• [Parte 1][1109]
• [Parte 2][1110]

• ["una elusión trivial de SecureBoot para firmware compatible con UEFI basado en Insyde H2O"][1143]
• ["un poco más que una simple elusión trivial de SecureBoot para firmware compatible con UEFI basado en Insyde H2O"][1144]
• ["una elusión corregida de SecureBoot para firmware compatible con UEFI basado en Insyde H2O"][1108]

• [Parte 1][1042]
• [Parte 2][1043]

• ["investigación de vulnerabilidades en ksmbd"][1033]
• ["Mejoras en fuzzing y descubrimiento de vulnerabilidades"][1175]
• ["Explotando CVE-2025-37947"][1176]

• [Parte 1][1062]
• [Parte 2][1063]

• [Parte 1][1156]
• [Parte 2][1157]

• [Parte 1][1204]
• [Parte 2][1205]
• [Parte 3][1206]
• [Parte 4][1207]
• [Parte 5][1208]

• [Parte 1][836]
• [Parte 2][837]
• [Parte 3][838]
• [Parte 4][839]
• [Parte 5][840]

• [Parte 1][973]
• [Parte 2][974]

• [Parte 1][906]
• [Parte 2][907]

• [Artículo 01][583]
• [Artículo 02][584]

• [Parte 1][996]
• [Parte 2][997]

• [Parte 1][870]
• [Parte 2][871]

• [Parte 1][934]
• [Parte 2][935]

• ["Entorno"][922]
• ["ret2usr"][923]

• [Parte 1][901]
• [Parte 2][902]
• [Parte 3][903]

• ["Análisis del módulo Keychain"][823]
• ["Análisis del módulo de audio"][824]

• ["Pwn2Own: Demostración de exploit de WAN a LAN, Parte 1"][950]
• ["Pwn2Own: Pivotando de WAN a LAN para atacar una cámara IP Synology BC500, Parte 2"][942]

• ["Cómo empezó todo"][829]
• ["Explorando la superficie de ataque"][830]
• ["Exploración"][831]
• ["Análisis de corrupción de memoria"][832]
• ["El exploit"][833]

• [Parte 1][867]
• [Parte 2][868]
• [Parte 3][869]

• [Parte 1][955]
• [Parte 2][956]

• [Parte 1][812]
• [Parte 2][813]

• ["Desprivilegiando SMI (ISRD)"][847]
• ["Reporte de políticas de seguridad (ISSR)"][848]

• [Parte 1][914]
• [Parte 2][915]
• [Parte 3][916]

• ["Adjuntándose a un proceso"][449]
• ["Estado de registros y stepping"][450]
• ["Leyendo memoria"][451]
• ["Exportaciones y símbolos privados"][452]
• ["Puntos de interrupción"][453]
• ["Pilas"][454]
• ["Desensamblado"][455]

"Attacking an EDR"

• [Part 1][395]
• [Part 2][396]

"Attacking IoT Devices from Web Perspective"

["Attacking JS engines: Fundamentals for understanding memory corruption crashes"][720]

["Audio with embedded Linux training"][267]

["Automating C2 Infrastructure with Terraform, Nebula, Caddy and Cobalt Strike"][300]

["b3typer - bi0sCTF 2022"][554]

["Back to the Future with Platform Security"][97]

["Bash Privileged-Mode Vulnerabilities in Parallel Desktop and CDPATH Handling in MacOS"][100]

["Bee-yond Capacity: Unauthenticated RCE in Extreme Networks/Aerohive Wireless APs - CVE-2023-35803"][91]

["Behind the Shield: Unmasking Scudos's Defenses"][8]

["BlackLotus UEFI bootkit: Myth confirmed"][429]

"BLUFFS: Bluetooth Forward and Future Secrecy Attacks and Defenses"

["BPF Memory Forensics with Volatility 3"][881]

["Breaking Fortinet Firmware Encryption"][233]

["Breaking the Code - Exploiting and Examining CVE-2023-1829 in cls_tcindex Classifier Vulnerability"][81]

["Breaking Secure Boot on the Silicon Labs Gecko platform"][262]

["Building a Custom Mach-O Memory Loader for macOS"][523]

["Building an Exploit for FortiGate Vulnerability CVE-2023-27997"][475]

["Bypassing a noexec by elf roping"][528]

["Bypassing PPL in Userland (again)"][308]

["Bypassing SELinux with init_module"][494]

"C101101: D-Link DIR-865L":

• ["Remote Code Execution (pre-auth)"][599]
• ["Unsigned firmware upload lead to persistent backdoor (pre-auth)"][600]
• ["Memory corruptions lead to Remote Code Execution (pre-auth)"][601]

["CAN Injection: keyless car theft"][195]

"chonked"

• ["minidlna 1.3.2 http chunk parsing heap overflow (cve-2023-33476) root cause analysis"][193]
• ["exploiting cve-2023-33476 for remote code execution"][194]

["Code Execution in Chromium’s V8 Heap Sandbox"][896]

["Coffee: A COFF loader made in Rust"][93]

["Competing in Pwn2Own ICS 2022 Miami: Exploiting a zero click remote memory corruption in ICONICS Genesis64"][397]

["Conquering the memory through io_uring - Analysis of CVE-2023-2598"][528]

"Cracking Windows Kernel with HEVD"

• "Chapter 0"
• "Chapter 1"
• "Chapter 2"
• "Chapter 3"
• "Chapter 4"

["Cueing up a calculator: an introduction to exploit development on Linux"][534]

"Customizing Sliver":

• [Part 1][603]
• Part 2
• Part 3

"CVE-2022-27666: My file your memory"

["CVE-2023-0179: Linux kernel stack buffer overflow in nftables: PoC and writeup"][567]

["CVE-2023-2008 - Analyzing and exploiting a bug in the udmabuf driver"][72]

["CVE-2023-23504: XNU Heap Underwrite in dlil.c"][543]

["CVE-2023-26258 – Remote Code Execution in ArcServe UDP Backup"][99]

["CVE-2023-36844 And Friends: RCE In Juniper Devices"][281]

["CVE-2023-38408: Remote Code Execution in OpenSSH's forwarded ssh-agent"][186]

["cURL audit: How a joke led to significant findings"][459]

["D^ 3CTF2023 d3kcache： From null-byte cross-cache overflow to infinite arbitrary read & write."][964]

["Debugger Ghidra Class"][28]

["Debugging D-Link: Emulating firmware and hacking hardware"][290]

["Decompilation Debugging"][508]

["Deep Lateral Movement in OT Networks: When is a Perimeter not a Perimeter?"][253]

["Defining the cobalt strike reflective loader"][320]

["Demystifying bitwise operations, a gentle C tutorial"][400]

["Detecting and decrypting Sliver C2 – a threat hunter’s guide"][480]

["Detecting BPFDoor Backdoor Variants Abusing BPF Filters"][183]

["Dirty Pagetable: A Novel Exploitation Technique To Rule Linux Kernel"][51]

["Dissecting and Exploiting TCP/IP RCE Vulnerability “EvilESP”"][164]

["Diving Into Smart Contract Decompilation"][204]

["Diving into Starlink's User Terminal Firmware"][268]

"DJI Mavic 3 Drone Research"

• ["Firmware Analysis"][376]
• ["Vulnerability Analysis"][713]

["Drone Security and Fault Injection Attacks"][82]

"DualShock4 Reverse Engineering":

• [Part 1][149]
• [Part 3][150]
• [Part 3][151]

"eBPF: A new frontier for malware"

["Emulating IoT Firmware Made Easy: Start Hacking Without the Physical Device"][47]

["Encrypted Doesn't Mean Authenticated: ShareFile RCE (CVE-2023-24489)"][182]

["ENLBufferPwn (CVE-2022-47949)"][422]

["Escaping the Google kCTF Container with a Data-Only Exploit"][178]

["Exploitation of a kernel pool overflow from a restrictive chunk size (CVE-2021-31969)"][827]

["Exploitation of Openfire CVE-2023-32315"][283]

["Exploiting a Critical Spoofing Vulnerability in Windows CryptoAPI"][572]

["Exploiting a Flaw in Bitmap Handling in Windows User-Mode Printer Drivers"][130]

["Exploiting CVE-2021-3490 for Container Escapes"][552]

["Exploiting null-dereferences in the Linux kernel"][148]

["Exploring UNIX pipes for iOS kernel exploit primitives"][514]

["EPF: Evil Packet Filter"][73]

["Escaping from Bhyve"][192]

["ESP32-C3 Wireless Adventure A Comprehensive Guide to IoT"][69]

["Espressif ESP32: Breaking HW AES with Electromagnetic Analysis"][394]

["Espressif ESP32: Breaking HW AES with Power Analysis"][393]

["Examining OpenSSH Sandboxing and Privilege Separation – Attack Surface Analysis"][324]

["Executing Arbitrary Code & Executables in Read-Only FileSystems"][52]

["Exploit Engineering – Attacking the Linux Kernel"][146]

["Exploiting a Remote Heap Overflow with a Custom TCP Stack"][322]

["Exploring Hell's Gate"][594]

["Exploiting a bug in the Linux kernel with Zig"][597]

["Exploiting HTTP Parsers Inconsistencies"][391]

["Exploiting MikroTik RouterOS Hardware with CVE-2023-30799"][198]

["Exploring Android Heap Allocations in Jemalloc 'New'"][7]

["Exploring Linux's New Random Kmalloc Caches"][511]

"Exploring the section layout in linker output"

"Fantastic Rootkits: And Where To Find Them":

• [Part 1][275]
• [Part 2][276]
• [Part 3][277]

["Few lesser known tricks, quirks and features of C"][354]

["Finding and exploiting process killer drivers with LOL for 3000$"][172]

["Finding bugs in C code with Multi-Level IR and VAST"][92]

["Finding Gadgets for CPU Side-Channels with Static Analysis Tools"][75]

["For Science! - Using an Unimpressive Bug in EDK II to Do Some Fun Exploitation"][70]

["FortiNAC - Just a few more RCEs"][95]

["Fortinet Series 3 — CVE-2022–42475 SSLVPN exploit strategy"][32]

["Framing Frames: Bypassing Wi-Fi Encryption by Manipulating Transmit Queues"][90]

["From C, with inline assembly, to shellcode"][235]

"Fuzzing Farm":

• ["Fuzzing GEGL with fuzzuf"][43]
• ["Evaluating Performance of Fuzzer"][44]
• ["Patch Analysis and PoC Development"][45]
• ["Hunting and Exploiting 0-day [CVE-2022-24834]"][46]

"Fuzzing Golang msgpack for fun and panic"

["Getting RCE in Chrome with incomplete object initialization in the Maglev compiler"][486]

"Ghidra" (Craig Young):

• ["A Guide to Reversing Shared Objects with Ghidra"][121]
• ["Reversing a Simple CrackMe with Ghidra Decompiler"][122]
• ["Vulnerability Hunting with Ghidra"][123]
• ["Patching a Bug from a Ghidra Listing"][124]
• ["Vulnerability Analysis with Ghidra Scripting"][125]

["Ghost In The Wire, Sonic In The Wall - Adventures With SonicWall"][481]

["Google Chrome V8 ArrayShift Race Condition Remote Code Execution"][530]

["Hacking a Tapo TC60 Camera"][350]

["Hacking Amazon's eero 6 (part 1)"][86]

["Hacking Brightway scooters: A case study"][29]

["Hacking ICS Historians: The Pivot Point from IT to OT"][444]

["Hacking the Nintendo DSi Browser"][456]

["Hardware Hacking to Bypass BIOS Passwords"][5]

["Heads up! Xdr33, A Variant Of CIA’s HIVE Attack Kit Emerges"][443]

["How a simple K-TypeConfusion took me 3 months long to create a exploit? [HEVD] - Windows 11 (build 22621)"][240]

["How does Linux start a process"][501]

"How NATs Work":

• [Part 1][152]
• [Part 2][153]
• [Part 3][154]
• [Part 4][155]

"How I Hacked my Car":

• [Part 1][101]
• [Part 2][102]
• [Part 3][103]
• [Part 4][104]
• [Part 5][105]
• [Part 6][106]

["How I hacked smart lights: the story behind CVE-2022-47758"][841]

["How to Emulate Android Native Libraries Using Qiling"][482]

["How to Voltage Fault Injection"][685]

["How To Secure A Linux Server"][140]

"Hunting Vulnerable Kernel Drivers"

["Icicle: A Re-designed Emulator for Grey-Box Firmware Fuzzing"][171]

["In-depth analysis on Valorant’s Guarded Regions"][141]

["In-Memory-Only ELF Execution (Without tmpfs)"][355]

["Intel BIOS Advisory – Memory Corruption in HID Drivers "][257]

["Intercepting Allocations with the Global Allocator"][79]

"Intro to Cutter"

["Introduction to SELinux"][59]

"IoT Series":

• ["Are People Ready to go?"][465]
• ["How To Build Kernel Image From Scratch"][466]
• ["Firmware testing in QEMU"][467]
• ["Debugging with GDB & GHIDRA + Zero-day"][468]

["JTAG 'Hacking' the Original Xbox in 2023"][244]

["Kernel Exploit Factory"][159]

["Learn Makefiles With the tastiest examples"][24]

["Let's build a Chrome extension that steals everything"][463]

["Let’s Go into the rabbit hole — the challenges of dynamically hooking Golang programs"][387]

• [Part 1][387]
• [Part 2][904]
• [Part 3][930]

["Leveraging ssh-keygen for Arbitrary Execution (and Privilege Escalation)"][327]

"lexmark printer haxx"

[linux-re-101][169]

["Linux debugging, profiling and tracing training"][353]

"Linux Kernel Exploitation"

• ["Getting started & BOF"][678]
• ["Heap techniques"][679]
• ["Exploiting race-condition + UAF"][680]

"Linux Kernel PWN":

• ["ret2dir"][899]
• ["DirtyCred"][900]

["Linux Kernel Unauthenticated Remote Heap Overflow Within KSMBD"][544]

["Linux Kernel Teaching"][131]

["Linux Malware: Defense Evasion Techniques"][165]

"Linux Red Team":

• ["Exploitation Techniques"][222]
• ["Privilege Escalation Techniques"][223]
• ["Persistence Techniques"][224]

["Linux Remote Process Injection - (Injecting into a firefox process)"][569]

["Linux rootkits explained – Part 1: Dynamic linker hijacking"][60]

["Linux Shellcode 101: From Hell to Shell"][53]

["Local Privilege Escalation on the DJI RM500 Smart Controller"][160]

"Lord Of The Ring0":

• [Part 1][10]
• [Part 2][11]
• [Part 3][12]
• [Part 4][13]
• [Part 5][14]

["Low-Level Software Security for Compiler Developers"][15]

["LPE and RCE in RenderDoc: CVE-2023-33865, CVE-2023-33864, CVE-2023-33863"][202]

["Making TOCTOU Great again – X(R)IP"][474]

"Malware Reverse Engineering for Beginners":

• [Part 1][128]
• [Part 2][129]

["Man-in-the-Middle Attacks without Rogue AP: When WPAs Meet ICMP Redirects"][285]

"mast1c0re"

• ["Introduction – Exploiting the PS4 and PS5 through a game save"][38]
• ["Part 1 – Modifying PS2 game save files"][39]
• ["Part 2 – Arbitrary PS2 code execution"][40]
• ["Part 3 – Escaping the emulator"][41]

["Mélofée: a new alien malware in the Panda's toolset targeting Linux hosts"][330]

["Meterpreter vs Modern EDR(s)"][170]

"MTE As Implemented":

• [Part 1][366]
• [Part 2][367]

["mTLS: When certificate authentication is done wrong"][270]

["MSMQ QueueJumper (RCE Vulnerability): An in-depth technical analysis"][177]

["Multiple Vulnerabilities in Qualcomm and Lenovo ARM-based Devices"][404]

"NetGear Series: Emulating Netgear R6700V3 circled binary ":

• [Part 1][441]
• [Part 2][442]

["New HiatusRAT Router Malware Covertly Spies On Victims"][402]

["No Alloc, No Problem: Leveraging Program Entry Points for Process Injection"][1091]

["NVMe: New Vulnerabilities Made Easy"][264]

["nftables Adventures: Bug Hunting and N-day Exploitation (CVE-2023-31248)"][365]

["Obscure Windows File Types"][74]

["Old Bug, Shallow Bug: Exploiting Ubuntu at Pwn2own Vancouver 2023"][254]

["One shot, Triple kill"][700]

"OPC UA Deep Dive Series":

• [Part 1][211]
• [Part 2][212]
• [Part 3][213]
• [Part 4][214]
• [Part 5][215]

["OpenSSH Pre-Auth Double Free CVE-2023-25136 – Writeup and Proof-of-Concept"][42]

["OrBit: advanced analysis of a Linux dedicated malware"][427]

["OrBit: New Undetected Linux Threat Uses Unique Hijack of Execution Flow"][428]

["P2PInfect: The Rusty Peer-to-Peer Self-Replicating Worm"][206]

["P4wnP1-LTE"][209]

["Patches, Collisions, and Root Shells: A Pwn2Own Adventure"][278]

["Patch Tuesday -> exploit Wednesday: Pwning windows ancillary function driver for WinSock (afd.sys) in 24 hours"][297]

["Persistence Techniques That Persist"][299]

["Practical Introduction to BLE GATT Reverse Engineering: Hacking the Domyos EL500"][166]

["prctl anon_vma_name: An Amusing Linux Kernel Heap Spray"][184]

["Producing a POC for CVE-2022-42475 (Fortinet RCE)"][323]

["Protecting Android clipboard content from unintended exposure"][448]

"Protecting the Phoenix: Unveiling Critical Vulnerabilities in Phoenix Contact HMI"

• [Part 1][477]
• [Part 2][478]
• [Part 3][479]

"Prototype Pollution in Python"

["PSPRAY: Timing Side-Channel based Linux Kernel Heap Exploitation Technique"][758]

["PyLoose: Python-based fileless malware targets cloud workloads to deliver cryptominer"][98]

["PwnAgent: A One-Click WAN-side RCE in Netgear RAX Routers with CVE-2023-24749"][318]

"Pwnassistant - Controlling /home's via a Home Assistant RCE"

["Pwning Pixel 6 with a leftover patch"][310]

["Pwning the tp-link ax1800 wifi 6 Router: Uncovered and Exploited a Memory Corruption Vulnerability"][309]

["Racing Against the Lock: Exploiting Spinlock UAF in the Android Kernel"][185]

["Readline crime: exploiting a SUID logic bug"][439]

["Red vs. Blue: Kerberos Ticket Times, Checksums, and You!"][30]

["Reptar"][527]

["Restoring Dyld Memory Loading"][522]

["Retreading The AMLogic A113X TrustZone Exploit Process"][77]

["Reversing UK mobile rail tickets"][551]

"Reversing Windows Container":

• [Part 1][821]
• [Part 2][822]

["RISC-V Bytes: Exploring a Custom ESP32 Bootloader"][493]

["REUnziP: Re-Exploiting Huawei Recovery With FaultyUSB"][364]

["Revisiting CVE-2017-11176"][48]

"Rooting the FiiO M6":

• ["Using the "World's Worst Fuzzer" To Find A Kernel Bug"][499]
• ["Writing an LPE Exploit For Our Overflow Bug"][500]

["Rooting Xiaomi WiFi Routers"][817]

["Rust Binary Analysis, Feature by Feature"][231]

["Rust to Assembly: Understanding the Inner Workings of Rust"][134]

"Rustproofing Linux":

• [Part 1][575]
• [Part 2][576]
• [Part 3][577]
• [Part 4][578]

["scudo Hardened Allocator — Unofficial Internals Documentation"][706]

"Securing our home labs: Frigate code review"

"Securing our home labs: Home Assistant code review"

["SHA-1 gets SHAttered"][325]

["Shambles: The Next-Generation IoT Reverse Engineering Tool to Discover 0-Day Vulnerabilities"][55]

["Shell in the Ghost: Ghostscript CVE-2023-28879 writeup"][76]

["Shifting boundaries: Exploiting an Integer Overflow in Apple Safari"][261]

["Shooting Yourself in the .flags – Jailbreaking the Sonos Era 100"][531]

["Smart Speaker Shenanigans: Making the Sonos ONE Sing its Secrets"][504]

["Smashing the state machine: the true potential of web race conditions"][271]

["SRE deep dive into Linux Page Cache"][94]

["Sshimpanzee"][16]

["Stepping Insyde System Management Mode"][256]

["Sudoedit bypass in Sudo <= 1.9.12p1 CVE-2023-22809"][562]

["THC's favourite Tips, Tricks & Hacks (Cheat Sheet)"][31]

["The ARM32 Scheduling and Kernelspace/Userspace Boundary"][512]

["The art of Fuzzing: Introduction"][57]

["The art of fuzzing: Windows Binaries"][89]

["The art of fuzzing-A Step-by-Step Guide to Coverage-Guided Fuzzing with LibFuzzer"][54]

["The Art Of Linux Persistence"][872]

["The Blitz Tutorial Lab on Fuzzing with AFL++"][303]

["The code that wasn’t there: Reading memory on an Android device by accident"][462]

["The Dragon Who Sold His camaro: Analyzing Custom Router Implant"][228]

["The Importance of Reverse Engineering in Network Analysis"][426]

["The Linux Kernel Module Programming Guide"][3]

["The Most Dangerous Codec in the World: Finding and Exploiting Vulnerabilities in H.264 Decoders"][284]

["The Role of the Control Flow Graph in Static Analysis"][509]

["The Silent Spy Among Us: Smart Intercom Attacks"][331]

["The Stack Series: The X64 Stack"][356]

["The Untold Story of the BlackLotus UEFI Bootkit"][205]

["Tickling ksmbd: fuzzing SMB in the Linux kernel"][386]

["Tool Release: Cartographer"][371]

["Total Identity Compromise: Microsoft Incident Response lessons on securing Active Directory"][445]

["Xortigate, or CVE-2023-27997 - The Rumoured RCE That Was"][80]

["Your not so "Home Office" - SOHO Hacking at Pwn2Own"][5]

["Ubuntu Shiftfs: Unbalanced Unlock Exploitation Attempt"][524]

["Unauthenticated RCE on a RIGOL oscilloscope"][210]

["UNCONTAINED: Uncovering Container Confusion in the Linux Kernel"][37]

["Uncovering a crazy privilege escalation from Chrome extensions"][502]

["Uncovering HinataBot: A Deep Dive into a Go-Based Threat"][311]

["Under The Hood - Disassembling of IKEA-Sonos Symfonisk Speaker Lamp"][180]

["Understanding a Payload’s Life Featuring Meterpreter & Other Guests "][315]

["Understanding Dirty Pagetable - m0leCon Finals 2023 CTF Writeup"][591]

["Understanding the Heap - a beautiful mess"][348]

["Unleashing ksmbd: crafting remote exploits of the Linux kernel"][828]

["Unleashing ksmbd: remote exploitation of the Linux kernel (ZDI-23-979, ZDI-23-980)"][533]

["Unlimited Results: Breaking Firmware Encryption of ESP32-V3"][598]

"Unveiling secrets of the ESP32":

• "creating an open-source MAC Layer"
• "reverse engineering RX"

"Web Hackers vs. The Auto Industry: Critical Vulnerabilities in Ferrari, BMW, Rolls Royce, Porsche, and More"

["What is Loader Lock?"][845]

["Windows Installer arbitrary content manipulation Elevation of Privilege (CVE-2020-0911)"][58]

["Windows Installer EOP (CVE-2023-21800)"][314]

["Writing your own RDI /sRDI loader using C and ASM"][307]

["Zenbleed"][207]

["Zero Effort Private Key Compromise: Abusing SSH-Agent For Lateral Movement"][248]## 2022

"A journey into IoT":

• ["Chip identification, BUSSide, and I2C"][294]
• ["Discover components and ports"][295]
• ["Firmware dump and analysis"][296]
• ["Radio communications"][681]
• ["Internal communications"][682]

["A Kernel Hacker Meets Fuchsia OS"][710]

"A Technical Analysis of Pegasus for Android":

• [part 1][564]
• [Part 2][565]
• [Part 3][566]

["ALL ABOUT USB-C: INTRODUCTION FOR HACKERS"][747]

["An In-Depth Look at the ICE-V Wireless FPGA Development Board"][779]

"ARM 64 Assembly Series":

• ["Basic definitions and registers"][408]
• ["Offset and Addressing modes"][409]
• ["Load and Store"][410]
• ["Branch"][411]
• ["Data Processing (Part 1)"][412]
• ["Data Processing (Part 2)"][413]
• ["selections and loops"][414]
• ["Subroutines"][415]

["Attacking the Android kernel using the Qualcomm TrustZone"][885]

["Attacking Titan M with Only One Byte"][259]

["Avoiding Detection with Shellcode Mutator"][432]

"BasicFUN Series":

• "Hardware Analysis / SPI Flash Extraction"
• "Reverse Engineering Firmware / Reflashing SPI Flash"
• "Dumping Parallel Flash via I2C I/O Expanders"
• "I2C Sniffing, EEPROM Extraction and Parallel Flash Extraction"

["Basics for Binary Exploitation"][749]

["Breaking Secure Boot on Google Nest Hub (2nd Gen) to run Ubuntu"][238]

["BrokenPrint: A Netgear stack overflow"][782]

"Bypassing software update package encryption ":

• ["Extracting the Lexmark MC3224i printer firmware"][190]
• ["Exploiting the Lexmark MC3224i printer"][191]

["Bypassing vtable Check in glibc File Structures"][208]

["Blind Exploits to Rule Watchguard Firewalls"][173]

["BPFDoor - An Evasive Linux Backdoor Technical Analysis"][292]

["Canary in the Kernel Mine: Exploiting and Defending Against Same-Type Object Reuse"][917]

"Chrome Browser Exploitation":

• [Part 1][1053]
• [Part 2][1054]
• [Part 3][1055]

["Competing in Pwn2Own 2021 Austin: Icarus at the Zenith"][556]

["CoRJail: From Null Byte Overflow To Docker Escape Exploiting poll_list Objects In The Linux Kernel"][759]

["Corrupting memory without memory corruption"][762]

["Creating a Rootkit to Learn C"][719]

["CVE-2022-0435: A Remote Stack Overflow in The Linux Kernel"][377]

["[CVE-2022-1786] A Journey To The Dawn"][401]

["CVE-2022-2602: DirtyCred File Exploitation applied on an io_uring UAF"][168]

["CVE-2022-27666: Exploit esp6 modules in Linux kernel"][532]

["CVE-2022-29582 An io_uring vulnerability"][495]

["Deconstructing and Exploiting CVE-2020-6418"][778]

["DirtyCred Remastered: how to turn an UAF into Privilege Escalation"][167]

"Disclosing information with a side-channel in Django"

["Dumping the Amlogic A113X Bootrom"][78]

["Dynamic analysis of firmware components in IoT devices"][250]

["Embedded Systems Security and TrustZone"][145]

["Emulate Until You Make it"][748]

["EntryBleed: Breaking KASLR under KPTI with Prefetch (CVE-2022-4543)"][473]

["Expanding the Dragon: Adding an ISA to Ghidra"][542]

["Exploiting: Buffer overflow in Xiongmai DVRs"][742]

["Exploiting CSN.1 Bugs in MediaTek Basebands"][272]

["exploiting CVE-2019-2215"][61]

"Exploiting CVE-2022-42703 - Bringing back the stack attack"

["Exploration of the Dirty Pipe Vulnerability (CVE-2022-0847)"][707]

"Exploring the Hidden Attack Surface of OEM IoT Devices"

["Firmware key extraction by gaining EL3"][316]

["Fortigate - Authentication Bypass Lead to Full Device Takeover"][291]

"Fourchain":

• ["Prologue"][765]
• ["Hole"][766]
• ["Sandbox"][767]

["Fuzzing ping(8) … and finding a 24 year old bug"][751]

"Hacking Bluetooth to Brew Coffee from Github Actions":

• [Part 1][752]
• [Part 2][753]
• [Part 3][754]

"Hackign More Secure Portable Storage Devices"

["How did I approach making linux LKM rootkit, “reveng_rtkit” ?"][884]

["How The Tables Have Turned: An analysis of two new Linux vulnerabilities in nf_tables"][266]

["Huawei Security Hypervisor Vulnerability"][435]

"Hunting for Persistence in Linux"

• [Part 1][64]
• [Part 2][65]
• [Part 3][66]
• [Part 4][67]
• [Part 5][68]

"Hacking Some More Secure USB Flash Drives":

• [Part 1][132]
• [Part 2][133]

["Learning eBPF exploitation"][768]

"Intro to Embedded RE":

• ["Tools and Series"][351]
• ["UART Discovery and Firmware Extraction via UBoot"][352]

"Introduction to x64 Linux Binary Exploitation":

• Part 1
• Part 2
• Part 3
• Part 4
• Part 5

["io_uring - new code, new bugs, and a new exploit technique"][978]

["Linux Hardening Guide"][349]

["Linux Kernel: Exploiting a Netfilter Use-after-Free in kmalloc-cg"][269]

["Linux Kernel Exploit (CVE-2022–32250) with mqueue"][242]

"Linux SLUB Allocator Internals and Debugging":

• [Part 1][359]
• [Part 2][360]
• [Part 3][361]
• [Part 4][362]

["Linternals: Introducing Memory Allocators & The Page Allocator"][516]

["Linternals: The Slab Allocator"][517]

["Linux kernel heap feng shui in 2022"][535]

["Looking for Remote Code Execution bugs in the Linux kernel"][503]

["Manipulating AES Traffic using a Chain of Proxies and Hardcoded Keys"][319]

["MeshyJSON: A TP-Link tdpServer JSON Stack Overflow"][777]

["Missing Manuals - io_uring worker pool"][265]

["Modifying Embedded Filesystems in ARM Linux zImages"][775]

"Netgear Orbi":

• ["orbi hunting 0x0: introduction, uart access, recon"][33]
• ["orbi hunting 0x1: crashes in soap-api"][34]
• ["nday exploit: netgear orbi unauthenticated command injection (cve-2020-27861)"][35]

["nday exploit: libinput format string bug, canary leak exploit (cve-2022-1215)"][63]

["NFC Relay Attack on Tesla Model Y"][574]

["Nightmare: One Byte to ROP // Deep Dive Edition"][582]

["Overview of GLIBC heap exploitation techniques"][239]

"Parsing TFTP in Rust"

["Patching, Instrumenting & Debugging Linux Kernel Modules"][483]

"PCIe DMA Attack against a secured Jetson Nano (CVE-2022-21819)"

["pipe_buffer arbitrary read write"][282]

"Pixel 6 Bootloader"

• ["Booting up"][286]
• ["Emulation, ROP"][287]
• ["Exploitation"][288]

["Port knocking from the scratch"][227]

["Pulling MikroTik into the Limelight"][120]

["Racing against the clock -- hitting a tiny kernel race window"][492]

["Replicating CVEs with KLEE"][763]

["Reversing C++, Qt based applications using Ghidra"][586]

["Racing Cats to the Exit: A Boring Linux Kernel Use-After-Free"][406]

["Replicant: Reproducing a Fault Injection "][675]

["Researching Xiaomi’s Tee to Get to Chinese Money"][274]

"Reversing embedded device bootloader (U-Boot)":

• [Part 1][162]
• [Part 2][163]

["Reverse Engineering a Cobalt Strike Dropper With Binary Ninja"][368]

"Reverse engineering an EV charger"

"Reverse Engineering Dark Souls 3":

• "Connection"
• "Packets"
• "Key Exchange"
• "Reliable UDP"

["Reverse engineering integrity checks in Black Ops 3"][220]

["Reverse engineering thermal printers"][245]

["Reviving Exploits Against Cred Structs - Six Byte Cross Cache Overflow to Leakless Data-Oriented Kernel Pwnage"][491]

["SETTLERS OF NETLINK: Exploiting a limited UAF in nf_tables (CVE-2022-32250)"][484]

["Shedding Light on Huawei's Security Hypervisor"][434]

["Shikitega - New stealthy malware targeting Linux"][438]

["side channels: power analysis"][380]

["side channels: using the chipwhisperer"][381]

["SIM Hijacking"][579]

["Spoofing Call Stacks To Confuse EDRs"][431]

["SROP Exploitation with radare2"][770]

["Stealing the Bitlocker key from a TPM"][505]

["Stranger Strings: An exploitable flaw in SQLite"][588]

"Survey of security mitigations and architectures, December 2022"

["Symbiote Deep-Dive: Analysis of a New, Nearly-Impossible-to-Detect Linux Threat"][461]

["Tetsuji: Remote Code Execution on a GameBoy Colour 22 Years Later"][226]

["The Dirty Pipe Vulnerability"][321]

["The Last Breath of Our Netgear RAX30 Bugs - A Tragic Tale before Pwn2Own Toronto 2022"][772]

["The Old, The New and The Bypass - One-click/Open-redirect to own Samsung S22 at Pwn2Own 2022"][36]

["TheHole New World - how a small leak will sink a great browser (CVE-2021-38003)"][751]

"The toddler’s introduction to Heap exploitation":

• ["Part 1"][339]
• ["Part 2"][340]
• ["Overflows"][341]
• ["Use After Free & Double free"][342]
• ["FastBin Dup to Stack"][343]
• ["FastBin Dup Consolidate"][344]
• ["Unsafe Unlink"][345]
• ["House of Spirit"][346]
• ["House of Lore"][347]

["TP-Link Tapo c200 Camera Unauthenticated RCE (CVE-2021-4045)"][553]

["Tracing and Manipulating with DynamoRIO"][750]

["Trying To Exploit A Windows Kernel Arbitrary Read Vulnerability"][312]

["Turning Google smart speakers into wiretaps for $100k"][18]

"UWB Real Time Locating Systems: How Secure Radio Communications May Fail in Practice'"

["Vulnerabilities and Hardware Teardown of GL.iNET GL-MT300N-V2 Router"][126]

"Vulnerabilities in BMC Firmware Affect OT/IoT Device Security":

• [Part 1][496]
• [Part 2][497]

["Vulnerability Details for CVE-2022-41218"][563]

["Vulnerabilities in Tenda's W15Ev2 AC1200 Router"][127]

"When an N-Day turns into a 0day"

["WPAxFuzz: Sniffing Out Vulnerabilities in Wi-Fi Implementations"][764]

["Write a Linux firewall from scratch based on Netfilter"][313]

["Yet another bug into Netfilter"][457]

"Xiongmai IoT Exploitation"

"Zyxel authentication bypass patch analysis (CVE-2022-0342)"

• [Part 1][83]
• [Part 2][84]
• [Part 3][85]

• [Part 1][740]
• [Part 1][741]

• ["Debugging the Kernel with QEMU"][25]
• ["Smashing Stack Overflows in the Kernel"][26]
• ["Controlling RIP and Escalating privileges via Stack Overflow"][27]

• [Part 1][470]
• [Part 2][471]
• [Part 3][472]

• [Part 1][792]
• [Part 2][793]
• [Part 3][794]
• [Part 4][795]
• [Part 5][796]
• [Part 6][797]
• [Part 7][798]
• [Part 8][799]
• [Part 9][800]

• [Part 1][142]
• [Part 2][143]
• [Part 3][144]

• [Part 1][423]
• [Part 2][424]
• [Part 3][425]

• [Part 1][960]
• [Part 2][961]