel Tablet Dock (korlan) Secure Boot Bypass
PixieFail - Nine vulnerabilities in Tianocore's EDK II IPv6 network stack.
PoC for CVE-2023-4427
Potential One Click MMS RCE on Xiomi via Malicious GIF
PowerVR - integer overflows in DevmemXIntMapPages() and DevmemXIntUnmapPages(), exploitable as dangling GPU page table entries
Preauth RCE on NVIDIA Triton Server
Project Naptime - Evaluating Offensive Security Capabilities of Large Language Models
Puckungfu 2 - Another NETGEAR WAN Command Injection
Pumping Iron on the Musl Heap - Real World CVE-2022-24834 Exploitation on an Alpine mallocng Heap
Pwn2Own - Pivoting from WAN to LAN to Attack a Synology BC500 IP Camera, Part 2
Pwn2Own - WAN-to-LAN Exploit Showcase
Pwn2Own Automotive - CHARX Vulnerability Discovery
Pwn2Own Automotive - Popping the CHARX SEC-3100
Pwn2Own Automotive 2024 - Hacking the JuiceBox 40
QakBot attacks with Windows zero-day (CVE-2024-30051)
QNAP QTS - QNAPping At The Wheel (CVE-2024-27130 and friends)
Qualys Releases Two glibc Bugs
Race condition in 9p File System
Race conditions in Linux Kernel perf events
Racing round and round - The little bug that could
Radek Domanski from FlashBack team on PWN2OWN
RCE & SQLi for pre-auth RCE in IP.Board e-commerce plugin ‘nexus’
RCE on Ollama
Recovering an ECU firmware using disassembler and branches
regreSSHion - RCE in OpenSSH's server, on glibc-based Linux systems (CVE-2024-6387)
Relution Remote Code Execution via Java Deserialization Vulnerability
Remote, One-Click, Breaking through Smartphones via a Non Well-Known Remote Attack Surface
Resurrecting Internet Explorer - Threat Actors Using Zero-Day Tricks In Internet Shortcut File To Lure Victims
Return of the JIT
Reverse Engineering The XZ Backdoor
Review of the SAILR paper
Ring Around The Regex - Lessons learned from fuzzing regex libraries (Part 1)
Ring Around The Regex - Lessons learned from fuzzing regex libraries (Part 2)
Robots Dream of Root Shells
ROPing Routers From Scratch - Step-By-Step TEnda Ac8v4 MIPs 0day Flow-Control ROP -> RCE
Say Friend and Enter - Digitally lockpicking an advanced smart lock
Say Friend and Enter - Digitally lockpicking an advanced smart lock (Part 2)
Secure by Design - Google’s Perspective on Memory Safety
Security research without ever leaving GitHub - From code scanning to CVE via Codespaces and private vulnerability reporting
Shuffle Up and Deal - Analyzing the Security of Automated Card Shufflers
SIMurai - Slicing Through the Complexity of SIM Card Security Research
Sky's the Limit - Quick Analysis and Exploitation of a Chrome ipcz TOCTOU Vulnerability
Smoke and Mirrors - Driver Signatures Are Optional
So You Wanna Find Bugs In The Linux Kernel
SolarWinds Security Event Manager AMF deserialization RCE (CVE-2024-0692)
SSD ADVISORY - D-LINK DIR-X4860 Security Vulnerabilities
SSD Advisory - Google Chrome RCE
SSD Advisory - Linux Kernel taprio OOB
SSD Advisory - TP-LINK VIGI onvif_discovery Overflow
SSD Advisory – Foscam R4M UDTMediaServer Buffer Overflow
Stardew Valley PRNG Seed Cracking
Start Your Engines - Capturing the First Flag in Google's New v8CTF
Streaming vulnerabilities from Windows Kernel (Part 1) - Proxying to Kernel
Strengthening the Shield - MTE in Heap Allocators
Super Hat Trick - Exploit Chrome and Firefox Four Times
Surviving MiraclePtr Navigating of Webp and Beyond by Kira
Telegram for Android - Use-after-free in Connection onReceivedData
The Boom, the Bust, the Adjust and the Unknown
The FloW Drops PPW
The V8 Heap Sandbox
The Way to Android Root - Exploiting Your GPU on Smartphone
The Windows Registry Adventure
The Windows Registry Adventure 3 - Learning resources
TIKTAG - Breaking ARM’s Memory Tagging Extension with Speculative Execution
Tony Hawk's Pro Strcpy
Trail Of Bits Handbook - Fuzzing
Trail of Bits Testing Handbook
UAF in PowerVR
Unauthenticated Command Execution on Tp-Link AC1350
Unburdened By What Has Been - Exploiting New Attack Surfaces in Radio Layer 2 for Baseband RCE on Samsung Exynos
Understanding AddressSanitizer - Better memory safety for your code
Underutilized Fuzzing Strategies for Modern Software Testing
Universal Code Execution by Chaining Messages in Browser Extensions
Veeam Backup & Response - RCE With Auth, But Mostly Without Auth (CVE-2024-40711)
VirtualBox Vuln Research Set-Up
Vulnerabilities found in VMWare by me
Welcome To 2024 - The SSLVPN Chaos Continues
When Samsung meets MediaTek - the story of a small bug chain
Windows AppLocker Driver LPE Vulnerability - CVE-2024-21338
Windows WiFi Driver RCE Vulnerability – CVE-2024-30078
You Can't Spell WebRTC without RCE - Part 1
You Can't Spell WebRTC without RCE - Part 2
You Can’t Spell WebRTC without RCE - Part 3
ZDI Discloses Lexmark Pwn2Own Bugs
ZDI-24-821 - A Remote UAF in The Kernel's net tipc

Explorer

Tag Index