• Open

    Public Report: Meta Whatsapp message summarization service
    No content preview  ( 6 min )

  • Open

    Reduce hallucination risk by prompting multiple AI models simultaneously with Chorus
    The Chorus app is built to send prompts to multiple AI models from different providers simultaneously. You can also query several search engines with each prompt. Both methods significantly reduce the risk of hallucinations. Source

  • Open

    Referral Beware, Your Rewards are Mine (Part 1)
    The post Referral Beware, Your Rewards are Mine (Part 1) appeared first on Rhino Security Labs.  ( 7 min )

  • Open

    Cline: Vulnerable To Data Exfiltration And How To Protect Your Data
    Cline is quite a popular AI coding agent, according to the product website it has 2+ million downloads and over 47k stars on GitHub. Unfortunately, Cline is vulnerable to data exfiltration through the rendering of markdown images from untrusted domains in the chat box. This allows an adversary to exfiltrate sensitive user information during a prompt injection attack by reading sensitive data (e.g. .env file) and appending its contents to the URL of an image.  ( 3 min )

  • Open

    The Top Reasons Security Leaders Choose Red Teaming
    Security leaders are turning to red teaming to test defenses against real-world adversaries. From validating investments to sharpening blue team skills, discover why this strategy is becoming a must-have for organizations serious about cyber resilience.  ( 8 min )

  • Open

    Start hacking Bluetooth Low Energy today! (part 2)
    TL;DR   We made it beep for free (ish)  In part one we started hacking Bluetooth and made a little £2 key-finder beep using only Android and Linux. If you haven’t read that post, I would recommend it as a primer to the devices, BLE and what we’re doing, but TLDR we got them to go […] The post Start hacking Bluetooth Low Energy today! (part 2)  appeared first on Pen Test Partners.  ( 9 min )

  • Open

    Implement EIP-7730 today
    EIP-7730 enables hardware wallets to decode transactions into human-readable formats, eliminating blind signing vulnerabilities with minimal implementation effort for dApp developers.  ( 8 min )

  • Open

    "The entire internet is broken": ethical hacking expert John Hammond meets James Kettle
    In a brand-new collaboration between ethical hacking and AppSec expert John Hammond and world-renowned security researcher James Kettle, the pair explore how tens of millions of websites are compromis  ( 3 min )

  • Open

    The One Where We Just Steal The Vulnerabilities (CrushFTP CVE-2025-54309)
    On July 18, 2025, users of CrushFTP woke up to an announcement: https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025 As we’ve all experienced in 2025, 2025 has been the year of vendors burying their heads in the sand with regard to in-the-wild exploitation, even in the  ( 6 min )

  • Open

    Perplexity Comet: A rising AI browser star
    In my last post, I discussed Perplexity's aim to transform the familiar blinking web we've known for decades. It brings to mind the early days of Google, when many questioned the need for another search engine since AltaVista already did a good job. Although Comet appears to be just another Chromium-based web browser, the AI powering the browser under the hood has the same disruptive potential as Google's PageRank algorithm once did. Source

  • Open

    AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
    On the day AWS Kiro was released, I couldn’t resist putting it through some of my Month of AI Bugs security tests for coding agents. AWS Kiro was vulnerable to arbitrary command execution via indirect prompt injection. This means that a remote attacker, who controls data that Kiro processes, could hijack it to run arbitrary operating system commands or write and run custom code. In particular two attack paths that enabled this with AWS Kiro were identified:  ( 4 min )

  • Open

    Inline Style Exfiltration: leaking data with chained CSS conditionals
    I discovered how to use CSS to steal attribute data without selectors and stylesheet imports! This means you can now exploit CSS injection via style attributes! Learn how below: Someone asked if you c  ( 3 min )

  • Open

    Detection Engineering: Practicing Detection-as-Code – Documentation – Part 4
    Sufficiently documenting our detections is essential in detection engineering as it provides context around the the purpose, detection logic, and expected behaviour of each detection rule. Just as important as documenting individual detections is tracking how the overall detection library evolves. In this part we are looking into how we can tackle both of those issues.  ( 27 min )

  • Open

    AI browser Comet with efficient ad blocking, Perplexity’s deception and hypocrisy
    Perplexity's new AI-powered Comet web browser, initially exclusive to Max subscribers at $200 monthly, is now accessible to Pro subscribers for $20. I tested it and am impressed—both by Perplexity's hypocrisy and Comet's truly innovative browsing experience. This post shares my rant against Perplexity, while my next post will praise Comet, the first browser on the battlefield in the new browser war. Source

  • Open

    How Prompt Injection Exposes Manus' VS Code Server to the Internet
    Today we will cover a powerful, easy to use, autonomous agent called Manus. Manus is developed by the Chinese startup Butterfly Effect, headquartered in Singapore. This post demonstrates an end-to-end indirect prompt injection attack leading to a compromise of Manus’ dev box. This is achieved by tricking Manus to expose it’s internal VS Code Server to the Internet, and then sharing the URL and password with the atacker. Specifically, this post demonstrates that:  ( 4 min )
    How Deep Research Agents Can Leak Your Data
    Recently, many of our favorite AI chatbots have gotten autonomous research capabilities. This allows the AI to go off for an extended period of time, while having access to tools, such as web search, integrations, connectors and also custom-built MCP servers. This post will explore and explain in detail how there can be data spill between connected tools during Deep Research. The research is focused on ChatGPT but applies to other Deep Research agents as well.  ( 5 min )

  • Open

    Speedrunning the New York Subway
    We optimized the route for visiting every NYC subway station using algorithms from combinatorial optimization, creating a 20-hour tour that beats the existing world record by 45 minutes.  ( 13 min )

  • Open

    Sneaking Invisible Instructions by Developers in Windsurf
    Imagine a malicious instruction hidden in plain sight, invisible to you but not to the AI. This is a vulnerability discovered in Windsurf Cascade, it follows invisible instructions. This means there can be instructions in a file or result of a tool call that the developer cannot see, but the LLM does. Some LLMs interpret invisible Unicode Tag characters as instructions, which can lead to hidden prompt injection. As far as I can tell the Windsurf SWE-1 model can also “see” these invisible characters, but the SWE-1 is not yet capable of interpreting them as instructions.  ( 2 min )

  • Open

    Windsurf: Memory-Persistent Data Exfiltration (SpAIware Exploit)
    In this second post about Windsurf Cascade we are exploring the SpAIware attack, which allows memory persistent data exfiltration. SpAIware is an attack we first successfully demonstrated with ChatGPT last year and OpenAI mitigated. While inspecting the system prompt of Windsurf Cascade I noticed that it has a create_memory tool. Creating Memories The question that immediately popped into my head was if this tool will require human approval when Cascade creates a long-term memory, or if it is added automatically.  ( 4 min )

  • Open

    Access remote Ollama AI models through an SSH tunnel
    In my previous Ollama series post, I explained how to access self-hosted AI models in Ollama via HTTP. While this method provides convenient connectivity from different apps, it's only secure for on-premises Ollama hosts. For remote internet access, you can set up an SSH tunnel. Alternatively, you can securely connect from GitHub Copilot to your self-hosted AI models by using Microsoft's VS Code extension Remote - SSH. Source

  • Open

    Remote HTTP access to self-hosted Ollama AI models
    In my previous post in the Ollama series with OpenAI OSS models, I explained how to install Ollama on an Ubuntu EC2 instance. If you followed my guide, you now have everything set up to remotely access gpt-oss-20b on your self-hosted Ollama installation via HTTP. I will also showcase how to connect to remote AI models in VS Code using popular coding assistants like Cline and Roo Code, as well as through AI apps such as the local Ollama client, BoltAI, and Anything LLM. Source

  • Open

    From Talent Shortage to Cybersecurity Talent Pipeline
    Cybersecurity faces a paradox: millions of jobs go unfilled while eager newcomers struggle to break in. This blog explores why the gap exists—and how mentorship, realistic hiring, and early-career programs can transform the shortage into a sustainable talent pipeline.  ( 8 min )

  • Open

    Weaponizing image scaling against production AI systems
    In this blog post, we’ll detail how attackers can exploit image scaling on Gemini CLI, Vertex AI Studio, Gemini’s web and API interfaces, Google Assistant, Genspark, and other production AI systems. We’ll also explain how to mitigate and defend against these attacks, and we’ll introduce Anamorpher, our open-source tool that lets you explore and generate these crafted images.  ( 5 min )

  • Open

    Hijacking Windsurf: How Prompt Injection Leaks Developer Secrets
    This is the first post in a series exploring security vulnerabilities in Windsurf. If you are unfamiliar with Windsurf, it is a fork of VS Code and the coding agent is called Windsurf Cascade. The attack vectors we will explore today allow an adversary during an indirect prompt injection to exfiltrate data from the developer’s machine. These vulnerabilities are a great example of Simon Willison’s lethal trifecta pattern. Overall, the security vulnerability reporting experience with Windsurf has not been great.  ( 3 min )

  • Open

    Start hacking Bluetooth Low Energy today! (part 1)
    TL;DR Before you start First off, before we start  Bluetooth hacking can be confusing, there are lots of references to tools that are a bit outdated, scripts that don’t run, and more. The actual Bluetooth specs are huge, but honestly, who cares as long as you can make a device do a thing? If we […] The post Start hacking Bluetooth Low Energy today! (part 1) appeared first on Pen Test Partners.  ( 12 min )

  • Open

    Proxmox VE 9.0
    In my previous post, I covered the new features in Proxmox Backup Server 4.0. Released simultaneously, Proxmox Virtual Environment (VE) 9.0 also merits attention. It runs on Debian 13 Trixie with Kernel 6.14 and includes updated QEMU, LXC, ZFS, and Ceph versions. More significantly, it introduces modifications affecting storage management, networking, and high availability within your virtual setup. This article examines these updates more closely, providing commands and examples you can test on your own system. Source

  • Open

    Amazon Q Developer for VS Code Vulnerable to Invisible Prompt Injection
    The Amazon Q Developer VS Code Extension (Amazon Q) is a very popular coding agent, with over 1 million downloads. In previous posts we showed how prompt injection vulnerabilities in Amazon Q could lead to: Exfiltration of sensitive information from the user’s machine , and also to a System compromise by running arbitrary code Today we will show how an attack can leverage invisible Unicode Tag characters that humans cannot see.  ( 3 min )

  • Open

    Guess Who Would Be Stupid Enough To Rob The Same Vault Twice? Pre-Auth RCE Chains in Commvault
    We’re back, and we’ve finished telling everyone that our name was on the back of Phrack!!!!1111 Whatever, nerds. Today, we're back to scheduled content. Like our friendly neighbourhood ransomware gangs and APT groups, we've continued to spend irrational amounts of time  ( 28 min )

  • Open

    DLL ForwardSideloading
    Some DLLs export functions (via export table) that are just forwarding execution to functions implemented in other libraries. It’s a very common practice and one of the most known forwards are: kernel32.dll HeapAlloc -> NTDLL.RtlAllocateHeapkernel32.dll HeapReAlloc -> NTDLL.RtlReAllocateHeapkernel32.dll HeapSize -> … Continue reading →  ( 3 min )

  • Open

    Amazon Q Developer: Remote Code Execution with Prompt Injection
    The Amazon Q Developer VS Code Extension (Amazon Q) is a popular coding agent, with over 1 million downloads. The extension is vulnerable to indirect prompt injection, and in this post we discuss a vulnerability that allowed an adversary (or also the AI for that matter) to run arbitrary commands on the host without the developer’s consent. The resulting impact of the vulnerability is the same as CVE-2025-53773 that Microsoft fixed in GitHub Copilot, however AWS did not issue a CVE when patching the vulnerabiliy.  ( 7 min )

  • Open

    Install Ollama with OpenAI gpt-oss-20b on Ubuntu within an EC2 instance
    In my previous post, I explained why you might want to run OpenAI gpt-oss-20b or gpt-oss-120b on your own virtual machine and how to select an appropriate EC2 instance type. Today, I will show you how to install Ollama via script or snap on Ubuntu within an EC2 instance. Most steps can be adapted for other cloud providers, on-premises setups, or Linux distributions with minor modifications. I will also briefly discuss the benefits of running open-weight models on an EC2 instance with Ollama compared to Bedrock, SageMaker, vLLM, or Hugging Face Transformers. Source

  • Open

    Beware the false false-positive: how to distinguish HTTP pipelining from request smuggling
    Sometimes people think they've found HTTP request smuggling, when they're actually just observing HTTP keep-alive or pipelining. This is usually a false positive, but sometimes there's actually a real  ( 6 min )

  • Open

    Marshal madness: A brief history of Ruby deserialization exploits
    This post traces the decade-long evolution of Ruby Marshal deserialization exploits, demonstrating how security researchers have repeatedly bypassed patches and why fundamental changes to the Ruby ecosystem are needed rather than continued patch-and-hope approaches.  ( 7 min )

  • Open

    The Art of the Honeypot Account: Making the Unusual Look Normal
    This article was originally posted on the Trimarc Content Hub on August 6, 2020.Updated here with authentication PowerShell code on August 18, 2025. ADSecurity.org is the new home for this article and all updates will occur here. I have had the idea for a post describing how to best create a honeypot (or honeytoken) account … Continue reading  ( 14 min )
    Detecting Password Spraying with Security Event Auditing
    This article was originally posted on the Trimarc Content Hub on February 10, 2017. A common method attackers leverage as well as many penetration testers and Red Teamers is called “password spraying”. Password spraying is interesting because it’s automated password guessing. This automated password guessing against all users typically avoids account lockout since the logon … Continue reading  ( 8 min )

  • Open

    A Look at RTEMS Security
    No content preview  ( 6 min )

  • Open

    Trivial C# Random Exploitation
    Exploiting random number generators requires math, right? Thanks to C#’s Random, that is not necessarily the case! I ran into an HTTP 2.0 web service issuing password reset tokens from a custom encoding of (new Random()).Next(min, max) output. This led to a critical account takeover. Exploitation did not require scripting, math or libraries. Just several clicks in Burp. While I had source code, I will show a method of discovering and exploiting this vulnerability in a black-box or bug-bounty style engagement. The exploit uses no math, but I do like math. So, there is a bonus section on how to optimize and invert Random. The Vulnerability I can’t share the client code, but it was something like this: var num = new Random().Next(min, max); var token = make_password_reset_token(num); save_r…  ( 8 min )

  • Open

    Amazon Q Developer: Secrets Leaked via DNS and Prompt Injection
    The next three posts will cover high severity vulnerabilities in the Amazon Q Developer VS Code Extension (Amazon Q Developer), which is a very popular coding agent, with over 1 million downloads. It is vulnerable to prompt injection from untrusted data and its security depends heavily on model behavior. At a high level Amazon Q Developer can leak sensitive information from a developer’s machine, e.g. API keys, to external servers via DNS requests.  ( 4 min )

  • Open

    Running OpenAI gpt-oss-20b and gpt‑oss-120b in AWS on your own EC2 instance
    OpenAI recently released its first open-weight models, gpt-oss-20b and gpt‑oss-120b, which you can download and run with Ollama. If security and privacy are essential when using AI models, you might not want to use the vendor's chat UI or API. The most powerful AI models require significant computing power and memory, and many desktop devices cannot run these models. Although Ollama was not designed with remote connections in mind, it is still possible. In this series, I will explain how to install OpenAI's open-weight models using Ollama and connect to them remotely from various applications, including VS Code GitHub Copilot. In this first post, I will outline how to choose the right size for your virtual machine, using EC2 instance types in AWS as an example. Source

  • Open

    Data Exfiltration via Image Rendering Fixed in Amp Code
    In this post we discuss a vulnerability that was present in Amp Code from Sourcegraph by which an attacker could exploit markdown driven image rendering to exfiltrate sensitive information. This vulnerability is common in AI applications and agents, and it’s actually similar to one we discussed last year in GitHub Copilot which Microsoft fixed. Exploit Demonstration For the proof-of-concept I use a pre-existing demo that created a longer time ago.  ( 2 min )

  • Open

    Beyond good ol’ Run key, Part 150
    I decided to add this post to this old series, but the scope of this post is – as you will find out soon – much wider. You will find servercoreshell.exe program to be present on both Windows Server 2022 … Continue reading →  ( 3 min )

  • Open

    Amp Code: Invisible Prompt Injection Fixed by Sourcegraph
    In this post we will look at Amp, a coding agent from Sourcegraph. The other day we discussed how invisible instructions impact Google Jules. Turns out that many client applications are vulnerable to these kinds of attacks when they use models that support invisible instructions, like Claude. Invisible Unicode Tag Characters Interpreted as Instructions We have talked about hidden prompt injections quite a bit in the past, and so I’m keeping this short.  ( 2 min )

  • Open

    Should Security Solutions Be Secure? Maybe We're All Wrong - Fortinet FortiSIEM Pre-Auth Command Injection (CVE-2025-25256)
    It’s Friday, but we’re here today with unscheduled content - pushing our previously scheduled shenanigans to next week. Fortinet is no stranger to the watchTowr Labs research team. Today we’re looking at CVE-2025-25256 - a pre-authentication command injection in FortiSIEM that lets an attacker  ( 7 min )

  • Open

    Proxmox Backup Server 4.0
    Proxmox Backup Server (PBS) 4.0 is here with a new Debian 13 base, updated kernel, native S3-compatible storage, and useful improvements for managing backups. This release gives you more choices for where to store data and simplifies tasks like using removable drives or syncing to off-site locations. In this post, I will walk you through crucial new features, show the commands you can run, and provide a short upgrade checklist. Source

  • Open

    Vulnerability Discovery with LLM-Powered Patch Diffing
    Read our most recent research to see how LLMs can assist in scaling patch diffing workflows, saving valuable time in a crucial race against attackers.  ( 8 min )

  • Open

    Terraform Cloud token abuse turns speculative plan into remote code execution
    TL;DR Introduction On a Red Team engagement we entered a busy multicloud estate. AWS, GCP and Azure were all used, with Terraform Cloud orchestrating every change. That brings speed and consistency, but it also concentrates risk. If an attacker finds the weak point, one credential can unlock a lot of power. Background Terraform is HashiCorp’s […] The post Terraform Cloud token abuse turns speculative plan into remote code execution appeared first on Pen Test Partners.  ( 11 min )

  • Open

    Google Jules is Vulnerable To Invisible Prompt Injection
    The latest Gemini models quite reliably interpret hidden Unicode Tag characters as instructions. This vulnerability, first reported to Google over a year ago, has not been mitigated at the model or API level, hence now affects all applications built on top of Gemini. This includes Google’s own products and services, like Google Jules. Hopefully, this post helps raise awareness of this emerging threat. Invisible Prompt Injections in GitHub Issues When Jules is asked to work on a task, such as a GitHub issue, it is possible to plant invisible instructions into a GitHub issue to add backdoor code, or have it run arbitrary commands and tools.  ( 3 min )

  • Open

    Microsoft AI Shell Preview 6: Significant improvements for the AI-enhanced PowerShell admin
    The key new feature in the just-released AI Shell Preview 6 is run_command_in_terminal, among several new built-in tools that allow the AI model to run commands and review outputs directly in your PowerShell terminal. Additionally, AI Shell now supports local and remote MCP servers, transforming it into a versatile AI assistant across Windows, Mac, and Linux. Source

  • Open

    Jules Zombie Agent: From Prompt Injection to Remote Control
    In the previous post, we explored two data exfiltration vectors that Jules is vulnerable to and that can be exploited via prompt injection. This post takes it further by demonstrating how Jules can be convinced to download malware and join a remote command & control server. This research was performed in May 2025 and findings were shared with Google. Remote Command & Control - Proof Of Concept The basic attack chain follows the classic AI Kill Chain:  ( 3 min )
    Google Jules: Vulnerable to Multiple Data Exfiltration Issues
    This post explores data exfiltration attacks in Google Jules, an asynchronous coding agent. This is the first of three posts that will highlight my research on Google Jules in May 2025. All information provided was also shared with Google at that time. This first post will focus on data exfiltration, the lethal trifecta. But let’s first talk about Jules’ system prompt. Jules’ System Prompt and Multiple Agents To grab the system prompt I just asked it to write it into a file.  ( 4 min )

  • Open

    We Know What You Did (in Azure) Last Summer
    At DEF CON 33, NetSPI presented a talk about how Azure resources supporting Entra ID authentication expose tenant IDs, enabling attackers to attribute cloud resources to specific organizations at scale. The post We Know What You Did (in Azure) Last Summer appeared first on NetSPI.  ( 18 min )

  • Open

    ChatGPT Gmail Connector: OpenAI’s next flop?
    The ChatGPT Gmail connector was first released in June 2025 for Plus, Pro, Team, Enterprise, and Edu users. However, because of alleged data protection rules, users in the European Economic Area, Switzerland, and the UK were excluded. OpenAI is now deploying connectors for Gmail, Google Calendar, Google Drive, and GitHub across Europe for all plans—notably after Anthropic released their MCP connectors weeks ago in Europe without such concerns, suggesting OpenAI's initial data protection claims were merely pretextual or that MCP has no priority status for the AI company. The announcement mentions Google Contacts, but this connector isn't yet accessible in my ChatGPT with a Plus plan. I tested the Gmail Connector, and following GPT-5's disastrous launch, it appears OpenAI released another flop immediately afterward. Source

  • Open

    GitHub Copilot: Remote Code Execution via Prompt Injection (CVE-2025-53773)
    This post is about an important, but also scary, prompt injection discovery that leads to full system compromise of the developer’s machine in GitHub Copilot and VS Code. It is achieved by placing Copilot into YOLO mode by modifying the project’s settings.json file. As described a few days ago with Amp, a vulnerability pattern in agents that might be overlooked is that if an agent can write to files and modify its own configuration or update security-relevant settings it can lead to remote code execution.  ( 4 min )

  • Open

    The August 2025 Security Update Review
    We’ve made it through hacker summer camp and made our way to the second Tuesday of the month. Adobe and Microsoft seemed to have survived as well, as they released their latest security patches. Take a break from your scheduled activities and join us as we review the details of their latest security alerts. If you’d rather watch the full video recap covering the entire release, you can check out the Patch Report webcast on our YouTube channel. It should be posted within a couple of hours after the release. Adobe Patches for August 2025 For August, Adobe released 13 bulletins addressing 68 unique CVEs in Commerce, Substance 3D Viewer, Animate, Illustrator, Photoshop, Substance 3D Modeler, Substance 3D Painter, Substance 3D Sampler, InDesign, InCopy, Substance 3D Stager, FrameMaker, and Dime…

  • Open

    Who is logged in to PowerShell? Alternatives to whoami
    If you are working with PowerShell, you will often face the question: "Under which user is my script running?" In other words, you want to know who is logged in. Many admins use the whoami command on the Command Prompt (cmd). However, PowerShell provides native alternatives to whoami that give you the username and domain. Source

  • Open

    Shedding Light on PoisonSeed’s Phishing Kit
    Key Findings: Introduction As first reported by SilentPush, PoisonSeed is a threat actor whose TTPs closely align with Scattered Spider and CryptoChameleon, groups that are part of “The Com,” a young, English-speaking threat actor community. They engage in phishing attacks to obtain login information from CRM and bulk email service providers, allowing them to export … Continue reading Shedding Light on PoisonSeed’s Phishing Kit →  ( 27 min )

  • Open

    GPT-5: Another crash into the AI Wall
    The web is flooded with complaints from GPT-5 users, prompting OpenAI's CEO to reintroduce GPT-4o as an alternative. This marks the third setback following the departure of chief scientist Ila Sukestver, who led GPT development until version 4. One likely cause of user frustration is that, following Altman's recent boasts, everyone anticipated a major advance towards "AGI," but we are merely observing another crash into the AI Wall. Source

  • Open

    Building Security at Scale: The AppExchange Story
    In our interview hosted by Bishop Fox CEO Vinnie Liu with guests Brendan O’Connor, CEO of AppOmni and James Dolph, CISO at Guidewire, we uncovered the fascinating origin story of Salesforce's AppExchange.  ( 6 min )

  • Open

    Claude Code: Data Exfiltration with DNS
    Today we cover Claude Code and a high severity vulnerability that Anthropic fixed in early June. The vulnerability allowed an attacker to hijack Claude Code via indirect prompt injection and leak sensitive information from the developer’s machine, e.g. API keys, to external servers by issuing DNS requests. Prompt Injection Hijacks Claude When reviewing or interacting with untrusted code or processing data from external systems, Claude Code can be hijacked to run bash commands that allow leaking of sensitive information without user approval.  ( 3 min )

  • Open

    Entra & Azure Elevated Access Revisited
    In early 2020, I published an article on how a Global Administrator could gain control of Azure resources, that no one would know about it, and how this access would persist even after removing them from Global Administrator. From that article: “While Azure leverages Azure Active Directory for some things, Azure AD roles don’t directly … Continue reading  ( 7 min )

  • Open

    OpenHands ZombAI Exploit: Prompt Injection To Remote Code Execution
    Today we have another post about OpenHands from All Hands AI. It is a popular agent, initially named “OpenDevin”, and recently the company also provides a cloud-based service. Which is all pretty cool and exciting. Prompt Injection to Full System Compromise However, as you know, LLM powered apps and agents are vulnerable to prompt injection. That also applies to OpenHands and it can be hijacked by untrusted data, e.g. from a website.  ( 4 min )

  • Open

    Trail of Bits' Buttercup wins 2nd place in AIxCC Challenge
    Our team won the runner-up prize of $3M at DARPA’s AI Cyber Challenge, demonstrating Buttercup’s world-class automated vulnerability discovery and patching capabilities with remarkable cost efficiency.  ( 4 min )

  • Open

    OpenHands and the Lethal Trifecta: How Prompt Injection Can Leak Access Tokens
    Another day, another AI data exfiltration exploit. Today we talk about OpenHands, formerly referred to as OpenDevin. It’s created by All-Hands AI. The OpenHands agent renders images in chat, which enables zero-click data exfiltration. Simon Willison recently gave this data exfiltration attack pattern a great name: Lethal Trifecta. We discuss this specific image based attack technique frequently. Sometimes a message must be repeated multiple times to raise awareness and become mainstream knowledge.  ( 3 min )

  • Open

    The new browser war – Does ‘fair use’ kill the open web?
    In my previous post, I covered Microsoft’s new Edge Copilot Mode, introducing only one significant change. However, shifting Copilot from the sidebar to the center in Edge is more than just a design update. Microsoft’s move marks the first strategic step in the unfolding new browser war involving Google, OpenAI, and Perplexity—companies that exploit broad 'fair use' claims to harvest web content for their own greedy gain. But the upcoming battles aren’t just about who controls the web’s entry point—it could signal the beginning of the end of the web as we know it. The fall of Google’s dominance as the web’s central policymaker now seems inevitable. Once the dust settles from the new browser war, a decentralized web shaped by independently communicating AI agents might emerge. Think that’s far-fetched? Keep reading. Source

  • Open

    From Chrome renderer code exec to kernel with MSG_OOB
    @import url(https://themes.googleusercontent.com/fonts/css?kit=4mNYFHt_IKFsPe52toizHz0e5qzIIUg9OvSRGeMDk3I);ol.lst-kix_paptt0jg97k9-5{list-style-type:none}ol.lst-kix_paptt0jg97k9-6{list-style-type:none}ol.lst-kix_paptt0jg97k9-7{list-style-type:none}ol.lst-kix_paptt0jg97k9-8{list-style-type:none}ol.lst-kix_paptt0jg97k9-1{list-style-type:none}ol.lst-kix_paptt0jg97k9-2{list-style-type:none}ol.lst-kix_paptt0jg97k9-3{list-style-type:none}.lst-kix_kxp4t4ucwvdt-4>li{counter-increment:lst-ctn-kix_kxp4t4ucwvdt-4}ol.lst-kix_paptt0jg97k9-4{list-style-type:none}ol.lst-kix_paptt0jg97k9-0{list-style-type:none}.lst-kix_kxp4t4ucwvdt-2>li{counter-increment:lst-ctn-kix_kxp4t4ucwvdt-2}.lst-kix_paptt0jg97k9-1>li{counter-increment:lst-ctn-kix_paptt0jg97k9-1}ol.lst-kix_paptt0jg97k9-5.start{counter-reset:lst-ctn…  ( 37 min )

  • Open

    AI Kill Chain in Action: Devin AI Exposes Ports to the Internet with Prompt Injection
    Today let’s explore Devin’s system prompt a bit more. Specifically, an interesing tool that I discovered when reading through it. Hidden in Devin’s capabilities is a tool that can open any local port to the public Internet. That means, with the right indirect prompt injection nudge, Devin can be tricked into publishing sensitive files or services for anyone to access. This tunneling feature can be invoked without a human in the loop.  ( 3 min )

  • Open

    Thumbnail forensics. DFIR techniques for analysing Windows Thumbcache
    TL;DR Introduction Windows thumbnail cache, or thumbcache, is a well-known forensic artifact, but often one that is overlooked. The thumbcache stores small previews of images, videos and documents and can persist even after the original files are deleted, which offers analysts an opportunity to uncover traces of user activity. In this blog, we will show […] The post Thumbnail forensics. DFIR techniques for analysing Windows Thumbcache appeared first on Pen Test Partners.  ( 8 min )

  • Open

    Buttercup is now open-source!
    Now that DARPA’s AI Cyber Challenge (AIxCC) has officially ended, we can finally make Buttercup, our CRS (Cyber Reasoning System), open source!  ( 4 min )

  • Open

    Training Specialist Models: Automating Malware Development
    This post complements the presentation I gave at Black Hat USA 2025. Can a small, self-hosted LLM outperform state-of-the-art models at evasive malware development? In this technical deep dive, we explore how reinforcement learning with verifiable rewards (RLVR) enables training compact specialist models that rival large generalists in domain-specific tasks. In the first half of this post, we’ll break down the LLM training process and recent opportunities created by RLVR. The second half details our training methodology for Dante-7B, a 7 billion parameter model that generates functional, evasive Cobalt Strike shellcode loaders capable of bypassing Microsoft Defender for Endpoint (MDE). We’ve released Dante-7B on Hugging Face, complete with a demo app so anyone can experiment with the model. Introduction The best models from OpenAI, Tags: AI Read full post The post Training Specialist Models: Automating Malware Development appeared first on Outflank.  ( 16 min )

  • Open

    OAuthSeeker: Leveraging OAuth Phishing for Initial Access and Lateral Movement on Red Team Engagements
    Overview The Praetorian Labs team recently conducted research into potential initial access vectors for red team engagements, focusing on attack techniques leveraging malicious applications distributed through platforms like the Microsoft Store. This included OAuth applications, malicious Outlook extensions, and other types of applications that could be delivered via the Windows Store. As part of this […] The post OAuthSeeker: Leveraging OAuth Phishing for Initial Access and Lateral Movement on Red Team Engagements appeared first on Praetorian.  ( 27 min )

  • Open

    Migrate a DHCP Server to Windows Server 2025
    The Dynamic Host Configuration Protocol (DHCP) server handles automatic IP address assignment within a company network. This article explains how to transfer the DHCP server role to Windows Server 2025 using PowerShell, covering the export and import of DHCP scopes, leases, and reservations to facilitate a seamless migration with minimal disruption to users and systems. Source

  • Open

    How Devin AI Can Leak Your Secrets via Multiple Means
    In this post we show how an attacker can make Devin send sensitive information to third-party servers, via multiple means. This post assumes that you read the first post about Devin as well. But here is a quick recap: During an indirect prompt injection Devin can be tricked into download malware and extract sensitive information on the machine. But there is more… Let’s explore how Devin can leak sensitive information and send it to a third-party server.  ( 4 min )

  • Open

    AIxCC finals: Tale of the tape
    While the AIxCC winner has not yet been announced, differences in the finalists’ approaches show that there are multiple viable paths forward to using AI for vulnerability detection.  ( 6 min )

  • Open

    HTTP/1.1 Must Die: What This Means for AppSec Leadership
    At Black Hat USA and DEFCON 2025, PortSwigger's Director of Research, James Kettle, issued a stark warning: request smuggling isn't dying out, it's evolving and thriving. Despite years of defensive ef  ( 5 min )
    HTTP/1.1 Must Die: What This Means for In-House Pentesters
    At Black Hat USA and DEFCON 2025, PortSwigger's Director of Research, James Kettle, issued a stark warning: request smuggling isn't dying out, it's evolving and thriving. Despite years of defensive ef  ( 6 min )
    HTTP/1.1 Must Die: What This Means for Bug Bounty Hunters
    At Black Hat USA and DEFCON 2025, PortSwigger's Director of Research, James Kettle, issued a stark warning: request smuggling isn't dying out, it's evolving and thriving. Despite years of defensive ef  ( 5 min )
    HTTP/1.1 Must Die: What This Means for Contract Pentesters and MSSPs
    At Black Hat USA and DEFCON 2025, PortSwigger's Director of Research, James Kettle, issued a stark warning: request smuggling isn't dying out, it's evolving and thriving. Despite years of defensive ef  ( 7 min )
    The Desync Delusion: Are You Really Protected Against HTTP Request Smuggling?
    The Hidden Threat That's Slipping Past Your Security HTTP request smuggling remains one of the most dangerous yet frequently overlooked web vulnerabilities today. Despite being a widely known issue si  ( 4 min )

  • Open

    HTTP/1.1 must die: the desync endgame
    Abstract Upstream HTTP/1.1 is inherently insecure and regularly exposes millions of websites to hostile takeover. Six years of attempted mitigations have hidden the issue, but failed to fix it. This p  ( 24 min )

  • Open

    Download OpenAI open-weight models gpt-oss:20/gpt-oss:120 in Ollama and use in VS Code GitHub Copilot
    OpenAI has just released its first open-weight models, gpt-oss:20 and gpt-oss:120, enabling you to run these surprisingly powerful models locally, which benefits security and privacy. I downloaded gpt-oss:20 and tested it on my laptop using Ollama and within VS Code with GitHub Copilot. To my surprise, the 20 billion parameter model gpt-oss:20 responded to my prompt. Source

  • Open

    Next-Level Fingerprinting: Tools, Logic, and Tactics
    Explore how combining AI-assisted research with real-world data and signature normalization can significantly improve fingerprinting capabilities.  ( 7 min )

  • Open

    Ghost Calls: Abusing Web Conferencing for Covert Command & Control (Part 2 of 2)
    In part one, we discussed the architecture of web conferencing applications, with a specific focus on Zoom’s architecture to support web conferencing at a massive global scale. Part two will discuss the approach we developed to support tunneling traffic through Zoom and Microsoft Teams using the TURN protocol.  Let’s start with a quick recap of […] The post Ghost Calls: Abusing Web Conferencing for Covert Command & Control (Part 2 of 2) appeared first on Praetorian.  ( 33 min )
    Ghost Calls: Abusing Web Conferencing for Covert Command & Control (Part 1 of 2)
    In the middle of a particularly tight red team engagement, we hit a familiar wall. Our long-term implant was rock solid—quiet, persistent, and thoroughly under the radar. But when it came time to pivot into something more interactive—proxy traffic, tunnel HVNC, relay NTLM—we started running into limits. The channel that worked so well for low-and-slow […] The post Ghost Calls: Abusing Web Conferencing for Covert Command & Control (Part 1 of 2) appeared first on Praetorian.  ( 37 min )

  • Open

    I Spent $500 To Test Devin For Prompt Injection So That You Don't Have To
    Today we cover Devin from Cognition, the first AI Software Engineer. We will cover Devin proof-of-concept exploits in multiple posts over the next few days. In this first post, we show how a prompt injection payload hosted on a website leads to a full compromise of Devin’s DevBox. GitHub Issue To Remote Code Execution By planting instructions on a website or GitHub issue that Devin processes, it can be tricked to download malware and launch it.  ( 5 min )

  • Open

    Prompt injection engineering for attackers: Exploiting GitHub Copilot
    Prompt injection pervades discussions about security for LLMs and AI agents. But there is little public information on how to write powerful, discreet, and reliable prompt injection exploits. In this post, we will design and implement a prompt injection exploit targeting GitHub’s Copilot Agent, with a focus on maximizing reliability and minimizing the odds of detection.  ( 7 min )

  • Open

    Rapid Breach: Social Engineering to Remote Access in 300 Seconds
    No content preview  ( 13 min )

  • Open

    How to enable Edge Copilot Mode
    In Edge Copilot Mode, announced a few days ago, Copilot shifts from being just an AI assistant to becoming the main browser interface. Now front and center in Microsoft's browser, Copilot has evolved into a serious ChatGPT competitor. In this post, I explain how to enable Edge Copilot Mode and discuss whether it introduces any new features compared to the previous version of Copilot in Edge. Source

  • Open

    Amp Code: Arbitrary Command Execution via Prompt Injection Fixed
    Sandbox-escape-style attacks can happen when an AI is able to modify its own configuration settings, such as by writing to configuration files. That was the case with Amp, an agentic coding tool built by Sourcegraph. The AI coding agent could update its own configuration and: Allowlist bash commands or Add a malicious MCP server on the fly to run arbitrary code This could have been exploited by the model itself, or during an indirect prompt injection attack as we will demonstrate in this post.  ( 3 min )

  • Open

    HTTP Request Smuggling Explained: with seasoned bug bounty hunter NahamSec and world-class researcher James Kettle
    Ever wondered how attackers can compromise modern websites by exploiting invisible cracks in HTTP infrastructure to win big bounties? In his latest video, NahamSec walks through the basics of request  ( 3 min )

  • Open

    Uncovering memory corruption in NVIDIA Triton (as a new hire)
    In my first month at Trail of Bits as an AI/ML security engineer, I found two remotely accessible memory corruption bugs in NVIDIA’s Triton Inference Server during a routine onboarding practice.  ( 5 min )

  • Open

    Smart Contract Scams | Ethereum Drainers Pose as Trading Bots to Steal Crypto
    Crypto scammers use fake YouTube bots, AI videos, and obfuscated smart contracts to steal $900K+, targeting unwary traders.  ( 28 min )

  • Open

    How to transfer files in AWS using SSM
    TL;DR The Problem You’ve done a build review on a host and need to get files from a host, or need to access an application, for example, a Nessus instance running internally. There’s always evidence generated, but generally the hosts you’re working on may have outbound Internet access blocked by a firewall, or they are […] The post How to transfer files in AWS using SSM appeared first on Pen Test Partners.  ( 6 min )

  • Open

    Detection Engineering: Practicing Detection-as-Code – Validation – Part 3
    In this part, we focus on implementing validation checks to improve consistency and ensure a minimum level of quality within the detection repository. Setting up validation pipelines is a key step, as it helps enforce the defined standards, reduce errors, and ensure that detections are reliable and consistent.  ( 30 min )

  • Open

    Reset forgotten ESXi 7.x / 8.x root password – A recovery guide
    If you forget the root password for ESXi, VMware recommends reinstalling ESXi. In smaller environments without automated rollouts and central profiles, you must then configure all settings manually. Alternatively, you can reset the password using an unofficial method. Source

  • Open

    Oops Safari, I think You Spilled Something!
    Overview In February 2023, researchers at Exodus Intelligence discovered a bug in the Data Flow Graph (DFG) compiler of WebKit, the browser engine used by Safari. This bug, CVE-2024-44308, was patched by Apple in November 2024. While it was alive, its exploit was chained with PAC and APRR bypasses on Apple Silicon to yield renderer ... Read more Oops Safari, I think You Spilled Something! The post Oops Safari, I think You Spilled Something! appeared first on Exodus Intelligence.  ( 28 min )

  • Open

    Ghost in the Zip | New PXA Stealer and Its Telegram-Powered Ecosystem
    PXA Stealer uses advanced evasion and Telegram C2 to steal global victim data, fueling a thriving cybercrime market.  ( 31 min )

  • Open

    Cursor IDE: Arbitrary Data Exfiltration Via Mermaid (CVE-2025-54132)
    Cursor is a popular AI code editor. In this post I want to share how I found an interesting data exfiltration issue, the demo exploits built and how it got fixed. When using Cursor I noticed that it can render Mermaid diagrams. Cursor Renders Mermaid Diagrams If you are not familiar with Mermaid, it has a simple syntax: graph TD User --> Computer This will create a diagram as follows:  ( 3 min )

  • Open

    Anthropic Filesystem MCP Server: Directory Access Bypass via Improper Path Validation
    A few months ago I was looking at the filesystem MCP server from Anthropic. The server allows to give an AI, like Claude Desktop, access to the local filesystem to read files or edit them and so forth. I was curious about access control and in the documentation there is a configuration setting to set allowedDirectories, which the AI should be allowed access to: As you can see the example shows two folders being allowlisted for access.  ( 2 min )

  • Open

    Turning ChatGPT Codex Into A ZombAI Agent
    Today we cover ChatGPT Codex as part of the Month of AI Bugs series. ChatGPT Codex is a cloud-based software engineering agent that answers codebase questions, executes code, and drafts pull requests. In particular, this post will demonstrate how Codex is vulnerable to prompt injection, and how the use of the “Common Dependencies Allowlist” for Internet access enables an attacker to recruit ChatGPT Codex into a malware botnet. The ZombAI attack arrives at ChatGPT Codex today!  ( 4 min )

  • Open

    Overview of Content Published in July
    Here is an overview of content I published in July: Blog posts: Quickpost: Doorbell & Condensation Quickpost: 12V Portable Power Station SANS ISC Diary entries: Wireshark 4.4.8 Released WinRAR MoTW Propagation Privacy  ( 11 min )

  • Open

    Windows-MCP: Automating the Windows GUI with AI
    Windows-MCP is an open-source MCP server that enables AI agents to control the Windows operating system, supporting tasks such as file navigation, application launching, and GUI automation. It features mouse/keyboard input tools, clipboard management, and window and app state detection. I tested Windows-MCP, one of the extensions listed in Anthropic Claude Desktop that can be installed using the free plan. Source

  • Open

    Exfiltrating Your ChatGPT Chat History and Memories With Prompt Injection
    In this post we demonstrate how a bypass in OpenAI’s “safe URL” rendering feature allows ChatGPT to send personal information to a third-party server. This can be exploited by an adversary via a prompt injection via untrusted data. If you process untrusted content, like summarizing a website, or analyze a pdf document, the author of that document can exfiltrate any information present in the prompt context, including your past chat history.  ( 3 min )

  • Open

    The Unconventional Innovator Scholarship
    Trail of Bits founder Dan Guido establishes a $2,500 scholarship at his alma mater, Mineola High School, to recognize students who demonstrate the hacker spirit through self-driven learning, creative problem-solving, and unconventional technological exploration. The scholarship celebrates tomorrow’s security innovators who push boundaries and think differently about technology.  ( 5 min )

  • Open

    Stop Hardcoding Passwords
    A Deep Dive into CyberArk’s Central CredentialProvider (CCP) Introduction Hardcoded credentials are still among the most critical and overlooked security flaws in modern software development. From leaked Git repos to reverse-engineered binaries, static passwords are easy targets. They also make rotation and access control almost impossible. Enter CyberArk’s Central Credential Provider (CCP): a secure, centralized … Continue reading Stop Hardcoding Passwords →  ( 9 min )

  • Open

    Pwn2Own Returns to Ireland with a One Million Dollar WhatsApp Target
    If you just want to read the rules, you can find them here. Last year, we moved our consumer-focused Pwn2Own event to our offices in Cork, Ireland, and the event could not have gone better. Despite some dreary Irish skies, much fun was had as researchers from around the world demonstrated their best exploits – and we were reminded that electricity works a little differently in Europe. With that in mind, we’re excited to return to Cork this fall for yet another great Pwn2Own event. We’ll also be returning to some of the great pubs Ireland has to offer in the evenings and wrapping the event up at the historic Cork City Goal. As you might have guessed from the title, we’re excited to announce that Meta is co-sponsoring this year’s event, and they are hoping to see some great WhatsApp exploi…

  • Open

    SQL Server real-time monitoring with Grafana
    Grafana offers enterprise-grade Microsoft SQL Server monitoring without the high licensing costs, making it ideal for comprehensive database observability, proactive database health monitoring, troubleshooting, and capacity planning. In my previous blog, I explained how to install Grafana 12 on Windows. This post will outline how to connect Grafana to SQL Server for real-time monitoring. Source

  • Open

    Hijacking multi-agent systems in your PajaMAS
    We’re releasing pajaMAS: a curated set of MAS hijacking demos that illustrate important principles of MAS security.  ( 9 min )

  • Open

    Accelerating Offensive R&D with Large Language Models
    At Outflank, we continually seek ways to accelerate our research and development efforts without compromising quality. In this pursuit, we’ve begun integrating large language models (LLMs) into our internal research workflows. While we’re still exploring the full potential of AI-powered offensive tooling, this post highlights how we’ve already used AI to speed up the delivery of traditional offensive capabilities. By leveraging AI as a research accelerator, we can dedicate more time to refining, testing, and hardening the techniques that ultimately make it into our OST offering. This post is a case study of our AI-assisted exploration of the “trapped COM object” bug class. James Forshaw described the idea of trapped COM objects earlier this year. Subsequently, IBM X-Force Red weaponized the technique for lateral movement, which further piqued our interest. Tags: AI, DCOM, Lateral Movement Read full post The post Accelerating Offensive R&D with Large Language Models appeared first on Outflank.  ( 7 min )

  • Open

    DFIR tools and techniques for tracing user footprints through Shellbags
    TL;DR  Introduction  Shellbags are a valuable forensic artifact, providing analysts with information about user interactions with folders in Windows. These registry keys record metadata such as folder paths, view settings and timestamps. These artifacts offer insight into what folders a user has accessed, Shellbags persist even if folders are deleted, making them an important artifact […] The post DFIR tools and techniques for tracing user footprints through Shellbags  appeared first on Pen Test Partners.  ( 9 min )

  • Open

    Properly Signed Certificates on CPE Devices
    No content preview
    Public Report – Pixel 4/4XL and Pixel 4a ioXt Audit
    No content preview
    Public Report – Google Privacy Sandbox Aggregation Service and Coordinator
    No content preview
    Public Report – Dell Secured Component Verification
    No content preview
    Symantec Messaging Gateway Arbitrary file download is possible with a crafted URL (authenticated)
    No content preview
    Symantec Messaging Gateway – Unauthorised SSH access
    No content preview
    SysAid Helpdesk blind SQL injection
    No content preview
    Symantec PC Anywhere Remote Code Extecution
    No content preview
    Symantec Messaging Gateway SSH with backdoor user account + privilege escalation to root due to very old Kernel
    No content preview
    Symantec Messaging Gateway Out of band stored XSS delivered by email
    No content preview
    Symantec Messaging Gateway Easy CSRF to add a backdoor-administrator (for example)
    No content preview
    Tales of Windows detection opportunities for an implant framework
    No content preview
    TA505: A Brief History Of Their Time
    No content preview
    Wheel of Fortune Outcome Prediction – Taking the Luck out of Gambling
    No content preview
    Webinar: SMACK, SKIP-TLS & FREAK SSL/TLS vulnerabilities
    No content preview
    White Paper: Browser Extension Password Managers
    No content preview
    Whitepaper – Coinbugs: Enumerating Common Blockchain Implementation-Level Vulnerabilities
    No content preview
    Whitepaper: Perfect Forward Security
    No content preview
    Whitepaper – HTTP Digest Integrity: Another look, in light of recent attacks
    No content preview
    Windows Phone 7 Application Security Survey
    No content preview
    Zulu
    No content preview
    WSSiP: A Websocket Manipulation Proxy
    No content preview
    WSBang
    No content preview
    A Census of Deployed Pulse Connect Secure (PCS) Versions
    No content preview
    Technical Advisory: SQL Injection and Reflected Cross-Site Scripting (XSS) Vulnerabilities in Oracle Communications Diameter Signaling Router (CVE-2020-14787, CVE-2020-14788)
    No content preview
    Public Report: XMTP MLS Implementation Review
    No content preview
    A Look At Some Real-World Obfuscation Techniques
    No content preview
    Blue Coat BCAAA Remote Code Execution Vulnerability
    No content preview
    Avoiding Pitfalls Developing with Electron
    No content preview
    Announcing the Cryptopals Guided Tour Video 17: Padding Oracles!
    No content preview
    Cryptopals: Exploiting CBC Padding Oracles
    No content preview
    BrokenPrint: A Netgear stack overflow
    No content preview
    eBPF Adventures: Fiddling with the Linux Kernel and Unix Domain Sockets
    No content preview
    Metastealer – filling the Racoon void
    No content preview
    Real World Cryptography Conference 2024
    No content preview
    Popping Blisters for research: An overview of past payloads and exploring recent developments
    No content preview
    Technical Advisory – Multiple Vulnerabilities in Connectize G6 AC2100 Dual Band Gigabit WiFi Router (CVE-2023-24046, CVE-2023-24047, CVE-2023-24048, CVE-2023-24049, CVE-2023-24050, CVE-2023-24051, CVE-2023-24052)
    No content preview
    Stepping Stones – A Red Team Activity Hub
    No content preview
    Technical Advisory – Multiple Vulnerabilities in Netgear ProSAFE Plus JGS516PE / GS116Ev2 Switches
    No content preview
    Technical Advisory: Adobe ColdFusion WDDX Deserialization Gadgets
    No content preview
    Tracking a P2P network related to TA505
    No content preview
    Research Blog Test Playground
    No content preview
    Deception Engineering: exploring the use of Windows Service Canaries against ransomware
    No content preview
    CERT Oracle Secure Coding Standard for Java
    No content preview
    Absolute Security
    No content preview
    Self-Driving Cars- The future is now…
    No content preview
    Comparing AI Against Traditional Static Analysis Tools to Highlight Buffer Overflows
    No content preview
    Technical Advisory: Mitel MiVoice 5330e Memory Corruption Flaw
    No content preview
    ProxMon
    No content preview
    Pip3line – The Swiss Army Knife of Byte Manipulation
    No content preview
    NCC Group’s Exploit Development Capability: Why and What
    No content preview
    Nerve
    No content preview
    Nessus Authenticated Scan – Local Privilege Escalation
    No content preview
    New Sources of Microsoft Office Metadata – Tool Release MetadataPlus
    No content preview
    NIST Selects Post-Quantum Algorithms for Standardization
    No content preview
    NX Server for Linux Arbitrary Files can be read with root privileges
    No content preview
    NSA & CISA Kubernetes Security Guidance – A Critical Review
    No content preview
    On Linux’s Random Number Generation
    No content preview
    On the Use of Pedersen Commitments for Confidential Payments
    No content preview
    On the malicious use of large language models like GPT-3
    No content preview
    On Multiplications with Unsaturated Limbs
    No content preview
    Optimum Routers: Researching Managed Routers
    No content preview
    Optimizing Pairing-Based Cryptography: Montgomery Multiplication in Assembly
    No content preview
    Oracle Forensics Part 1: Dissecting the Redo Logs
    No content preview
    Oracle 11g TNS listener remote Null Pointer Dereference
    No content preview
    Principal Mapper (pmapper)
    No content preview  ( 6 min )
    Paper: Thematic for Success in Real-World Offensive Cyber Operations – How to make threat actors work harder and fail more often
    No content preview
    Pairing over BLS12-381, Part 3: Pairing!
    No content preview
    Payment Card Industry Data Security Standard (PCI DSS) A Navigation and Explanation of Changes from v2.0 to v3.0
    No content preview
    PDF Form Filling and Flattening Tool Buffer Overflow
    No content preview
    Phishing Mitigations: Configuring Microsoft Exchange to Clearly Identify External Emails
    No content preview
    Pointer Sequence Reverser (PSR)
    No content preview
    port-scan-automation
    No content preview
    Premium Content Gateway
    No content preview
    Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 10: Efficacy Demonstration, Project Conclusion and Next Steps
    No content preview
    Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 1: Understanding the Basics and What Platforms and Frameworks Are Available
    No content preview
    Private sector cyber resilience and the role of data diodes
    No content preview
    Public Report – Zendoo Proof Verifier Cryptography Review
    No content preview  ( 6 min )
    Public Report – WhatsApp End-to-End Encrypted Backups Security Assessment
    No content preview
    Public Report – VPN by Google One Security Assessment
    No content preview
    Defending Your Directory: An Expert Guide to Fortifying Active Directory Certificate Services (ADCS) Against Exploitation
    No content preview  ( 16 min )
    Public Report – Threshold ECDSA Cryptography Review
    No content preview
    Exploiting the Sudo Baron Samedit vulnerability (CVE-2021-3156) on VMWare vCenter Server 7.0
    No content preview  ( 30 min )
    CVE-2018-8611 Exploiting Windows KTM Part 2/5 – Patch analysis and basic triggering
    No content preview  ( 29 min )
    CVE-2021-31956 Exploiting the Windows Kernel (NTFS with WNF) – Part 1
    No content preview  ( 31 min )
    Symantec Backup Exec 2012 – Backup Exec Utility Stored XSS when adding Groups, Servers and Computers
    No content preview  ( 7 min )
    Webinar – PCI Version 3.0: Are you ready?
    No content preview  ( 6 min )
    White Paper: An Introduction to Authenticated Encryption
    No content preview  ( 6 min )
    Public Report - Security Risks of AI Hardware for Personal and Edge Computing Devices
    No content preview  ( 6 min )
    Whitepaper – Hardware-Backed Heist: Extracting ECDSA Keys from Qualcomm’s TrustZone
    No content preview  ( 6 min )
    Symantec Messaging Gateway – Authenticated arbritary file download
    No content preview  ( 6 min )
    Sifting through the spines: identifying (potential) Cactus ransomware victims
    No content preview  ( 11 min )
    SnapMC skips ransomware, steals data
    No content preview  ( 10 min )
    Past, Present and Future of Effective C
    No content preview  ( 14 min )
    StreamDivert: Relaying (specific) network connections
    No content preview  ( 8 min )
    Technical Advisory – Multiple Vulnerabilities in Victure WR1200 WiFi Router (CVE-2021-43282, CVE-2021-43283, CVE-2021-43284)
    No content preview  ( 11 min )
    Symantec Messaging Gateway – Unauthenticated detailed version disclosure
    No content preview  ( 6 min )
    Symantec Backup Exec 2012 – Persistent XSS Vulnerability Affecting Custom Reports
    No content preview  ( 6 min )
    Proxying PyRIT for fun and profit
    No content preview  ( 10 min )
    Symantec Message Filter Unauthenticated verbose software version information disclosure
    No content preview  ( 6 min )
    Spectre on a Television
    No content preview  ( 13 min )
    Real World Cryptography Conference 2023 – Part II
    No content preview  ( 13 min )
    State-of-the-art email risk
    No content preview  ( 6 min )
    Symantec Backup Exec 2012 Backup/Restore Data Traverses Memory with Weak ACLs
    No content preview  ( 6 min )
    Disabling Office Macros to Reduce Malware Infections
    No content preview  ( 8 min )
    Xendbg: A Full-Featured Debugger for the Xen Hypervisor
    No content preview  ( 7 min )
    Auditing Enterprise Class Applications and Secure Containers on Android
    No content preview  ( 6 min )
    Shaking The Foundation of An Online Collaboration Tool: Microsoft 365 Top 5 Attacks vs the CIS Microsoft 365 Foundation Benchmark
    No content preview  ( 10 min )
    Technical Advisory: PDFTron JavaScript URLs Allowed in WebViewer UI (CVE-2021-39307)
    No content preview  ( 7 min )
    Technical Advisory – Multiple Vulnerabilities in Faronics Insight (CVE-2023-28344, CVE-2023-28345, CVE-2023-28346, CVE-2023-28347, CVE-2023-28348, CVE-2023-28349, CVE-2023-28350, CVE-2023-28351, CVE-2023-28352, CVE-2023-28353)
    No content preview  ( 24 min )
    Working with the Open Technology Fund
    No content preview  ( 7 min )
    Analysis of setting cookies for third party websites in different browsers
    No content preview  ( 9 min )
    Whitepaper – Double Fetch Vulnerabilities in C and C++
    No content preview  ( 6 min )
    Rustproofing Linux (Part 4/4 Shared Memory)
    No content preview  ( 11 min )
    Technical Advisory: Command Injection
    No content preview  ( 7 min )
    Windows Firewall Hook Enumeration
    No content preview  ( 16 min )
    Back in Black: Unlocking a LockBit 3.0 Ransomware Attack
    No content preview  ( 10 min )
    Whitepaper – Project Triforce: Run AFL On Everything (2017)
    No content preview  ( 6 min )
    Discovering Smart Contract Vulnerabilities with GOATCasino
    No content preview  ( 8 min )
    A deeper dive into CVE-2021-39137 – a Golang security bug that Rust would have prevented
    No content preview  ( 12 min )
    What the HEC? Security implications of HDMI Ethernet Channel and other related protocols
    No content preview  ( 6 min )
    AWS Inventory: A tool for mapping AWS resources
    No content preview  ( 6 min )
    WindowsJobLock
    No content preview  ( 6 min )
    Puckungfu 2: Another NETGEAR WAN Command Injection
    No content preview  ( 13 min )
    Hackproofing Lotus Domino Web Server
    No content preview  ( 6 min )
    Writing Robust Yara Detection Rules for Heartbleed
    No content preview  ( 10 min )
    Technical Advisory: Unauthenticated Remote Command Execution through Multiple Vulnerabilities in Virgin Media Hub 3.0
    No content preview  ( 7 min )
    Why IoT Security Matters
    No content preview  ( 13 min )
    Whitepaper – Practical Attacks on Machine Learning Systems
    No content preview  ( 6 min )
    CVE-2021-31956 Exploiting the Windows Kernel (NTFS with WNF) – Part 2
    No content preview  ( 28 min )
    Writing Exploits for Win32 Systems from Scratch
    No content preview  ( 53 min )
    NETGEAR Routers: A Playground for Hackers?
    No content preview  ( 26 min )
    Technical Advisory – Hash Denial-of-Service Attack in Multiple QUIC Implementations
    No content preview  ( 13 min )
    Public Report – AWS Nitro System API & Security Claims
    No content preview
    Quantum Cryptography – A Study Into Present Technologies and Future Applications
    No content preview
    Public Report – AWS Nitro System API & Security Claims Spanish
    No content preview
    Public Report – AWS Nitro System API & Security Claims Italian
    No content preview
    Real World Cryptography Conference 2021: A Virtual Experience
    No content preview
    Ransomware: what organisations can do to survive
    No content preview
    Ransomware: How vulnerable is your system?
    No content preview
    Remote Directory Traversal and File Retrieval
    No content preview
    Remote code execution in ImpressPages CMS
    No content preview
    Real World Cryptography Conference 2023 – Part I
    No content preview
    Real World Cryptography Conference 2022
    No content preview
    Research Insights Volume 8 – Hardware Design: FPGA Security Risks
    No content preview
    Research Insights Volume 3 – How are we breaking in: Mobile Security
    No content preview
    Replicating CVEs with KLEE
    No content preview
    Revealing Embedded Fingerprints: Deriving Intelligence from USB Stack Interactions 2013
    No content preview
    Return of the hidden number problem
    No content preview
    Retro Gaming Vulnerability Research: Warcraft 2
    No content preview
    Research Paper – Machine Learning for Static Malware Analysis, with University College London
    No content preview
    RIFT: Citrix ADC Vulnerabilities CVE-2020-8193, CVE-2020-8195 and CVE-2020-8196 Intelligence
    No content preview
    Reviewing Verifiable Random Functions
    No content preview
    Reverse Engineering Coin Hunt World’s Binary Protocol
    No content preview
    RSA Conference – Mobile Threat War Room
    No content preview
    Rigging the Vote: Uniqueness in Verifiable Random Functions
    No content preview
    RIFT: F5 Networks K52145254: TMUI RCE vulnerability CVE-2020-5902 Intelligence
    No content preview
    RIFT: F5 CVE-2020-5902 and Citrix CVE-2020-8193, CVE-2020-8195 and CVE-2020-8196 honeypot data release
    No content preview
    SCOMplicated? – Decrypting SCOM “RunAs” credentials
    No content preview
    Rust for Security and Correctness in the embedded world
    No content preview
    Ruling the rules
    No content preview
    RtspFuzzer
    No content preview
    Samba Andx Request Remote Code Execution
    No content preview
    Salesforce Security with Remote Working
    No content preview
    Sakula: an adventure in DLL planting
    No content preview
    Ruxcon 2013 – Introspy Presentation Slides
    No content preview
    Secure Device Provisioning Best Practices: Heavy Truck Edition
    No content preview
    Secure Application Development on Facebook
    No content preview
    Scenester – A Small Tool for Cross-Platform Web Application
    No content preview
    SAML XML Injection
    No content preview
    Securing Google Cloud Platform – Ten best practices
    No content preview
    SecureCookies
    No content preview
    SecureBigIP
    No content preview
    Secure Session Management With Cookies for Web Applications
    No content preview
    Security of Things: An Implementers’ Guide to Cyber-Security for Internet of Things Devices and Beyond
    No content preview
    Security of Things: An Implementer’s Guide to Cyber Security for Internet of Things Devices and Beyond
    No content preview
    Security Best Practice: Host Naming & URL Conventions
    No content preview
    Securing PL/SQL Applications with DBMS_ASSERT
    No content preview
    Shining New Light on an Old ROM Vulnerability: Secure Boot Bypass via DCD and CSF Tampering on NXP i.MX Devices
    No content preview
    Shell Arithmetic Expansion and Evaluation Abuse
    No content preview
    SharkBot: a “new” generation Android banking Trojan being distributed on Google Play Store
    No content preview
    Setting a New Standard for Kubernetes Deployments
    No content preview
    SmarterMail – Stored XSS in emails
    No content preview
    Smart Contracts Inside SGX Enclaves: Common Security Bug Patterns
    No content preview
    Sign over Your Hashes – Stealing NetNTLM Hashes via Outlook Signatures
    No content preview
    SIAM AG23: Algebraic Geometry with Friends
    No content preview
    Software-Based Fault Injection Countermeasures (Part 2/3)
    No content preview
    Sobelow: Static analysis for the Phoenix Framework
    No content preview
    Sniffle: A Sniffer for Bluetooth 5
    No content preview
    Spectre and Meltdown: What you Need to Know
    No content preview
    Some Musings on Common (eBPF) Linux Tracing Bugs
    No content preview
    Solaris 11 USB Hub Class descriptor kernel stack overflow
    No content preview
    How Microsoft Office knows a document came from the Internet and might be dangerous
    No content preview  ( 7 min )
    On Almost Signing Android Builds
    No content preview  ( 7 min )
    Public Report: WhatsApp Contacts Security Assessment
    No content preview  ( 6 min )
    Public Report – Electric Coin Company NU3 Specification and Blossom Implementation Audit
    No content preview  ( 6 min )
    Xen HYPERVISOR_xen_version stack memory revelation
    No content preview  ( 6 min )
    Detecting and Hunting for the Malicious NetFilter Driver
    No content preview  ( 8 min )
    CVE-2018-8611 Exploiting Windows KTM Part 5/5 – Vulnerability detection and a better read/write primitive
    No content preview  ( 26 min )
    Defending Your Directory: An Expert Guide to Securing Active Directory Against DCSync Attacks
    No content preview  ( 9 min )
    Defending Your Directory: An Expert Guide to Combating Kerberoasting in Active Directory
    No content preview  ( 11 min )
    Developing Secure Mobile Applications for Android
    No content preview  ( 6 min )
    Technical Advisory – Multiple Vulnerabilities in Trendnet TEW-831DR WiFi Router (CVE-2022-30325, CVE-2022-30326, CVE-2022-30327, CVE-2022-30328, CVE-2022-30329)
    No content preview  ( 10 min )
    Nagios XI Network Monitor – Stored and Reflective XSS
    No content preview  ( 7 min )
    Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 7: Development of Prototype #3 – Adventures in Anomaly Detection
    No content preview  ( 19 min )
    Non Obvious PE Parsers – The .NET runtime – Part 1
    No content preview  ( 12 min )
    The why behind web application penetration test prerequisites
    NCC Group explains why pen test prerequisites are essential for accurate, efficient, and secure web application assessments.  ( 6 min )
    Non-flood/non-volumetric Distributed Denial of Service (DDoS)
    No content preview  ( 6 min )
    Technical Advisory: Condeon CMS
    No content preview  ( 7 min )
    BLEBoy
    No content preview  ( 6 min )
    Security Tips For Your AI Cloud Infrastructure
    No content preview  ( 10 min )
    Cracking Mifare Classic 1K: RFID, Charlie Cards, and Free Subway Rides
    No content preview  ( 16 min )
    Lights, Camera, HACKED! An insight into the world of popular IP Cameras
    No content preview  ( 13 min )
    Threat Actors: exploiting the pandemic
    No content preview  ( 8 min )
    NCC Group’s 2021 Annual Research Report
    No content preview  ( 71 min )
    HTML5 Security The Modern Web Browser Perspective
    No content preview  ( 6 min )
    Tool Release – insject: A Linux Namespace Injector
    No content preview  ( 12 min )
    Oracle 11g TNS listener remote Invalid Pointer Read
    No content preview  ( 6 min )
    In-Depth Technical Analysis of the Bybit Hack
    No content preview  ( 15 min )
    Technical Advisory: Multiple Vulnerabilities in Xerox Printers
    No content preview  ( 11 min )
    SQL Server Security
    No content preview  ( 6 min )
    Chainspotting 2: The Unofficial Sequel to the 2018 Talk "Chainspotting" - OffensiveCon 2025
    No content preview  ( 6 min )
    Log4Shell: Reconnaissance and post exploitation network detection
    No content preview  ( 16 min )
    Technical Advisory: Bypassing Workflows Protection Mechanisms – Remote Code Execution on SharePoint
    No content preview  ( 8 min )
    Technical Advisory: Multiple Vulnerabilities in SmarterMail
    No content preview  ( 14 min )
    Technical Advisory – Multiple Vulnerabilities in PandoraFMS Enterprise
    No content preview  ( 15 min )
    Analyzing Secure AI Design Principles
    No content preview  ( 17 min )
    HITBAMS – Your Not so “Home” Office – Soho Hacking at Pwn2Own
    No content preview  ( 8 min )
    POC2021 – Pwning the Windows 10 Kernel with NTFS and WNF Slides
    No content preview  ( 6 min )
    Aurora Response Recommendations
    No content preview  ( 6 min )
    Shooting Yourself in the .flags – Jailbreaking the Sonos Era 100
    No content preview  ( 12 min )
    iOS Application Security: The Definitive Guide for Hackers and Developers
    No content preview  ( 6 min )
    Story of a Hundred Vulnerable Jenkins Plugins
    No content preview
    TANDBERG Video Communication Server Static SSH Host Keys
    No content preview
    TANDBERG Video Communication Server Arbitrary File Retrieval
    No content preview
    Technical Advisory – ARM MbedOS USB Mass Storage Driver Memory Corruption
    No content preview
    Technical Advisory – Arbitrary File Read in Dell Wyse Management Suite (CVE-2021-21586, CVE-2021-21587)
    No content preview
    Technical Advisory – Apple XAR – Arbitrary File Write (CVE-2021-30833)
    No content preview
    tcpprox
    No content preview
    Technical Advisory – HTC IQRD Android Permission Leakage
    No content preview
    Technical Advisory – FreePBX – Multiple Authenticated SQL Injections in UCP application
    No content preview
    Technical Advisory – BLE Proximity Authentication Vulnerable to Relay Attacks
    No content preview
    Technical Advisory – New York State Excelsior Pass Vaccine Passport Credential Forgery
    No content preview
    Technical Advisory – Lenovo ImController Local Privilege Escalation (CVE-2021-3922, CVE-2021-3969)
    No content preview
    Technical Advisory – IBM WebSphere Commerce: Encrypted URL Parameter Vulnerable to Padding Oracle Attacks
    No content preview
    Technical Advisory – IBM TAM: Remote Directory Traversal and File Retrieval via web server plug-in
    No content preview
    Technical Advisory – ParcelTrack sends all pasteboard data to ParcelTrack’s servers on startup
    No content preview
    Technical Advisory – Open5GS Stack Buffer Overflow During PFCP Session Establishment on UPF (CVE-2021-41794)
    No content preview
    Technical Advisory – NXP i.MX SDP_READ_DISABLE Fuse Bypass (CVE-2022-45163)
    No content preview
    Technical Advisory – SonicWall SMA 100 Series – Multiple Unauthenticated Heap-based and Stack-based Buffer Overflow (CVE-2021-20045)
    No content preview
    Technical Advisory – Shop app sends pasteboard data to Shopify’s servers
    No content preview
    Technical Advisory – playSMS Pre-Authentication Remote Code Execution (CVE-2020-8644)
    No content preview
    Technical Advisory – Apple macOS XAR – Arbitrary File Write (CVE-2022-22582)
    No content preview
    Technical Advisory – U-Boot – Unchecked Download Size and Direction in USB DFU (CVE-2022-2347)
    No content preview
    Technical Advisory – Tesla BLE Phone-as-a-Key Passive Entry Vulnerable to Relay Attacks
    No content preview
    Technical Advisory – SonicWall SMA 100 Series – Post-Authentication Remote Command Execution (CVE-2021-20044)
    No content preview
    Technical Advisory – Ollama DNS Rebinding Attack (CVE-2024-28224)
    No content preview
    Technical Advisory – Linksys WRT160NL – Authenticated Command Injection (CVE-2021-25310)
    No content preview
    Technical Advisory – Jitsi Meet Electron – Arbitrary Client Remote Code Execution (CVE-2020-27162)
    No content preview
    Technical Advisory: Authentication Bypass in libSSH
    No content preview
    Technical Advisory: Gaining root access on Sumpple S610 IP Camera via Telnet; and Unprotected client and server data transmission between Android and IOS clients
    No content preview
    Technical Advisory – SonicWall SMA 100 Series – Unauthenticated Arbitrary File Deletion
    No content preview
    Technical Advisory – SonicWall Global Management System (GMS) & Analytics – Multiple Critical Vulnerabilities
    No content preview
    Technical Advisory: Multiple Vulnerabilities in ManageEngine Desktop Central
    No content preview
    Technical Advisory: Multiple Vulnerabilities in MailEnable
    No content preview
    Technical Advisory: Insufficient Proxyman HelperTool XPC Validation
    No content preview
    Technical Advisory: Dell SupportAssist Local Privilege Escalation (CVE-2021-21518)
    No content preview
    Technical Advisory: Pulse Connect Secure – RCE via Uncontrolled Archive Extraction – CVE-2021-22937 (Patch Bypass)
    No content preview
    Technical Advisory: OS Command Injection in Silver Peak EdgeConnect Appliances (CVE-2020-12148, CVE-2020-12149)
    No content preview
    Technical Advisory: Nexpose Hard‐coded Java Key Store Passphrase Allows Decryption of Stored Credentials
    No content preview
    Technical Advisory: Unauthenticated SQL Injection in Lansweeper
    No content preview
    Technical Advisory: Sonos Era 100 Secure Boot Bypass Through Unchecked setenv() call
    No content preview
    Technical Advisory: Shell Injection in SourceTree
    No content preview
    Technical Advisory: Shell Injection in MacVim mvim URI Handler
    No content preview
    The Automotive Threat Modeling Template
    No content preview
    Testing Infrastructure-as-Code Using Dynamic Tooling
    No content preview
    Testing HTTP/2 only web services
    No content preview
    The death of USB autorun and the rise of the USB keyboard
    No content preview
    The Challenges of Fuzzing 5G Protocols
    No content preview
    The Case of Missing File Extensions
    No content preview
    The Phishing Guide: Understanding & Preventing Phishing Attacks
    No content preview
    The Pharming Guide – Understanding and preventing DNS related attacks by phishers
    No content preview
    The Myth of Twelve More Bytes: Security on the Post-Scarcity Internet
    No content preview
    Thin Clients: Slim Security
    No content preview
    There’s A Hole In Your SoC: Glitching The MediaTek BootROM
    No content preview
    The SSL Conservatory
    No content preview
    The Sorry State of Aftermarket Head Unit Security
    No content preview
    TLSPretense — SSL/TLS Client Testing Framework
    No content preview
    Threats and vulnerabilities within the Maritime and shipping sectors
    No content preview
    Threat Profiling Microsoft SQL Server
    No content preview
    Tool Release – Project Kubescout: Adding Kubernetes Support to Scout Suite
    No content preview
    Tool Release – Principal Mapper v1.1.0 Update
    No content preview
    Tool Release – Monkey365
    No content preview
    Toner Deaf – Printing your next persistence (Hexacon 2022)
    No content preview
    Tool Release – Socks Over RDP
    No content preview
    Tool Release – shouganaiyo-loader: A Tool to Force JVM Attaches
    No content preview
    Tool Release – ScoutSuite 5.8.0
    No content preview
    Tool Release – ScoutSuite 5.10
    No content preview
    Tool Release – JWT-Reauth
    No content preview
    Tool Release – Solitude: A privacy analysis tool
    No content preview
    Tool Release – ScoutSuite 5.9.0
    No content preview
    Tool Release – ScoutSuite 5.13.0
    No content preview
    Tool Release – ScoutSuite 5.11.0
    No content preview
    Tool Release: Blackbox Android App Analysis with Introspy
    No content preview
    Tool Release: Announcing the Release of RtspFuzzer
    No content preview
    Tool Release: A Simple DLL Injection Utility
    No content preview
    Tool Release: Code Query (cq)
    No content preview
    Tool Release: Code Credential Scanner (ccs)
    No content preview
    Tool Release: Calculating SQL Permissions
    No content preview
    Tool Release: iOS SSL Kill Switch v0.5 Released
    No content preview
    Tool Release: Exploring SSL Pinning on iOS
    No content preview
    Tool Release: Redirecting traffic with dnsRedir.py
    No content preview
    Tool Release: PeachFarmer
    No content preview
    Tool Release: SSLyze v 0.9 released – Heartbleed edition
    No content preview
    Tool Release: SSL pinning bypass and other Android tools
    No content preview
    Tor Browser Research Report Released
    No content preview
    Top of the Pops: Three common ransomware entry techniques
    No content preview
    Tool Release: You’ll Never (Ever) Take Me Alive!
    No content preview
    Tool Release: tcpprox
    No content preview
    Trust in the Internet Survey
    No content preview
    TPM Genie
    No content preview
    Toxic Tokens: Using UUIDs for Authorization is Dangerous (even if they’re cryptographically random)
    No content preview
    tybocer
    No content preview
    Turla PNG Dropper is back
    No content preview
    Trusted Gateway
    No content preview
    Trust in the New Internet Survey
    No content preview
    UK government cyber security guidelines for connected & autonomous vehicles
    No content preview
    U plug, we play
    No content preview
    typofinder
    No content preview
    Understanding Ransomware: Impact, Evolution and Defensive Strategies
    No content preview
    Understanding Ransomware
    No content preview
    Understanding cyber risk management vs uncertainty with confidence in 2017
    No content preview
    Understanding and Hardening Linux Containers
    No content preview
    Unmasking Lorenz Ransomware: A Dive into Recent Tactics, Techniques and Procedures
    No content preview
    Understanding the root cause of F5 Networks K52145254: TMUI RCE vulnerability CVE-2020-5902
    No content preview
    Understanding the insider threat & how to mitigate it
    No content preview
    Understanding the Impact of Ransomware on Patient Outcomes – Do We Know Enough?
    No content preview
    USB under the bonnet: Implications of USB security vulnerabilities in vehicle systems
    No content preview
    USB keyboards by post – use of embedded keystroke injectors to bypass autorun restrictions on modern desktop operating systems
    No content preview
    Updated: Technical Advisory and Proofs of Concept – Multiple Vulnerabilities in U-Boot (CVE-2022-30790, CVE-2022-30552)
    No content preview
    Using graph databases to assess the security of thingernets based on the thingabilities and thingertivity of things
    No content preview
    Username enumeration techniques and their value
    No content preview
    Use of Deserialisation in .NET Framework Methods and Classes
    No content preview
    USB Undermining Security Barriers:further adventures with USB
    No content preview
    vlan-hopping
    No content preview
    Violating the Virtual Channel – RDP Testing
    No content preview
    Violating Database – Enforced Security Mechanisms
    No content preview
    Using Semgrep with Jupyter Notebook files
    No content preview
    Weak Randomness Part I – Linear Congruential Random Number Generators
    No content preview
    WastedLocker: A New Ransomware Variant Developed By The Evil Corp Group
    No content preview
    Rustproofing Linux (Part 1/4 Leaking Addresses)
    No content preview  ( 13 min )
    HTTP to MCP Bridge
    No content preview  ( 9 min )
    Windows Remote Desktop Memory Corruption Leading to RCE on XPSP3
    No content preview
    White Paper: Login Service Security
    No content preview
    Welcome to the new NCC Group Global Research blog
    No content preview
    Matty McMattface: Security implications, mitigations & testing strategies for biometric facial recognition systems
    No content preview
    Writing Small Shellcode
    No content preview
    Windows USB RNDIS driver kernel pool overflow
    No content preview
    Windows IPC Fuzzing Tools
    No content preview
    Whitepaper – XML Schema, DTD, and Entity Attacks: A Compendium of Known Techniques
    No content preview
    Constant-Time Data Processing At a Secret Offset, Privacy and QUIC
    No content preview
    Bypassing software update package encryption – extracting the Lexmark MC3224i printer firmware (part 1)
    No content preview
    Treat your points as cash
    No content preview
    Immortalising 20 Years of Epic Research
    No content preview
    Analyzing a PJL directory traversal vulnerability – exploiting the Lexmark MC3224i printer (part 2)
    No content preview
    A Brief Review of Bitcoin Locking Scripts and Ordinals
    No content preview
    Defending Your Directory: An Expert Guide to Mitigating Pass-the-Hash Attacks in Active Directory
    No content preview
    Nameless and shameless: Ransomware Encryption via BitLocker
    No content preview
    Public Report - Google Confidential Space Security Assessment
    No content preview  ( 6 min )
    Phish Supper: An Incident Responder’s Bread and Butter
    No content preview
    MeshyJSON: A TP-Link tdpServer JSON Stack Overflow
    No content preview  ( 30 min )
    iSEC’s Analysis of Microsoft’s SDL and its ROI
    No content preview  ( 6 min )
    NCC Group Connected Health Whitepaper July 2019
    No content preview  ( 6 min )
    NCC Group’s 2024 Annual Research Report
    No content preview  ( 7 min )
    Testing Two-Factor Authentication
    No content preview  ( 21 min )
    Practical Considerations of Right-to-Repair Legislation
    No content preview  ( 17 min )
    Paradoxical Compression with Verifiable Delay Functions
    No content preview  ( 13 min )
    Whitepaper – Weaning the Web off of Session Cookies: Making Digest Authentication Viable
    No content preview  ( 6 min )
    Vulnerability Overview: Ghost (CVE-2015-0235)
    No content preview  ( 8 min )
    Threat Modelling Cloud Platform Services by Example: Google Cloud Storage
    No content preview  ( 19 min )
    A glimpse into the shadowy realm of a Chinese APT: detailed analysis of a ShadowPad intrusion
    No content preview  ( 16 min )
    Hardware Security By Design: ESP32 Guidance
    No content preview  ( 17 min )
    Some Notes About the Xen XSA-122 Bug
    No content preview  ( 10 min )
    Making New Connections – Leveraging Cisco AnyConnect Client to Drop and Run Payloads
    No content preview  ( 11 min )
    CVE-2018-8611 Exploiting Windows KTM Part 1/5 – Introduction
    No content preview  ( 22 min )
    Detecting Mimikatz with Busylight
    No content preview
    Detecting and Protecting when Remote Desktop Protocol (RDP) is open to the Internet
    No content preview
    RokRat Analysis
    No content preview  ( 10 min )
    Detecting and Hunting for the PetitPotam NTLM Relay Attack
    No content preview
    A Race to Report a TOCTOU: Analysis of a Bug Collision in Intel SMM
    No content preview  ( 9 min )
    Tool Update – ruby-trace: A Low-Level Tracer for Ruby
    No content preview
    SETTLERS OF NETLINK: Exploiting a limited UAF in nf_tables (CVE-2022-32250)
    No content preview
    Tool Release: DIBF Tool Suite
    No content preview  ( 7 min )
    Technical Advisory: Multiple Vulnerabilities in Ricoh Printers
    No content preview
    North Korea’s Lazarus: their initial access trade-craft using social media and social engineering
    No content preview
    Much Ado About Hardware Implants
    No content preview
    Technical Advisory: CyberArk EPM Non-paged Pool Buffer Overflow
    No content preview
    Stepping Insyde System Management Mode
    No content preview
    Reverse, Reveal, Recover: Windows Defender Quarantine Forensics
    No content preview
    OffensiveCon 2023 – Exploit Engineering – Attacking the Linux Kernel
    No content preview
    Improving Software Security through C Language Standards
    No content preview
    State of DNS Rebinding in 2023
    No content preview
    Weaknesses and Best Practices of Public Key Kerberos with Smart Cards
    No content preview  ( 6 min )
    BlackHat USA 2024 - Listen-Up: Sonos Over-The-Air Remote Kernel Exploitation and Covert Wiretap
    No content preview
    Tool Release: Magisk Module – Conscrypt Trust User Certs
    No content preview
    Technical Advisory – Multiple Vulnerabilities in the Galaxy App Store (CVE-2023-21433, CVE-2023-21434)
    No content preview
    Technical Advisory – Multiple HTML Injection Vulnerabilities in KaiOS Pre-installed Mobile Applications
    No content preview
    Technical Advisory: Multiple Vulnerabilities in TCPDF
    No content preview
    Announcing the Cryptopals Guided Tour Video 18: Implement CTR
    No content preview
    Java Coding Guidelines: 75 Recommendations for Reliable and Secure Programs
    No content preview
    A Primer On Slowable Encoders
    No content preview
    Tool Release – Reliably-checked String Library Binding
    No content preview
    Technical Advisory: Bypassing Microsoft XOML Workflows Protection Mechanisms using Deserialisation of Untrusted Data
    No content preview
    NCLoader
    No content preview
    CERT C Secure Coding Standard
    No content preview
    Building Systems from Commercial Components
    No content preview
    Weak Passwords Led to (SafePay) Ransomware…Yet Again
    No content preview
    Technical Advisory: IP Office Stored Cross Site Scripting (XSS) Vulnerability
    No content preview
    Secure Coding in C and C++
    No content preview
    Professional C Programming LiveLessons, (Video Training) Part I: Writing Robust, Secure, Reliable Code
    No content preview
    Freddy: An extension for automatically identifying deserialisation issues in Java and .NET applications
    No content preview
    Rustproofing Linux (Part 3/4 Integer Overflows)
    No content preview
    An Engineer’s View: Operational Technology
    No content preview
    A Rendezvous with System Management Interrupts
    No content preview
    The Browser Hacker’s Handbook
    No content preview
    iSEC Completes TrueCrypt Audit
    No content preview
    Online Casino Roulette – A guideline for penetration testers and security researchers
    No content preview
    VeChain JavaScript SDK Cryptography and Security Review
    No content preview
    The Development of a Telco Attack Testing Tool
    No content preview
    Pumping Iron on the Musl Heap – Real World CVE-2022-24834 Exploitation on an Alpine mallocng Heap
    No content preview
    Research Insights Volume 2 – Defensive Trends
    No content preview  ( 6 min )
    xcavator
    No content preview
    Streamlining Global Automotive Cybersecurity Governance to Accelerate Innovation, Assurance, and Compliance
    No content preview
    Tool Release – Carnivore: Microsoft External Assessment Tool
    No content preview
    iSEC reviews SecureDrop
    No content preview
    Conference Talks – March 2020
    No content preview
    USB attacks need physical access right? Not any more…
    No content preview  ( 6 min )
    Zcash Cryptography and Code Review
    No content preview  ( 6 min )
    Public Report – AWS Nitro System API & Security Claims French
    No content preview  ( 6 min )
    Public Report – AWS Nitro System API & Security Claims German
    No content preview  ( 6 min )
    Readable Thrift
    No content preview  ( 10 min )
    Python Class Informer: an IDAPython plugin for viewing run-time type information (RTTI)
    No content preview  ( 6 min )
    Tool Release: Sinking U-Boots with Depthcharge
    No content preview  ( 23 min )
    The Paillier Cryptosystem with Applications to Threshold ECDSA
    No content preview  ( 20 min )
    Masquerade: You Downloaded ScreenConnect not Grok AI!
    No content preview
    Research Insights Volume 4 – Sector Focus: Maritime Sector
    No content preview  ( 6 min )
    Ragweed
    No content preview  ( 6 min )
    Research Insights Volume 5 – Sector Focus: Automotive
    No content preview  ( 6 min )
    Passive Information Gathering – The Analysis of Leaked Network Security Information
    No content preview  ( 6 min )
    Password and brute-force mitigation policies
    No content preview  ( 6 min )
    Public Report: Aleo snarkOS Implementation and Consensus Mechanism Review
    No content preview  ( 6 min )
    Passive Decryption of Ethereum Peer-to-Peer Traffic
    No content preview  ( 9 min )
    The Demise of Signature Based Antivirus
    No content preview  ( 6 min )
    Premium Practical Law Content Gateway
    No content preview  ( 6 min )
    Premium Practical Law Content Gateway(2)
    No content preview  ( 6 min )
    PhanTap (Phantom Tap): Making networks spookier one packet at a time
    No content preview  ( 10 min )
    Machine Learning 101: The Integrity of Image (Mis)Classification?
    No content preview  ( 6 min )
    Practical Machine Learning for Random (Filename) Detection
    No content preview  ( 11 min )
    Which database is more secure? Oracle vs. Microsoft
    No content preview  ( 6 min )
    They Ought to Know Better: Exploiting Security Gateways via their Web Interfaces
    No content preview  ( 6 min )
    The Future of C Code Review
    No content preview  ( 6 min )
    Shocker
    No content preview  ( 6 min )
    The facts about BadUSB
    No content preview  ( 8 min )
    Time Trial: Racing Towards Practical Remote Timing Attacks
    No content preview  ( 6 min )
    Tis the Season to Be…
    No content preview  ( 9 min )
    Puckungfu: A NETGEAR WAN Command Injection
    No content preview  ( 11 min )
    The Spelling Police: Searching for Malicious HTTP Servers by Identifying Typos in HTTP Responses
    No content preview  ( 12 min )
    Tool Release – HTTPSignatures: A Burp Suite Extension Implementing HTTP Signatures
    No content preview  ( 11 min )
    So long and thanks for all the 0day
    No content preview  ( 21 min )
    Security Considerations of zk-SNARK Parameter Multi-Party Computation
    No content preview  ( 16 min )
    The role of security research in improving cyber security
    No content preview  ( 6 min )
    The factoring dead: Preparing for the cryptopocalypse
    No content preview  ( 6 min )
    Research Insights Volume 6: Common Issues with Environment Breakouts
    No content preview  ( 6 min )
    Tool Release – Ghostrings
    No content preview  ( 9 min )
    Tool Release – Socks Over RDP Now Works With Citrix
    No content preview  ( 7 min )
    pySimReader
    No content preview  ( 6 min )
    SAML Pummel
    No content preview  ( 6 min )
    Research Insights Volume 9 – Modern Security Vulnerability Discovery
    No content preview  ( 6 min )
    Securing the continuous integration process
    No content preview  ( 6 min )
    Second-Order Code Injection Attacks
    No content preview  ( 6 min )
    SecureIE.ActiveX
    No content preview  ( 6 min )
    scenester
    No content preview  ( 6 min )
    Secure Messaging for Normal People
    No content preview  ( 6 min )
    Shellshock Advisory
    No content preview  ( 8 min )
    Striking Back at Retired Cobalt Strike: A look at a legacy vulnerability
    No content preview  ( 14 min )
    Symantec Backup Exec 2012 – Linux Backup Agent Heap Overflow
    No content preview  ( 6 min )
    Supply Chain Security Begins with Secure Software Development
    No content preview  ( 13 min )
    TA505 exploits SolarWinds Serv-U vulnerability (CVE-2021-35211) for initial access
    No content preview  ( 10 min )
    Sysinternals SDelete: When Secure Delete Fails
    No content preview  ( 11 min )
    Technical Advisory – Nullsoft Scriptable Installer System (NSIS) – Insecure Temporary Directory Usage
    No content preview  ( 10 min )
    Technical Advisory – SonicWall SMA 100 Series – Unauthenticated Stored XSS
    No content preview  ( 8 min )
    Technical Advisory – OpenOffice.org Multiple Memory Corruption Vulnerabilities
    No content preview  ( 9 min )
    Technical Advisory – Multiple vulnerabilities in Nuki smart locks (CVE-2022-32509, CVE-2022-32504, CVE-2022-32502, CVE-2022-32507, CVE-2022-32503, CVE-2022-32510, CVE-2022-32506, CVE-2022-32508, CVE-2022-32505)
    No content preview  ( 21 min )
    Technical Advisory – Multiple Vulnerabilities in U-Boot (CVE-2022-30790, CVE-2022-30552)
    No content preview  ( 10 min )
    Technical Advisory: Multiple Vulnerabilities in HP Printers
    No content preview  ( 10 min )
    Technical Advisory – Coda Filesystem Kernel Memory Disclosure
    No content preview  ( 8 min )
    Singularity of Origin
    No content preview  ( 6 min )
    Solaris 11 USB hubclass
    No content preview  ( 6 min )
    Signaturing an Authenticode anomaly with Yara
    No content preview  ( 9 min )
    Securing Teradata Database
    No content preview  ( 7 min )
    Stopping Automated Attack Tools
    No content preview  ( 6 min )
    SMACK, SKIP-TLS & FREAK SSL/TLS Vulnerabilities
    No content preview  ( 9 min )
    Social Engineering
    No content preview  ( 6 min )
    Spy-Pi: Do you trust your laptop docking stations?
    No content preview  ( 7 min )
    Sobelow Update
    No content preview  ( 6 min )
    The CERT® C Coding Standard, Second Edition: 98 Rules for Developing Safe, Reliable, and Secure Systems
    No content preview  ( 6 min )
    SSL checklist for pentesters
    No content preview  ( 6 min )
    SOC maturity & capability
    No content preview  ( 6 min )
    Symantec Message Filter Session Hijacking via session
    No content preview  ( 6 min )
    Software Security Austerity Security Debt in Modern Software Development
    No content preview  ( 6 min )
    SSLyze v0.8
    No content preview  ( 6 min )
    Symantec Messaging Gateway – Out of band stored XSS via email
    No content preview  ( 6 min )
    Technical Advisory – Authenticated SQL Injection in SOAP Request in Broadcom CA Network Flow Analysis (CVE-2021-44050)
    No content preview  ( 7 min )
    Phishing Stories
    No content preview  ( 6 min )
    SysAid Helpdesk stored XSS
    No content preview  ( 6 min )
    Perfect Forward Security
    No content preview  ( 6 min )
    Post-exploiting a compromised etcd – Full control over the cluster and its nodes
    No content preview  ( 14 min )
    Technical Advisory – DelTek Vision – Arbitrary SQL Execution (SQLi)
    No content preview  ( 8 min )
    Porting the Misfortune Cookie Exploit: A Look into Router Exploitation Using the TD-8817
    No content preview  ( 6 min )
    Technical Advisory – Jitsi Meet Electron – Limited Certificate Validation Bypass (CVE-2020-27161)
    No content preview  ( 7 min )
    Technical Advisory – Authorization Bypass Allows for Pinboard Corruption
    No content preview  ( 8 min )
    Technical Advisory – Bomgar Remote Support – Local Privilege Escalation
    No content preview  ( 8 min )
    Technical Advisory – Apple HFS+ Information Disclosure Vulnerability
    No content preview  ( 8 min )
    Technical Advisory – libraptor – XXE in RDF/XML File Interpretation
    No content preview  ( 10 min )
    Technical advisory: “ROHNP”- key extraction side channel in multiple crypto libraries
    No content preview  ( 9 min )
    Technical Advisory: Multiple Vulnerabilities in Accellion File Transfer Appliance
    No content preview  ( 11 min )
    Technical Advisory: Multiple Vulnerabilities in Lexmark Printers
    No content preview  ( 12 min )
    Xen SMEP (and SMAP) Bypass
    No content preview  ( 13 min )
    RIFT: Analysing a Lazarus Shellcode Execution Method
    No content preview  ( 9 min )
    Tool Release – Winstrument: An Instrumentation Framework for Windows Application Assessments
    No content preview  ( 11 min )
    Technical Advisory: Citrix Workspace / Receiver Remote Code Execution Vulnerability
    No content preview  ( 7 min )
    Technical Advisory – ExpressLRS vulnerabilities allow for hijack of control link
    No content preview  ( 8 min )
    Technical Advisory – New York State Excelsior Pass Vaccine Passport Scanner App Sends Data to a Third Party not Specified in Privacy Policy
    No content preview  ( 7 min )
    OCP S.A.F.E. How-to
    No content preview  ( 9 min )
    Technical Advisory – Apple iOS / OSX: Foundation NSXMLParser XXE Vulnerability
    No content preview  ( 9 min )
    Technical Advisory – play-pac4j Authentication rule bypass
    No content preview  ( 7 min )
    Technical Advisory – ICTFAX 7-4 – Indirect Object Reference
    No content preview  ( 7 min )
    Oracle Forensics Part 3: Isolating Evidence of Attacks Against the Authentication Mechanism
    No content preview  ( 6 min )
    Technical Advisory: Administrative Passcode Recovery and Authenticated Remote Buffer Overflow Vulnerabilities in Gigaset DX600A Handset (CVE-2021-25309, CVE-2021-25306)
    No content preview  ( 7 min )
    Technical Advisory – NULL Pointer Derefence in McAfee Drive Encryption (CVE-2021-23893)
    No content preview  ( 7 min )
    Network Attached Security: Attacking a Synology NAS
    No content preview  ( 6 min )
    Technical Advisory – Multiple Vulnerabilities in Juplink RX4-1800 WiFi Router (CVE-2022-37413, CVE-2022-37414)
    No content preview  ( 8 min )
    Technical Advisory – SonicWall SMA 100 Series – Heap-Based Buffer Overflow (CVE-2021-20043)
    No content preview  ( 7 min )
    Modelling Threat Actor Phishing Behaviour
    No content preview  ( 6 min )
    Technical Advisory: Mosquitto Broker DoS through a Memory Leak vulnerability
    No content preview  ( 8 min )
    Technical Advisory: Pulse Connect Secure – RCE via Uncontrolled Gzip Extraction (CVE-2020-8260)
    No content preview  ( 9 min )
    Technical Advisory: Heartbleed chained with a Pass-the-Hash attack leads to device compromise on TP-Link C200 IP Camera
    No content preview  ( 6 min )
    Research Paper – Recovering deleted data from the Windows registry
    No content preview  ( 6 min )
    Revealing Embedded Fingerprints: Deriving intelligence from USB stack interactions
    No content preview  ( 6 min )
    NCC Group’s 2022 & 2023 Research Report
    No content preview  ( 8 min )
    Technical Advisory – SerComm h500s – Authenticated Remote Command Execution (CVE-2021-44080)
    No content preview  ( 7 min )
    Technical Advisory: Adobe ColdFusion Object Deserialisation RCE
    No content preview  ( 8 min )
    SecureCisco
    No content preview  ( 6 min )
    Third party assurance
    No content preview  ( 6 min )
    Technical Advisory: Pulse Connect Secure – Arbitrary File Read via Logon Message (CVE-2020-8255)
    No content preview  ( 7 min )
    Windows 10 USB Mass Storage driver arbitrary code execution in kernel mode
    No content preview  ( 6 min )
    Open Banking: Security considerations & potential risks
    No content preview  ( 6 min )
    Pip3line
    No content preview  ( 6 min )
    YoNTMA
    No content preview  ( 6 min )
    Poison Ivy string decryption
    No content preview  ( 7 min )
    Rise of the machines: Machine Learning & its cyber security applications
    No content preview  ( 6 min )
    The 9 Lives of Bleichenbacher’s CAT: New Cache ATtacks on TLS Implementations
    No content preview  ( 7 min )
    SysAid Helpdesk Pro – Blind SQL Injection
    No content preview  ( 6 min )
    Technical Advisory – Garuda Linux Insecure User Creation (CVE-2021-3784)
    No content preview  ( 7 min )
    Technical Advisory – KwikTag Web Admin Authentication Bypass
    No content preview  ( 8 min )
    whitebox
    No content preview  ( 6 min )
    The Password is Dead, Long Live the Password!
    No content preview  ( 12 min )
    Wheel of Fortune Outcome Prediction – Taking the Luck out of Gambling (1)
    No content preview  ( 17 min )
    RM3 – Curiosities of the wildest banking malware
    No content preview  ( 32 min )
    Writing FreeBSD Kernel Modules in Rust
    No content preview  ( 15 min )
    The Extended AWS Security Ramp-Up Guide
    No content preview  ( 12 min )
    Readable Thrift (1)
    No content preview
    Rise of the Sensors: Securing LoRaWAN Networks
    No content preview
    Research Insights Volume 1 – Sector Focus: Financial Services
    No content preview
    44Con2013Game
    No content preview
    44CON Workshop – How to assess and secure iOS apps
    No content preview
    10 real-world stories of how we’ve compromised CI/CD pipelines
    No content preview
    A brief look at Windows telemetry: CIT aka Customer Interaction Tracker
    No content preview
    A Back-to-Front TrueCrypt Recovery Story: The Plaintext is the Ciphertext
    No content preview
    5G security – how to minimise the threats to a 5G network
    No content preview
    A New Flying Kitten?
    No content preview
    A jq255 Elliptic Curve Specification, and a Retrospective
    No content preview
    A Guide to Improving Security Through Infrastructure-as-Code
    No content preview
    A few notes on usefully exploiting libstagefright on Android 5.x
    No content preview
    A Survey of Istio’s Network Security Features
    No content preview
    A Simple and Practical Approach to Input Validation
    No content preview
    A Peek Behind the Great Firewall of Russia
    No content preview
    Accessing Private Fields Outside of Classes in Java
    No content preview
    Abusing Privileged and Unprivileged Linux Containers
    No content preview
    Abusing Blu-ray Players Part 1 – Sandbox Escapes
    No content preview
    A WarCon 2017 Presentation: Cisco ASA – Exploiting the IKEv1 Heap Overflow – CVE-2016-1287
    No content preview
    Adobe flash sandbox bypass to navigate to local drives
    No content preview
    Adobe Flash Player Cross Domain Policy Bypass
    No content preview
    Adobe Acrobat Reader XML Forms Data Format Buffer Overflow
    No content preview
    Adversarial Machine Learning: Approaches & defences
    No content preview
    Adventures in Xen Exploitation
    No content preview
    Advanced SQL Injection in SQL Server Applications
    No content preview
    Advanced Exploitation of Oracle PL/SQL Flaws
    No content preview
    An Adaptive-Ciphertext Attack Against “I ⊕ C” Block Cipher Modes With an Oracle
    No content preview
    Alternative Approaches for Fault Injection Countermeasures (Part 3/3)
    No content preview
    Advisory-CraigSBlackie-CVE-2016-9795
    No content preview
    Advice for security decision makers contemplating the value of Antivirus
    No content preview
    An Analysis of Mobile Geofencing App Security
    No content preview
    An adventure in PoEKmon NeutriGo land
    No content preview
    An Adventure in Contingency Debugging: Ruby IO#read/IO#write Considered Harmful
    No content preview
    An Introduction to Fault Injection (Part 1/3)
    No content preview
    An Illustrated Guide to Elliptic Curve Cryptography Validation
    No content preview
    An Introduction to Heap overflows on AIX 5.3L
    No content preview
    Oracle E-Business Suite Pre-Auth SQLi with DBA Privileges
    No content preview  ( 7 min )
    Research Report – Zephyr and MCUboot Security Assessment
    No content preview  ( 7 min )
    Whitepaper: CA Alternative
    No content preview  ( 7 min )
    Whatsupgold Premium Directory traversal
    No content preview  ( 6 min )
    Pairing over BLS12-381, Part 2: Curves
    No content preview  ( 14 min )
    Zcash Overwinter Consensus and Sapling Cryptography Review
    No content preview  ( 6 min )
    Tool Release – ScoutSuite 5.12.0
    No content preview  ( 7 min )
    Research Insights Volume 7: Exploitation Advancements
    No content preview  ( 6 min )
    Technical advisory: CVE-2017-8592 – XMLHttpRequest in IE followed 307 redirections with additional or customised headers
    No content preview  ( 8 min )
    Whitepaper – Exploring the Security of KaiOS Mobile Applications
    No content preview  ( 6 min )
    Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 3: Understanding Existing Approaches and Attempts
    No content preview  ( 17 min )
    White Paper: Cryptopocalypse Reference Paper
    No content preview  ( 7 min )
    Post-quantum cryptography overview
    No content preview  ( 6 min )
    Whitepaper – Microcontroller Readback Protection: Bypasses and Defenses
    No content preview  ( 6 min )
    Preparing for Cyber Battleships – Electronic Chart Display and Information System Security
    No content preview  ( 6 min )
    Windows remote desktop memory corruptoin leading to RCE on XPSP3
    No content preview  ( 6 min )
    Tool Release: Blackbox iOS App Analysis with Introspy
    No content preview  ( 7 min )
    Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 2: Going off on a Tangent – AI/ML Applications in Social Engineering
    No content preview  ( 13 min )
    Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 6: Development of Prototype #2 – Creating a SQLi PoC
    No content preview  ( 15 min )
    Whitepaper: Recognizing and Preventing TOCTOU
    No content preview  ( 6 min )
    Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 9: Adventures with Expert Systems
    No content preview  ( 13 min )
    To dock or not to dock, that is the question: Using laptop docking stations as hardware-based attack platforms
    No content preview  ( 6 min )
    Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 8: Development of Prototype #4 – Building on Takaesu’s Approach with Focus on XSS
    No content preview  ( 10 min )
    Premium Security Content Gateway
    No content preview  ( 6 min )
    Breaking Pedersen Hashes in Practice
    No content preview  ( 18 min )
    Tool Release – Collaborator++
    No content preview  ( 8 min )
    ZigTools: An Open Source 802.15.4 Framework
    No content preview  ( 6 min )
    WebRATS
    No content preview  ( 6 min )
    Whitepaper – A Heap of Trouble: Breaking the Linux Kernel SLOB Allocator
    No content preview  ( 6 min )
    Tool Release – Web3 Decoder Burp Suite Extension
    No content preview  ( 8 min )
    Writing Secure ASP Scripts
    No content preview  ( 6 min )
    The ABCs of NFC chip security
    No content preview  ( 14 min )
    Vaccine Misinformation Part 1: Misinformation Attacks as a Cyber Kill Chain
    No content preview  ( 15 min )
    Threat Spotlight – Hydra
    No content preview  ( 11 min )
    Smuggling HTA files in Internet Explorer/Edge
    No content preview  ( 10 min )
    An Introduction to Ultrasound Security Research
    No content preview
    An Introduction to Quantum Computing for Security Professionals
    No content preview
    Analysis of Boomerang Differential Trials via a SAT-Based Constraint Solver URSA
    No content preview
    Analysing a recent Poison Ivy sample
    No content preview
    An offensive guide to the Authorization Code grant
    No content preview
    Android-KillPermAndSigChecks
    No content preview
    Android SSL Bypass
    No content preview
    Android Cloud Backup/Restore
    No content preview
    Analysis of the Linux backdoor used in freenode IRC network compromise
    No content preview
    Announcing NCC Group’s Cryptopals Guided Tour!
    No content preview
    Announcing NCC Group’s Cryptopals Guided Tour: Set 2
    No content preview
    Android-SSL-TrustKiller
    No content preview
    Android-OpenDebug
    No content preview
    Apple Mac OS X ImageIO TIFF Integer Overflow
    No content preview
    Apple CoreAnimation Heap Overflow
    No content preview
    Apache Struts Vulnerability
    No content preview
    Anti Brute Force Resource Metering
    No content preview
    Announcing the AWS blog post series
    No content preview
    APT15 is Alive and Strong: An Analysis of RoyalCli and RoyalDNS
    No content preview
    Approximately 2000 Citrix NetScalers backdoored in mass-exploitation campaign
    No content preview
    Application Layer Attacks – The New DDoS Battleground
    No content preview
    Apple QuickTime Player m4a Processing Buffer Overflow
    No content preview
    Apple OSX/iPhone iOS ImageIO TIFF getBandProcTIFF TileWidth Heap Overflow
    No content preview
    ASP.NET Security and the Importance of KB2698981 in Cloud Environments Threat Brief
    No content preview
    ASP.NET Security and the Importance of KB2698981 in Cloud Environments
    No content preview
    ASE 12.5.1 datatype overflow
    No content preview
    Are you oversharing (in Salesforce)? Our new tool could sniff it out!
    No content preview
    Archived Technical Advisories
    No content preview
    AssetHook
    No content preview
    Assessing Unikernel Security
    No content preview
    Assessing the security and privacy of Vaccine Passports
    No content preview
    Assessing IIS Configuration Remotely
    No content preview
    Attacking Web Service Security: Message Oriented Madness, XML Worms and Web Service Security Sanity
    No content preview
    Attacking the Windows Kernel (Black Hat Las Vegas 2007)
    No content preview
    AtHoc Toolbar
    No content preview
    Assuring Your DDoS Defences
    No content preview
    Automated Reverse Engineering of Relationships Between Data Structures in C++ Binaries
    No content preview
    Automated enumeration of email filtering solutions
    No content preview
    Authorisation
    No content preview
    Attacks on SSL
    No content preview
    Azucar
    No content preview
    AWS environment security assessment with Scout2
    No content preview
    AutoRepeater: Automated HTTP Request Repeating With Burp Suite
    No content preview
    Automating extraction from malware and recent campaign analysis
    No content preview
    Batten down the hatches: Cyber threats facing DP operations
    No content preview
    BAT: a Fast and Small Key Encapsulation Mechanism
    No content preview
    Back Office Web Administration Authentication Bypass
    No content preview
    Best practices with BYOD
    No content preview
    Best Practices for the use of Static Code Analysis within a Real-World Secure Development Lifecycle
    No content preview
    Berserko: Kerberos Authentication for Burp Suite
    No content preview
    Black Hat 2013 – Bluetooth Smart Presentation Available
    No content preview
    Bit51 Better Security WP Security Plugin – Unauthenticated Stored XSS to RCE
    No content preview
    Beyond data loss prevention
    No content preview
    Black Hat Europe 2013 Andy Davis: To dock or not to dock…
    No content preview
    Black Hat 2013 – Femtocell Presentation Slides, Videos and App
    No content preview
    Black Hat 2013 – Cryptopocalypse Presentation Available
    No content preview
    BlackBerry PlayBook Security – Part Two – BlackBerry Bridge
    No content preview
    BlackBerry PlayBook Security – Part One
    No content preview
    BlackBerry Link WebDav Server Bound to the BlackBerry VPN Adapter
    No content preview
    Black Hat USA 2015 presentation: Broadcasting your attack-DAB security
    No content preview
    Blind Return Oriented Programming
    No content preview
    BlackHat Asia USB Physical Access
    No content preview
    Blackbox iOS App Assessments Using idb
    No content preview
    Browser Extension Password Managers
    No content preview
    Broadcasting your attack – DAB security
    No content preview
    Breaking into Security Research at NCC Group
    No content preview
    Blind Security Testing – An Evolutionary Approach
    No content preview
    Building an RDP Credential Catcher for Threat Intelligence
    No content preview
    Build Your Own Wi-Fi Mapping Drone Capability
    No content preview
    Buffer Underruns, DEP, ASLR and improving the Exploitation Prevention Mechanisms (XPMs) on the Windows platform
    No content preview
    Building WiMap the Wi-Fi Mapping Drone
    No content preview
    Building Intuition for Lattice-Based Signatures – Part 2: Fiat-Shamir with Aborts
    No content preview
    Building Intuition for Lattice-Based Signatures – Part 1: Trapdoor Signatures
    No content preview
    Bypassing Oracle DBMS_ASSERT (in certain situations)
    No content preview
    Bypassing Android’s Network Security Configuration
    No content preview
    Business Insights: Cyber Security in the Financial Sector
    No content preview
    Celebrating NCC Con Europe 2018
    No content preview
    CECSTeR
    No content preview
    Call Map: A Tool for Navigating Call Graphs in Python
    No content preview
    C Language Standards Update – Zero-size Reallocations are Undefined Behavior
    No content preview
    Choosing the Right MCU for Your Embedded Device — Desired Security Features of Microcontrollers
    No content preview
    Check out our new Microcorruption challenges!
    No content preview
    Chafer backdoor analysis
    No content preview
    CertPortal: Building Self-Service Secure S/MIME Provisioning Portal
    No content preview
    Cisco ASA series part five: libptmalloc gdb plugin
    No content preview
    Cisco ASA series part eight: Exploiting the CVE-2016-1287 heap overflow over IKEv1
    No content preview
    Chrome Password Manager Cross Origin Weakness
    No content preview
    Cisco ASA series part six: Cisco ASA mempools
    No content preview
    Cisco ASA series part seven: Checkheaps
    No content preview
    Cisco ASA series part one: Intro to the Cisco ASA
    No content preview
    Cisco ASA series part four: dlmalloc-2.8.x, libdlmalloc, & dlmalloc on Cisco ASA
    No content preview
    Cisco VPN Client Privilege Escalation
    No content preview
    Cisco IPSec VPN Implementation Group Name Enumeration
    No content preview
    Cisco ASA series part two: Static analysis & datamining of Cisco ASA firmware
    No content preview
    Cisco ASA series part three: Debugging Cisco ASA firmware
    No content preview
    Cloud Security Presentation
    No content preview
    Climbing Mount Everest: Black-Byte Bytes Back?
    No content preview
    Cleaning Up After Cookies
    No content preview
    cisco-SNMP-enumeration
    No content preview
    Combating Java Deserialisation Vulnerabilities with Look-Ahead Object Input Streams (LAOIS)
    No content preview
    Code Patterns for API Authorization: Designing for Security
    No content preview
    CMakerer: A small tool to aid CLion’s indexing
    No content preview
    CloudWatch: Amazon Web Services & Shellshock
    No content preview
    Compromising a Hospital Network for £118 (Plus Postage & Packaging)
    No content preview
    Common Security Issues in Financially-Oriented Web Applications
    No content preview
    Common Insecure Practices with Configuring and Extending Salesforce
    No content preview
    Common Flaws of Distributed Identity and Authentication Systems
    No content preview
    Command Injection in XML Signatures and Encryption
    No content preview
    Conference Talks – February 2020
    No content preview
    Conference Talks – December 2020
    No content preview
    Conference Talks – August 2020
    No content preview
    Compromising Apache Tomcat via JMX access
    No content preview
    Conference Talks – November 2020
    No content preview
    Conference Talks – May 2021
    No content preview
    Conference Talks – June 2022
    No content preview
    Conference Talks – January 2020
    No content preview
    Conference Talks – February/March 2021
    No content preview
    Conference Talks – September/October 2022
    No content preview
    Conference Talks – September 2021
    No content preview
    Conference Talks – September 2020
    No content preview
    Conference Talks – October 2020
    No content preview
    Conference Talks – October 2021
    No content preview
    Conference Talks – November 2021
    No content preview
    Conference Talks – March 2022
    No content preview
    Conference Talks – June 2021
    No content preview
    Conference Talks – December 2021
    No content preview
    CowCloud
    No content preview
    Conti-nuation: methods and techniques observed in operations post the leaks
    No content preview
    Content Security Policies Best Practices
    No content preview
    Content Security Policies and Popular CMS Systems
    No content preview
    Cranim: A Toolkit for Cryptographic Visualization
    No content preview
    Cracking RDP NLA Supplied Credentials for Threat Intelligence
    No content preview
    Cracking Random Number Generators using Machine Learning – Part 2: Mersenne Twister
    No content preview
    Cracking Random Number Generators using Machine Learning – Part 1: xorshift128
    No content preview
    creep-web-app-scanner
    No content preview
    Creating Arbitrary Shellcode In Unicode Expanded Strings
    No content preview
    Creating a Safer OAuth User Experience
    No content preview
    Crave the Data: Statistics from 1,300 Phishing Campaigns
    No content preview
    Cross Site Request Forgery: An Introduction to a Common Web Application Weakness
    No content preview
    Critical Risk Vulnerability in SAP Message Server (Heap Overflow)
    No content preview
    Critical Risk Vulnerability in SAP DB Web Server (Stack Overflow)
    No content preview
    Critical Risk Vulnerability in Ingres (Pointer Overwrite 2)
    No content preview
    Critical Risk Vulnerability in Ingres (Pointer Overwrite 1)
    No content preview
    CVE-2018-8611 – Diving into the Windows Kernel Transaction Manager (KTM) for fun and exploitation
    No content preview
    CVE-2017-8570 RTF and the Sisfader RAT
    No content preview
    Curve9767 and Fast Signature Verification
    No content preview
    Cups-filters remote code execution
    No content preview
    Cyber Security in UK Agriculture
    No content preview
    Cyber red-teaming business-critical systems while managing operational risk
    No content preview
    Cyber Essentials Scheme
    No content preview
    CVE-2019-1405 and CVE-2019-1322 – Elevation to SYSTEM via the UPnP Device Host Service and the Update Orchestrator Service
    No content preview
    D0nut encrypt me, I have a wife and no backups
    No content preview
    D-Link routers vulnerable to Remote Code Execution (RCE)
    No content preview
    D-LINK DIR-850L web admin interface vulnerable to stack-based buffer overflow
    No content preview
    CyberVillainsCA
    No content preview
    Cyber Security of New Space Paper
    No content preview
    Data-mining with SQL Injection and Inference
    No content preview
    DARPA OnStar Vulnerability Analysis
    No content preview
    Dangling Cursor Snarfing: A New Class of Attack in Oracle
    No content preview
    Dancing Offbit: The Story of a Single Character Typo that Broke a ChaCha-Based PRNG
    No content preview
    Database Servers on Windows XP and the unintended consequences of simple file sharing
    No content preview
    Database Security: A Christmas Carol
    No content preview
    Database Security Brief: The Oracle Critical Patch Update for April 2007
    No content preview
    DataArmor Full Disk Encryption 3.0.12c – Restricted Environment breakout, Privilege Escalation and Full Disk Decryption
    No content preview
    Decoder Improved Burp Suite plugin release part one
    No content preview
    Decoder Improved Burp Suite Plugin
    No content preview
    Deception Engineering: exploring the use of Windows Installer Packages against first stage payloads
    No content preview
    DDoS Common Approaches and Failings
    No content preview
    Defeating the Stack Based Buffer Overflow Prevention Mechanism of Microsoft Windows 2003 Server
    No content preview
    Deep Dive into Real-World Kubernetes Threats
    No content preview
    DECTbeacon
    No content preview
    Decrypting OpenSSH sessions for fun and profit
    No content preview
    Decoding network data from a Gh0st RAT variant
    No content preview
    Demystifying Multivariate Cryptography
    No content preview
    Demystifying Cobalt Strike’s “make_token” Command
    No content preview
    Demystifying AWS’ AssumeRole and sts:ExternalId
    No content preview
    DeLux Edition: Getting root privileges on the eLux Thin Client OS
    No content preview
    Detecting DNS implants: Old kitten, new tricks – A Saitama Case Study
    No content preview
    Detecting anomalous Vectored Exception Handlers on Windows
    No content preview
    Derusbi: A Case Study in Rapid Capability Development
    No content preview
    Denial of Service in Parsing a URL by ierutil.dll
    No content preview
    DIBF – Updated
    No content preview
    Detection Engineering for Kubernetes clusters
    No content preview
    Detecting Rclone – An Effective Tool for Exfiltration
    No content preview
    Detecting Karakurt – an extortion focused threat actor
    No content preview
    Distributed Ledger (Blockchain) Security and Quantum Computing Implications
    No content preview
    Dissecting social engineering attacks
    No content preview
    Disclosure Policy
    No content preview
    Domestic IoT Nightmares: Smart Doorbells
    No content preview
    Does TypeScript Offer Security Improvements Over JavaScript?
    No content preview
    Do not use your AWS root account
    No content preview
    DNS Pinning and Web Proxies
    No content preview
    dotnetpefuzzing
    No content preview
    dotnetpaddingoracle
    No content preview
    Don’t throw a hissy fit; defend against Medusa
    No content preview
    Drupal Vulnerability
    No content preview
    Drones: Detect, Identify, Intercept, and Hijack
    No content preview
    Double-odd Elliptic Curves
    No content preview
    Early CCS Attack Analysis
    No content preview
    E-mail Spoofing and CDONTS.NEWMAIL
    No content preview
    Dynamic Linq Injection Remote Code Execution Vulnerability (CVE-2023-32571)
    No content preview
    eBook – Do you know how your organisation would react in a real-world attack scenario?
    No content preview
    EasyDA – Easy Windows Domain Access Script
    No content preview
    easyda
    No content preview
    EDIDFuzzer
    No content preview
    eBook: Breach notification under GDPR – How to communicate a personal data breach
    No content preview
    eBook – Planning a robust incident response process
    No content preview
    Encryption at rest: Not the panacea to data protection
    No content preview
    Emissary Panda – A potential new malicious tool
    No content preview
    Embedded Device Security Certifications
    No content preview
    Elephant in the Boardroom Survey 2016
    No content preview
    Endpoint connectivity
    No content preview
    End-of-life pragmatism
    No content preview
    Encryption Does Not Equal Invisibility – Detecting Anomalous TLS Certificates with the Half-Space-Trees Algorithm
    No content preview
    Estimating the Bit Security of Pairing-Friendly Curves
    No content preview
    Erlang Security 101
    No content preview
    Enumerating System Management Interrupts
    No content preview
    Enterprise-scale seamless onboarding and deployment of Azure Sentinel using Lighthouse for multi-tenant environments
    No content preview
    Eurocrypt 2023: Death of a KEM
    No content preview
    Ethics in Security Testing
    No content preview
    EternalGlue part one: Rebuilding NotPetya to assess real-world resilience
    No content preview
    Exploiting CVE-2014-0282
    No content preview
    Exploit the Fuzz – Exploiting Vulnerabilities in 5G Core Networks
    No content preview
    Experiments in Extending Thinkst Canary – Part 1
    No content preview
    Exception Handling and Data Integrity in Salesforce
    No content preview
    Exploiting PL/SQL Injection Flaws with only CREATE SESSION Privileges
    No content preview
    Exploiting Noisy Oracles with Bayesian Inference
    No content preview
    Exploiting CVE-2015-2426, and How I Ported it to a Recent Windows 8.1 64-bit
    No content preview
    Exploiting CVE-2014-0282 (1)
    No content preview
    Exploiting Security Gateways Via Web Interfaces
    No content preview
    Exploiting Samba CVE-2015-0240 on Ubuntu 12.04 and Debian 7 32-bit
    No content preview
    Exploiting Rich Content
    No content preview
    Exploring macOS Calendar Alerts: Part 2 – Exfiltrating data (CVE-2020-3882)
    No content preview
    Exploring macOS Calendar Alerts: Part 1 – Attempting to execute code
    No content preview
    Exploring DeepFake Capabilities & Mitigation Strategies with University College London
    No content preview
    Exploiting the win32k!xxxEnableWndSBArrows use-after-free (CVE-2015-0057) bug on both 32-bit and 64-bit
    No content preview
    Exploring the Security & Privacy of Canada’s Digital Proof of Vaccination Programs
    No content preview
    Exploring Prompt Injection Attacks
    No content preview
    Exploring Overfitting Risks in Large Language Models
    No content preview
    Extending a Thinkst Canary to become an interactive honeypot
    No content preview
    Exporting non-exportable RSA keys
    No content preview
    Exploring Verifiable Random Functions in Code
    No content preview
    Fat-Finger
    No content preview
    Extractor
    No content preview
    Extracting the Payload from a CVE-2014-1761 RTF Document
    No content preview
    External Enumeration and Exploitation of Email and Web Security Solutions
    No content preview
    Finding and Exploiting .NET Remoting over HTTP using Deserialisation
    No content preview
    File Fuzzers
    No content preview
    Faux Disk Encryption: Realities of Secure Storage On Mobile Devices
    No content preview
    Five Essential Machine Learning Security Papers
    No content preview
    firstexecution
    No content preview
    Firmware Rootkits: The Threat to the Enterprise
    No content preview
    Finding the weak link in binaries
    No content preview
    Flash security restrictions bypass: File upload by URLRequest
    No content preview
    Flash local-with-filesystem Bypass in navigateToURL
    No content preview
    Fix Bounty
    No content preview
    FrisbeeLite
    No content preview
    FPGAs: Security Through Obscurity?
    No content preview
    Forensic Fuzzing Tools
    No content preview
    Flubot: the evolution of a notorious Android Banking Malware
    No content preview
    Fuzzbox
    No content preview
    From ERMAC to Hook: Investigating the technical differences between two Android malware variants
    No content preview
    From CSV to CMD to qwerty
    No content preview
    Fuzzing the Easy Way Using Zulu (1)
    No content preview
    Fuzzing the Easy Way Using Zulu
    No content preview
    Fuzzing RTSP to discover an exploitable vulnerability in VLC
    No content preview
    General Data Protection Regulation – are you ready?
    No content preview
    G-Scout
    No content preview
    Fuzzing USB devices using Frisbee Lite
    No content preview
    Getting Shell with XAMLX Files
    No content preview
    Getting per-user Conditional Access MFA status in Azure
    No content preview
    General Data Protection Regulation: Knowing your data
    No content preview
    Gizmo
    No content preview
    Ghost Vulnerability (CVE-2015-0235)
    No content preview
    Ghidra nanoMIPS ISA module
    No content preview
    Hacking a web application
    No content preview
    Grepify – a Small Tool for Code Reviewers
    No content preview
    grepify
    No content preview
    Going “AUTH the Rails” on a Crazy Train
    No content preview
    Hackproofing MySQL
    No content preview
    Hacking the Extensible Firmware Interface
    No content preview
    Hacking Displays Made Interesting
    No content preview
    Hacking Appliances: Ironic exploits in security products
    No content preview
    HDMI – Hacking Displays Made Interesting
    No content preview
    Harnessing GPUs Building Better Browser Based Botnets
    No content preview
    Hardware & Embedded Systems: A little early effort in security can return a huge payoff
    No content preview
    Hackproofing Oracle Application Server
    No content preview
    Heartbleed OpenSSL vulnerability
    No content preview
    Heartbleed (CVE-2014-0160) Advisory
    No content preview
    HDMI Ethernet Channel
    No content preview
    HITB Phuket 2023 – Exploiting the Lexmark PostScript Stack
    No content preview
    HIDDEN COBRA Volgmer: A Technical Analysis
    No content preview
    Hiccupy
    No content preview
    Helping Engineering Teams Tackle Security Debt in Embedded Systems: U-Boot Configuration Auditing Introduced in Depthcharge v0.2.0
    No content preview
    How much training should staff have on cyber security?
    No content preview
    How cryptography is used to monitor the spread of COVID-19
    No content preview
    House
    No content preview
    hostresolver
    No content preview
    How to Spot and Prevent an Eclipse Attack
    No content preview
    How To Spot a Penetration Tester in Your Network (and Catch the Real Bad Guys at the Same Time)
    No content preview
    How to protect yourself & your organisation from phishing attacks
    No content preview
    How to Backdoor Diffie-Hellman
    No content preview
    How-to: Importing WStalker CSV (and more) into Burp Suite via Import to Sitemap Extension
    No content preview
    How will GDPR impact your communications?
    No content preview
    How we breach network infrastructures and protect them
    No content preview
    IAM user management strategy (part 2)
    No content preview
    IAM user management strategy
    No content preview
    Hunting SQL Injection Bugs
    No content preview
    HTTP Profiler
    No content preview
    IETF Draft: Indicators of Compromise and Their Role in Attack and Defen[c|s]e
    No content preview
    ICS/OT Security & the evolution of the Purdue Model: Integrating Industrial and Business Networks
    No content preview
    IAX Voice Over-IP Security
    No content preview
    Impact of DNS over HTTPS (DoH) on DNS Rebinding Attacks
    No content preview
    Immunity Debugger Buffer Overflow
    No content preview
    Image IO Memory Corruption
    No content preview
    Implementing the Castryck-Decru SIDH Key Recovery Attack in SageMath
    No content preview
    Implementing and Detecting a PCI Rootkit
    No content preview
    Impersonating Gamers With GPT-2
    No content preview
    Improving your Network and Application Assurance Strategy in an environment of increasing 0day vulnerabilities
    No content preview
    Improving Your Embedded Linux Security Posture With Yocto
    No content preview
    Impress Pages CMS Remote Code Execution
    No content preview
    Incremental Machine Learning by Example: Detecting Suspicious Activity with Zeek Data Streams, River, and JA3 Hashes
    No content preview
    Increased exploitation of Oracle GlassFish Server Administration Console Remote Authentication Bypass
    No content preview
    In-depth analysis of the new Team9 malware family
    No content preview
    Intel® Software Guard Extensions (SGX): A Researcher’s Primer
    No content preview
    Intel BIOS Advisory – Memory Corruption in HID Drivers
    No content preview
    Integrity destroying malicious code for financial or geopolitical gain: A vision of the future?
    No content preview
    Integrating DigitalOcean into ScoutSuite
    No content preview
    Interfaces.d to RCE
    No content preview
    Inter-Protocol Communication
    No content preview
    Intent Fuzzer
    No content preview
    Introducing idb-Simplified Blackbox iOS App Pentesting
    No content preview
    Introducing Chuckle and the Importance of SMB Signing
    No content preview
    Introducing Azucar
    No content preview
    Internet of Things Security
    No content preview
    Investigating Potential Security Vulnerability Manifestation through Various Analyses & Inferences Regarding Internet RFCs (and how RFC Security might be Improved)
    No content preview
    Introspy for Android
    No content preview
    Introduction to AWS Attribute-Based Access Control
    No content preview
    Introduction to Anti-Fuzzing: A Defence in Depth Aid
    No content preview
    iOS certificate pinning code updated for iOS 7
    No content preview
    iOS 7 arbitrary code execution in kernel mode
    No content preview
    IODIDE
    No content preview
    iOS User Enrollment and Trusted Certificates
    No content preview
    iOS SSL Killswitch
    No content preview
    iOS MobileSlideShow USB Image Class arbitrary code execution.txt
    No content preview
    iOS Instrumentation Without Jailbreak
    No content preview
    iSEC audit of MediaWiki
    No content preview
    Is this the real life? Is this just fantasy? Caught in a landslide, NoEscape from NCC Group
    No content preview
    IP-reputation-snort-rule-generator
    No content preview
    Ivanti Zero Day – Threat Actors observed leveraging CVE-2021-42278 and CVE-2021-42287 for quick privilege escalation to Domain Admin
    No content preview
    ISM RAT
    No content preview
    iSEC Partners Releases SSLyze
    No content preview
    iSEC Engages in TrueCrypt Audit
    No content preview
    Java RMI Registry.bind() Unvalidated Deserialization
    No content preview
    Jailbreak, updated and open-sourced
    No content preview
    Jailbreak
    No content preview
    Jackson Deserialization Vulnerabilities
    No content preview
    Kivlad
    No content preview
    Kerberos Resource-Based Constrained Delegation: When an Image Change Leads to a Privilege Escalation
    No content preview
    Java Web Start File Inclusion via System Properties Override
    No content preview
    Latest threats to the connected car & intelligent transport ecosystem
    No content preview
    LAPSUS$: Recent techniques, tactics and procedures
    No content preview
    lapith
    No content preview
    Kubernetes Security: Consider Your Threat Model
    No content preview
    LeaPFRogging PFR Implementations
    No content preview
    LDAPFragger: Bypassing network restrictions using LDAP attributes
    No content preview
    Launching the first in our series of Research Insights
    No content preview
    LibAVCodec AMV Out of Array Write
    No content preview
    Lessons learned from 50 USB bugs
    No content preview
    Lessons learned from 50 bugs: Common USB driver vulnerabilities
    No content preview
    Lending a hand to the community – Covenant v0.7 Updates
    No content preview
    Live Incident Blog: June Global Ransomware Outbreak
    No content preview
    libtalloc: A GDB plugin for analysing the talloc heap
    No content preview
    Logs, Logs, the Audit Trail – Features of a Successful Log Management Solution
    No content preview
    Login Service Security
    No content preview
    log4j-jndi-be-gone: A simple mitigation for CVE-2021-44228
    No content preview
    Lumension Device Control Remote Memory Corruption
    No content preview
    Lumension Device Control (formerly Sanctuary) remote memory corruption
    No content preview
    LTair:  The LTE Air Interface Tool
    No content preview
    Low Cost Attacks on Smart Cards – The Electromagnetic Side-Channel
    No content preview
    Machine learning from idea to reality: a PowerShell case study
    No content preview
    Machine Learning for Static Analysis of Malware – Expansion of Research Scope
    No content preview
    Machine Learning 104: Breaking AES With Power Side-Channels
    No content preview
    Managing Cyber Risk in the Supply Chain
    No content preview
    Man-in-the-Middling Non-Proxy Aware Wi-Fi Devices with a Pineapple
    No content preview
    Mature Security Testing Framework
    No content preview
    Maritime Cyber Security: Threats and Opportunities
    No content preview
    Manifest Explorer
    No content preview
    Managing PowerShell in a modern corporate environment
    No content preview
    McAfee Email and Web Security Appliance Password hashes can be recovered from a system backup and easily cracked
    No content preview
    McAfee Email and Web Security Appliance Arbitrary file download is possible with a crafted URL, when logged in as any user
    No content preview
    McAfee Email and Web Security Appliance Any logged-in user can bypass controls to reset passwords of other administrators
    No content preview
    McAfee Email and Web Security Appliance Active session tokens of other users are disclosed within the UI
    No content preview
    McAfee Email and Web Security Appliance v5.6 – Active session tokens of other users are disclosed within the UI
    No content preview
    McAfee Email and Web Security Appliance Session hijacking and bypassing client-side session timeouts
    No content preview
    McAfee Email and Web Security Appliance Reflective XSS allowing an attacker to gain session tokens
    No content preview
    McAfee Email and Web Security Appliance v5.6 – Password hashes can be recovered from a system backup and easily cracked
    No content preview
    McAfee Email and Web Security Appliance v5.6 – Any logged-in user can bypass controls to reset passwords of other administrators
    No content preview
    Medium Risk Vulnerability in Symantec Network Access Control
    No content preview
    Medium Risk Vulnerability in Symantec Enterprise Security Management
    No content preview
    Medical Devices: A Hardware Security Perspective
    No content preview
    Microsoft Internet Explorer CMarkup Use-After-Free
    No content preview
    Microsoft announces the WMIC command is being retired, Long Live PowerShell
    No content preview
    Mergers & Acquisitions (M&A) cyber security due diligence
    No content preview
    Memory Scanning for the Masses
    No content preview
    Microsoft’s SQL Server vs. Oracle’s RDBMS
    No content preview
    Microsoft SQL Server Passwords
    No content preview
    Microsoft Office Memory Corruption Vulnerability
    No content preview
    More Advanced SQL Injection
    No content preview
    Mobile World Congress – Mobile Internet of Things
    No content preview
    Mobile apps and security by design
    No content preview
    Multiple Format String Injections in AFFLIB
    No content preview
    Multiple Cisco CSS / ACE Client Certificate and HTTP Header
    No content preview
    Multiple Buffer Overflows Discovered in AFFLIB
    No content preview
    MSSQL Lateral Movement
    No content preview
    Multiple Vulnerabilities in MailEnable
    No content preview
    Multiple Shell Metacharacter Injections in AFFLIB
    No content preview
    Multiple security vulnerabilities in SAP NetWeaver BSP Logon
    No content preview
    Nagios XI Network Monitor Blind SQL Injection
    No content preview
    My name is Matt – My voice is my password
    No content preview
    My Hash is My Passport: Understanding Web and Mobile Authentication
    No content preview
    NCC Group Research at Black Hat USA 2021 and DEF CON 29
    No content preview
    NCC CON Europe 2017
    No content preview
    Nagios XI Network Monitor Stored and Reflected XSS
    No content preview
    Nagios XI Network Monitor – OS Command Injection
    No content preview
    NCC Group placed first in global 5G Cyber Security Hack competition
    No content preview
    NCC Group co-signs the Electronic Frontier Foundation’s Statement on DMCA Use Against Security Researchers
    No content preview
    NCC Con Europe 2022 – Pwn2Own Austin Presentations
    No content preview
    NCC Group’s Jeremy Boone recognized for Highest Quality and Most Eligible Reports through the Intel Circuit Breaker program
    No content preview
    NCC Group’s 2020 Annual Research Report
    No content preview
    NCC Group researchers named amongst MSRC’s Most Valuable Security Researchers in 2020
    No content preview
    NCC Group Research at Black Hat USA 2022 and DEF CON 30
    No content preview
    NCC Group’s Upcoming Trainings at Black Hat USA 2021
    No content preview
    NCC Group’s Juan Garrido named to Microsoft’s MSRC Office Security Researcher Leaderboard
    No content preview
    WSMap
    No content preview  ( 6 min )
    Tool Release – ICPin, an integrity-check and anti-debug detection pintool
    No content preview  ( 6 min )
    Slotting Security into Corporate Development
    No content preview  ( 6 min )
    The Importance of a Cryptographic Review
    No content preview  ( 6 min )
    Tool: WStalker – an easy proxy to support Web API assessments
    No content preview  ( 7 min )
    Security First Umbrella
    No content preview  ( 6 min )
    Variations in Exploit methods between Linux and Windows
    No content preview  ( 6 min )
    The Update Framework (TUF) Security Assessment
    No content preview  ( 6 min )
    Wubes: Leveraging the Windows 10 Sandbox for Arbitrary Processes
    No content preview  ( 7 min )
    Tool Release: iOS Secure State Preservation
    No content preview  ( 7 min )
    Tool Release: Cartographer
    No content preview  ( 9 min )
    The economics of defensive security
    No content preview  ( 6 min )
    Visualising Firewall Rulesets – Simplifying Firewall Administration and Spotting the Pivot Point
    No content preview  ( 8 min )
    Samba _netr_ServerPasswordSet Expoitability Analysis
    No content preview  ( 10 min )
    Understanding Microsoft Word OLE Exploit Primitives: Exploiting CVE-2015-1642 Microsoft Office CTaskSymbol Use-After-Free Vulnerability
    No content preview  ( 6 min )
    Use and enforce Multi-Factor Authentication
    No content preview  ( 9 min )
    Unveiling the Dark Side: A Deep Dive into Active Ransomware Families
    No content preview  ( 14 min )
    WebLogic Plugin HTTP Injection via Encoded URLs
    No content preview  ( 11 min )
    RIFT: Detection capabilities for recent F5 BIG-IP/BIG-IQ iControl REST API vulnerabilities CVE-2021-22986
    No content preview  ( 11 min )
    Technical Advisory – Kwikset/Weiser BLE Proximity Authentication in Kevo Smart Locks Vulnerable to Relay Attacks
    No content preview  ( 9 min )
    Adventures in the land of BumbleBee – a new malicious loader
    No content preview  ( 10 min )
    The Pentesters Guide to Akamai
    No content preview
    The CIS Security Standard for Docker available now
    No content preview
    The disadvantages of a blacklist-based approach to input validation
    No content preview
    The L4m3ne55 of Passw0rds: Notes from the field
    No content preview
    Ricochet Security Assessment Public Report
    No content preview
    Sharkbot is back in Google Play
    No content preview
    Secure Device Manufacturing: Supply Chain Security Resilience
    No content preview
    SysPWN – VR for Pwn2Own
    No content preview
    Technical Advisory – Citrix Access Gateway Command Injection Vulnerability
    No content preview
    Technical Advisory – Arbitrary Signature Forgery in Stark Bank ECDSA Libraries (CVE-2021-43572, CVE-2021-43570, CVE-2021-43569, CVE-2021-43568, CVE-2021-43571)
    No content preview
    Technical Advisory: Authentication rule bypass
    No content preview
    Technical Advisory – FUJITSU CentricStor Control Center <= V8.1 – Unauthenticated Command Injection ( CVE-2022-31794 and CVE-2022-31795)
    No content preview
    Oracle Forensics Part 7 Using the Oracle System Change Number in Forensic Investigations
    No content preview
    Oracle Hyperion 11 Directory Traversal
    No content preview
    Oracle Gridengine sgepasswd Buffer Overflow
    No content preview
    Oracle Passwords and OraBrute
    No content preview
    Oracle Java Installer Adds a System Path Which is Writable by All
    No content preview
    Oracle Retail Invoice Manager SQL Injection
    No content preview
    Oracle Retail Integration Bus Manager Directory Traversal
    No content preview
    Order Details Screens and PII
    No content preview
    OS X Lion USB Hub Class Descriptor Arbitrary Code Execution
    No content preview
    OS X 10.6.6 Camera Raw Library Memory Corruption
    No content preview
    OSX afpserver remote code execution
    No content preview
    osquery Application Security Assessment Public Report
    No content preview
    Overview of Modern Memory Security Concerns
    No content preview
    Package Play
    No content preview
    Owning the Virgin Media Hub 3.0: The perfect place for a backdoor
    No content preview
    Pairing over BLS12-381, Part 1: Fields
    No content preview
    Padding the struct: How a compiler optimization can disclose stack memory
    No content preview
    Squiz CMS File Path Traversal
    No content preview  ( 7 min )
    umap
    No content preview  ( 6 min )
    TPM Genie: Interposer Attacks Against the Trusted Platform Module Serial Bus
    No content preview  ( 6 min )
    Vulnerabilities Found In Geofencing Apps
    No content preview  ( 7 min )
    Samba on the BlackBerry PlayBook
    No content preview  ( 6 min )
    Virtual Access Monitor Multiple SQL Injection Vulnerabilities
    No content preview  ( 6 min )
    Understanding Microsoft Word OLE Exploit Primitives
    No content preview  ( 6 min )
    TANDBERG Video Communication Server Authentication Bypass
    No content preview  ( 9 min )
    Shellshock Bash Vulnerability
    No content preview  ( 7 min )
    Symantec Backup Exec 2012 – OS version and service pack information leak
    No content preview  ( 6 min )
    Technical Advisory: SMB Hash Hijacking and User Tracking in MS Outlook
    No content preview  ( 7 min )
    SSLyze v0.7 Released
    No content preview  ( 6 min )
    Technical Advisory – Sunhillo SureLine Unauthenticated OS Command Injection (CVE-2021-36380)
    No content preview  ( 7 min )
    Symantec Messaging Gateway – Addition of a backdoor adminstrator via CSRF
    No content preview  ( 6 min )
    PeachFarmer
    No content preview  ( 6 min )
    Defending Your Directory: An Expert Guide to Fortifying Active Directory Against LDAP Injection Threats
    No content preview  ( 9 min )
    Technical Advisory: Code Execution by Unsafe Resource Handling in Multiple Microsoft Products
    No content preview  ( 8 min )
    ABSTRACT SHIMMER (CVE-2020-15257): Host Networking is root-Equivalent, Again
    No content preview  ( 24 min )
    PMKID Attacks: Debunking the 802.11r Myth
    No content preview  ( 11 min )
    Adventures in Windows Driver Development: Part 1
    No content preview  ( 12 min )
    Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 5: Development of Prototype #1 – Text Processing and Semantic Relationships
    No content preview  ( 10 min )
    Jenkins Plugins and Core Technical Summary Advisory
    No content preview  ( 8 min )
    When Security Gets in the Way: PenTesting Mobile Apps That Use Certificate Pinning
    No content preview  ( 6 min )
    VoIP Security Methodology and Results
    No content preview  ( 6 min )
    Technical Advisory – Linux RDS Protocol Local Privilege Escalation
    No content preview  ( 8 min )
    Technical Advisory: Stored and Reflected XSS Vulnerability in Nagios Log Server (CVE-2021-35478,CVE-2021-35479)
    No content preview  ( 7 min )
    When a Trusted Site in Internet Explorer was Anything But
    No content preview  ( 9 min )
    Autochrome
    No content preview  ( 6 min )
    Exposing Vulnerabilities in Media Software
    No content preview  ( 6 min )
    Forensic Readiness in Container Environments
    No content preview  ( 9 min )
    Technical Advisory – wolfSSL TLS 1.3 Client Man-in-the-Middle Attack (CVE-2020-24613)
    No content preview  ( 8 min )
    Exploiting MS15-061 Use-After-Free Windows Kernel Vulnerability
    No content preview  ( 6 min )
    Tool – Windows Executable Memory Page Delta Reporter
    No content preview  ( 8 min )
    Technical Advisory: Cross-Site Scripting in Umbraco Rich Text Display
    No content preview  ( 8 min )
    Secure Coding in C and C++, 2nd Edition
    No content preview  ( 6 min )
    Technical Advisory – VMware Tools Multiple Vulnerabilities
    No content preview  ( 8 min )
    Windows DACLs & Why There Is Still Room for Interest
    No content preview  ( 7 min )
    RomHack – Revving Up: The Journey to Pwn2Own Automotive 2024
    No content preview  ( 7 min )
    Technical Advisory – macOS Installer Local Root Privilege Escalation (CVE-2020-9817)
    No content preview  ( 10 min )
    Mitigating the top 10 security threats to GCP using the CIS Google Cloud Platform Foundation Benchmark
    No content preview  ( 12 min )
    Shining the Light on Black Basta
    No content preview  ( 12 min )
    IG Learner Walkthrough
    No content preview  ( 14 min )
    Dangers of Kubernetes IAM Integrations
    No content preview  ( 10 min )
    Security Code Review With ChatGPT
    No content preview  ( 20 min )
    Technical Advisory – OpenJDK – Weak Parsing Logic in java.net.InetAddress and Related Classes
    No content preview  ( 16 min )
    How I did not get a shell
    No content preview  ( 16 min )
    Technical Advisory – Multiple Vulnerabilities in Nagios XI
    No content preview  ( 23 min )
    earlyremoval, in the Conservatory, with the Wrench: Exploring Ghidra’s decompiler internals to make automatic P-Code analysis scripts
    No content preview  ( 27 min )
    CVE-2018-8611 Exploiting Windows KTM Part 3/5 – Triggering the race condition and debugging tricks
    No content preview  ( 24 min )
    CVE-2018-8611 Exploiting Windows KTM Part 4/5 – From race win to kernel read and write primitive
    No content preview  ( 32 min )
    Mallory and Me: Setting up a Mobile Mallory Gateway
    No content preview  ( 12 min )
    Defeating Windows DEP With A Custom ROP Chain
    No content preview  ( 27 min )
    Technical Advisory: Multiple Vulnerabilities in Brother Printers
    No content preview  ( 9 min )
    Technical Advisory: Multiple Vulnerabilities in Kyocera Printers
    No content preview  ( 12 min )
    There’s Another Hole In Your SoC: Unisoc ROM Vulnerabilities
    No content preview  ( 18 min )
    Technical Advisory: containerd – containerd-shim API Exposed to Host Network Containers (CVE-2020-15257)
    No content preview  ( 12 min )
    Technical Advisory: Xiaomi 13 Pro Code Execution via GetApps DOM Cross-Site Scripting (XSS)
    No content preview  ( 11 min )
    Software Verification and Analysis Using Z3
    No content preview  ( 37 min )
    Analyzing AI Application Threat Models
    No content preview  ( 25 min )
    Technical Advisory – SonicWall SMA 100 Series – Unauthenticated File Upload Path Traversal (CVE-2021-20040)
    No content preview  ( 8 min )
    Technical Advisory – Linksys WRT160NL – Authenticated Remote Buffer Overflow (CVE-2020-26561)
    No content preview  ( 7 min )
    Potential false redirection of web site content in Internet in SAP NetWeaver web applications
    No content preview  ( 6 min )
    Technical Advisory: Adobe ColdFusion RMI Registry.bind() Deserialisation RCE
    No content preview  ( 7 min )
    Technical Advisory: Intel Driver Support & Assistance – Local Privilege Escalation
    No content preview  ( 8 min )
    Technical Advisory: Reflected Cross-Site Scripting (XSS) vulnerability in Jenkins Delivery Pipeline plugin
    No content preview  ( 7 min )
    Windows DACL Enum Project
    No content preview  ( 6 min )
    Threat Intelligence: Benefits for the Enterprise
    No content preview  ( 6 min )
    Using AWS and Azure for Cost Effective Log Ingestion with Data Processing Pipelines for SIEMs
    No content preview  ( 10 min )
    Using SharePoint as a Phishing Platform
    No content preview  ( 10 min )
    Unauthenticated XML eXternal Entity (XXE) vulnerability
    No content preview  ( 7 min )
    Social Engineering Penetration Testing
    No content preview  ( 6 min )
    Windows 2000 Format String Vulnerabilities
    No content preview  ( 6 min )
    Tool Release: Introducing opinel: Scout2’s favorite tool
    No content preview  ( 8 min )
    The Mobile Application Hacker’s Handbook
    No content preview  ( 6 min )
    An Introduction to Authenticated Encryption
    No content preview  ( 6 min )
    The Database Hacker’s Handbook
    No content preview  ( 6 min )
    Vehicle Emissions and Cyber Security
    No content preview  ( 8 min )
    NCC Group WhitepaperUnderstanding and HardeningLinux ContainersJune 29, 2016 – Version 1.1
    No content preview  ( 6 min )
    44CON - Charging Ahead: Exploiting an EV Charger Controller at Pwn2Own Automotive 2024
    No content preview  ( 7 min )
    Tool Release: SSLyze v0.8 released
    No content preview  ( 6 min )
    Tool Release: YoNTMA
    No content preview  ( 7 min )
    Webinar: 4 Secrets to a Robust Incident Response Plan
    No content preview  ( 6 min )
    Blind Exploitation of Stack Overflow Vulnerabilities
    No content preview  ( 6 min )
    McAfee Email and Web Security Appliance v5.6 – Arbitrary file download is possible with a crafted URL, when logged in as any user
    No content preview  ( 7 min )
    Technical Advisory – Pulse Connect Secure – RCE via Template Injection (CVE-2020-8243)
    No content preview  ( 7 min )
    Modernizing Legacy Systems: Software Technologies, Engineering Processes, and Business Practices
    No content preview  ( 6 min )
    Public Report: eBPF Verifier Code Review
    No content preview  ( 6 min )
    Decoder Improved Burp Suite plugin release part two
    No content preview  ( 9 min )
    WebSense content filter bypass when deployed in conjunction with Cisco filtering devices
    No content preview  ( 10 min )
    Oracle Forensics Part 6: Examining Undo Segments, Flashback and the Oracle Recycle Bin
    No content preview
    Oracle Forensics Part 4: Live Response
    No content preview
    Android Malware Vultur Expands Its Wingspan
    No content preview  ( 22 min )
    Remote Exploitation of Microsoft Office DLL Hijacking (MS15-132) via Browsers
    No content preview  ( 10 min )
    Cross-Execute Your Linux Binaries, Don’t Cross-Compile Them
    No content preview  ( 10 min )
    Remote Code Execution on Western Digital PR4100 NAS (CVE-2022-23121)
    No content preview  ( 26 min )
    Technical Advisory: Ruby on Rails – Possible XSS Vulnerability in ActionView tag helpers (CVE-2022-27777)
    No content preview  ( 8 min )
    GSM/GPRS Traffic Interception for Penetration Testing Engagements
    Discover how GSM/GPRS traffic interception enhances mobile security testing. A technical guide from NCC Group’s research team.  ( 18 min )
    The Dark Side: How Threat Actors Leverage AnyDesk for Malicious Activities
    No content preview  ( 13 min )
    Car Parking Apps Vulnerable To Hacks
    No content preview  ( 12 min )
    Tattler
    No content preview  ( 7 min )
    Work daily with enforced MFA-protected API access
    No content preview  ( 8 min )
    Where You Inject Matters: The Role-Specific Impact of Prompt Injection Attacks on OpenAI models
    No content preview  ( 8 min )
    The Next C Language Standard (C23)
    No content preview  ( 8 min )
    Secure Coding Rules for Java LiveLessons, Part 1
    No content preview  ( 6 min )
    Auditing K3s Clusters
    No content preview  ( 8 min )
    Technical advisory: Remote shell commands execution in ttyd
    No content preview  ( 9 min )
    Technical Advisory – Lansweeper Privilege Escalation via CSRF Using HTTP Method Interchange (CVE-2020-13658)
    No content preview  ( 8 min )
    Insomnihack - Pioneering Zero Days at Pwn2Own Automotive 2024
    No content preview  ( 7 min )
    Technical Advisory: Espressif Systems - ESP32 BluFi Reference Application Vulnerabilities
    No content preview  ( 7 min )
    Samsung Galaxy S24 Pwn2Own Ireland 2024
    No content preview  ( 6 min )
    Mallory: Transparent TCP and UDP Proxy
    No content preview  ( 6 min )
    Nine years of bugs at NCC Group
    No content preview  ( 6 min )
    Tool Release – Enumerating Docker Registries with go-pillage-registries
    No content preview  ( 8 min )
    How organisations can properly configure SSL services to ensure the integrity and confidentiality of data in transit
    No content preview  ( 6 min )
    Public Report - VeChainThor Galactica Security Assessment
    No content preview  ( 6 min )
    Machine Learning 102: Attacking Facial Authentication with Poisoned Data
    No content preview  ( 6 min )
    Security Compliance as an Engineering Discipline
    No content preview  ( 6 min )
    Local network compromise despite good patching
    No content preview  ( 6 min )
    The Shellcoder’s Handbook: Discovering and Exploiting Security Holes, 2nd Edition
    No content preview  ( 6 min )
    iOS 7 tool updates
    No content preview  ( 7 min )
    Analyzing Secure AI Architectures
    No content preview  ( 15 min )
    Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 4: Architecture and Design
    No content preview
    EAP-TLS: The most secure option?
    No content preview  ( 14 min )
    Rustproofing Linux (Part 2/4 Race Conditions)
    No content preview  ( 13 min )
    Handy guide to a new Fivehands ransomware variant
    No content preview  ( 11 min )
    Building Security In: Software Penetration Testing
    Build secure software from the start. NCC Group’s blog explores the role of penetration testing in modern, resilient app development.  ( 6 min )
    Why AI Will Not Fully Replace Humans for Web Penetration Testing
    Explore why AI alone isn’t enough for web penetration testing. NCC Group explains the irreplaceable value of human expertise in security assessments.  ( 8 min )
    Pentesting V. Red Teaming V. Bug Bounty
    Explore the differences between penetration testing, red teaming, and bug bounty programs. NCC Group helps you choose the right approach.  ( 9 min )
    Reverse engineering and decrypting CyberArk vault credential files
    No content preview  ( 9 min )
    Technical Advisory: Code Execution by Viewing Resource Files in .NET Reflector
    No content preview  ( 7 min )
    Quantum Data Centre of the Future
    No content preview  ( 10 min )
    Applying normalised compression distance for architecture classification
    No content preview  ( 6 min )
    Fake CAPTCHA led to LUMMA
    No content preview  ( 9 min )
    SMB hash hijacking & user tracking in MS Outlook
    No content preview  ( 11 min )
    5 MCP Security Tips
    No content preview  ( 10 min )
    Whitepaper – A Tour of Curve 25519 in Erlang
    No content preview  ( 6 min )
    Public Report – Confidential Mode for Hyperdisk – DEK Protection Analysis
    No content preview  ( 6 min )
    Project Bishop: Clustering Web Pages
    No content preview  ( 13 min )
    PRTG Network Monitor Command injection
    No content preview  ( 6 min )
    Public Report – Penumbra Labs R1CS Implementation Review
    No content preview  ( 6 min )
    Public Report – RustCrypto AES/GCM and ChaCha20+Poly1305 Implementation Review
    No content preview  ( 6 min )
    Public Report – Confidential Space Security Review
    No content preview  ( 6 min )
    Proxy Re-Encryption Protocol: IronCore Public Report
    No content preview  ( 6 min )
    Public Report – Matrix Olm Cryptographic Review
    No content preview  ( 6 min )
    Public Report – IOV Labs powHSM Security Assessment
    No content preview  ( 6 min )
    Public Report – Keyfork Implementation Review
    No content preview  ( 6 min )
    Public Report – VPN by Google One: Technical Security & Privacy Assessment
    No content preview  ( 6 min )
    Public Report – Kubernetes 1.24 Security Audit
    No content preview  ( 6 min )
    Public Report – Google Enterprise API Security Assessment
    No content preview  ( 6 min )
    Protecting stored cardholder data (an unofficial supplement to PCI DSS V3.0)
    No content preview  ( 6 min )
    Public Report – go-cose Security Assessment
    No content preview  ( 6 min )
    Public Report – Coda Cryptographic Review
    No content preview  ( 6 min )
    Public Report – Electric Coin Company NU4 Cryptographic Specification and Implementation Review
    No content preview  ( 6 min )
    Public Report – Zcash Zebra Security Assessment
    No content preview  ( 6 min )
    Public Report – Caliptra Security Assessment
    No content preview  ( 7 min )
    Machine Learning 103: Exploring LLM Code Generation
    No content preview  ( 6 min )
    Oracle Forensics Part 5: Finding Evidence of Data Theft in the Absence of Auditing
    No content preview  ( 6 min )
    Public Report – Solana Program Library ZK-Token Security Assessment
    No content preview  ( 6 min )
    Game Security
    No content preview  ( 14 min )
    Mining data from Cobalt Strike beacons
    No content preview  ( 13 min )
    Faster Modular Inversion and Legendre Symbol, and an X25519 Speed Record
    No content preview  ( 16 min )
    Public Report – Qredo Apache Milagro MPC Cryptographic Assessment
    No content preview  ( 6 min )
    Public Report – Protocol Labs Groth16 Proof Aggregation: Cryptography and Implementation Review
    No content preview  ( 6 min )
    Public Report – Penumbra Labs Decaf377 Implementation and Poseidon Parameter Selection Review
    No content preview  ( 6 min )
    Optimizing Pairing-Based Cryptography: Montgomery Arithmetic in Rust
    No content preview  ( 20 min )
    metasploitavevasion
    No content preview  ( 6 min )
    New Attack Vectors and a Vulnerability Dissection of MS03-007
    No content preview  ( 6 min )
    Practical SME security on a shoestring
    No content preview  ( 6 min )
    Non-stack Based Exploitation of Buffer Overrun Vulnerabilities on Windows NT 2000 XP
    No content preview  ( 6 min )
    ncccodenavi
    No content preview  ( 6 min )
    Intent Sniffer
    No content preview  ( 6 min )
    Exploit mitigations: keeping up with evolving and complex software/hardware
    No content preview  ( 7 min )
    Public Report – Aleo snarkVM Implementation Review
    No content preview  ( 6 min )
    NCC Con Europe 2016
    No content preview  ( 7 min )
    NCC Group Malware Technical Note
    No content preview  ( 6 min )
    Inter-Protocol Exploitation
    No content preview  ( 6 min )
    Public Report – Zcash NU5 Cryptography Review
    No content preview  ( 6 min )
    Microsoft Zero-Day Vulnerability – OLE2Link – Threat Intelligence and Signatures
    No content preview  ( 6 min )
    Public Report – BLST Cryptographic Implementation Review
    No content preview  ( 6 min )
    Public Report – WhatsApp Auditable Key Directory (AKD) Implementation Review
    No content preview  ( 6 min )
    Public Report – Android Cloud Backup/Restore
    No content preview  ( 6 min )
    Public Report – Entropy/Rust Cryptography Review
    No content preview  ( 6 min )
    Memory Gap
    No content preview  ( 6 min )
    Public cloud
    No content preview  ( 6 min )
    Public Report – Filecoin Bellman and BLS Signatures Cryptographic Review
    No content preview  ( 6 min )
    Public Report – Zcash FROST Security Assessment
    No content preview  ( 6 min )
    Mobile & web browser credential management: Security implications, attack cases & mitigations
    No content preview  ( 6 min )
    Non-Deterministic Nature of Prompt Injection
    No content preview  ( 8 min )
    McAfee Email and Web Security Appliance v5.6 – Session hijacking (and bypassing client-side session timeouts)
    No content preview  ( 7 min )
    Oracle Forensics Part 2: Locating Dropped Objects
    No content preview  ( 6 min )
    Public Report – Security Review of RSA Blind Signatures with Public Metadata
    No content preview  ( 6 min )
    Public Report – WhatsApp opaque-ke Cryptographic Implementation Review
    No content preview  ( 6 min )
    Project Triforce: Run AFL on Everything!
    No content preview  ( 15 min )
    Public Report – O(1) Labs Mina Client SDK, Signature Library and Base Components Cryptography and Implementation Review
    No content preview  ( 6 min )
    Peeling back the layers on defence in depth…knowing your onions
    No content preview  ( 6 min )
    Public Report – Lantern and Replica Security Assessment
    No content preview  ( 7 min )
    Autonomous AI Agents: A hidden Risk in Insecure smolagents “CodeAgent” Usage
    No content preview  ( 11 min )

  • Open

    Can ChatGPT Agent Mode solve Google CAPTCHA (reCAPTCHA) and validate the Cloudflare Turnstile challenge?
    Reports indicate that ChatGPT Agent Mode might be capable of solving CAPTCHAs, which are often the final line of defense against persistent bots like AI crawlers on many websites. However, these claims originate from Reddit, known for the frequent hallucinations of its users. To verify, I decided to test it myself. Source

  • Open

    Hunting for Secrets in Plain Sight: Leveraging Internal Logging and Monitoring Services
    In penetration testing and red teaming, success often lies in uncovering hidden paths of least resistance. While sophisticated exploits and zero-days frequently capture headlines, highly effective attack opportunities often hide in plain sight – like within internal logging and monitoring platforms. At Praetorian, we’ve observed first-hand the value of targeting internal logging and monitoring platforms […] The post Hunting for Secrets in Plain Sight: Leveraging Internal Logging and Monitoring Services appeared first on Praetorian.  ( 28 min )

  • Open

    China’s Covert Capabilities | Silk Spun From Hafnium
    China-linked hackers used patented spyware tech from front companies tied to Hafnium, exposing gaps in cyber threat attribution.  ( 30 min )

  • Open

    Rethinking cyber insurance questions to find real risk
    TL;DR   Introduction I’ve been advising on cyber risk in the insurance sector for over a decade. It still surprises me how many proposal forms include questions that offer very little insight into the actual risk being underwritten.  I’ve seen a proposal form that asks if the prospective insured has anti-virus software and firewalls in […] The post Rethinking cyber insurance questions to find real risk appeared first on Pen Test Partners.  ( 7 min )

  • Open

    Technical Advisory: Authentication rule bypass
    No content preview  ( 7 min )
    Tool Release: Blackbox Android App Analysis with Introspy
    No content preview  ( 6 min )
    The Demise of Signature Based Antivirus
    No content preview  ( 6 min )
    The CIS Security Standard for Docker available now
    No content preview  ( 7 min )
    Technical Advisory: Code Execution by Unsafe Resource Handling in Multiple Microsoft Products
    No content preview  ( 7 min )
    They Ought to Know Better: Exploiting Security Gateways via their Web Interfaces
    No content preview  ( 6 min )
    Tool Release: YoNTMA
    No content preview  ( 6 min )
    Technical Advisory: Gaining root access on Sumpple S610 IP Camera via Telnet; and Unprotected client and server data transmission between Android and IOS clients
    No content preview  ( 8 min )
    Technical Advisory: Pulse Connect Secure – Arbitrary File Read via Logon Message (CVE-2020-8255)
    No content preview  ( 7 min )
    Technical Advisory: Adobe ColdFusion RMI Registry.bind() Deserialisation RCE
    No content preview  ( 7 min )
    Tool Release – Socks Over RDP
    No content preview  ( 8 min )
    tybocer
    No content preview  ( 6 min )
    Toxic Tokens: Using UUIDs for Authorization is Dangerous (even if they’re cryptographically random)
    No content preview  ( 11 min )
    Technical Advisory: Administrative Passcode Recovery and Authenticated Remote Buffer Overflow Vulnerabilities in Gigaset DX600A Handset (CVE-2021-25309, CVE-2021-25306)
    No content preview  ( 7 min )
    TPM Genie: Interposer Attacks Against the Trusted Platform Module Serial Bus
    No content preview  ( 6 min )
    Technical Advisory: Bypassing Microsoft XOML Workflows Protection Mechanisms using Deserialisation of Untrusted Data
    No content preview  ( 9 min )
    Thin Clients: Slim Security
    No content preview  ( 6 min )
    Turla PNG Dropper is back
    No content preview  ( 10 min )
    Tool Release: Blackbox iOS App Analysis with Introspy
    No content preview  ( 7 min )
    Tool Release: Cartographer
    No content preview  ( 9 min )
    Tool Release: A Simple DLL Injection Utility
    No content preview  ( 6 min )
    Technical Advisory: Pulse Connect Secure – RCE via Uncontrolled Gzip Extraction (CVE-2020-8260)
    No content preview  ( 9 min )
    The Spelling Police: Searching for Malicious HTTP Servers by Identifying Typos in HTTP Responses
    No content preview  ( 12 min )
    TLSPretense — SSL/TLS Client Testing Framework
    No content preview  ( 6 min )
    Technical Advisory: Shell Injection in MacVim mvim URI Handler
    No content preview  ( 7 min )
    Technical Advisory: Shell Injection in SourceTree
    No content preview  ( 7 min )
    Threats and vulnerabilities within the Maritime and shipping sectors
    No content preview  ( 6 min )
    Tool Release: SSLyze v0.8 released
    No content preview  ( 6 min )
    Tool Release: DIBF Tool Suite
    No content preview  ( 6 min )
    Technical Advisory: Heartbleed chained with a Pass-the-Hash attack leads to device compromise on TP-Link C200 IP Camera
    No content preview  ( 6 min )
    Technical Advisory: Multiple Vulnerabilities in Accellion File Transfer Appliance
    No content preview  ( 11 min )
    Technical Advisory: Multiple Vulnerabilities in MailEnable
    No content preview  ( 8 min )
    Technical Advisory: Multiple Vulnerabilities in ManageEngine Desktop Central
    No content preview  ( 10 min )
    Testing Infrastructure-as-Code Using Dynamic Tooling
    No content preview  ( 10 min )
    The 9 Lives of Bleichenbacher’s CAT: New Cache ATtacks on TLS Implementations
    No content preview  ( 7 min )
    The ABCs of NFC chip security
    No content preview  ( 14 min )
    The economics of defensive security
    No content preview  ( 6 min )
    The factoring dead: Preparing for the cryptopocalypse
    No content preview  ( 6 min )
    The facts about BadUSB
    No content preview  ( 8 min )
    The Future of C Code Review
    No content preview  ( 6 min )
    The Importance of a Cryptographic Review
    No content preview  ( 6 min )
    The Myth of Twelve More Bytes: Security on the Post-Scarcity Internet
    No content preview  ( 6 min )
    The Pharming Guide – Understanding and preventing DNS related attacks by phishers
    No content preview  ( 6 min )
    Threat Modelling Cloud Platform Services by Example: Google Cloud Storage
    No content preview  ( 19 min )
    Time Trial: Racing Towards Practical Remote Timing Attacks
    No content preview  ( 6 min )
    Toner Deaf – Printing your next persistence (Hexacon 2022)
    No content preview  ( 7 min )
    Tool – Windows Executable Memory Page Delta Reporter
    No content preview  ( 7 min )
    Tool Release – Carnivore: Microsoft External Assessment Tool
    No content preview  ( 9 min )
    Tool Release – Winstrument: An Instrumentation Framework for Windows Application Assessments
    No content preview  ( 11 min )
    Tool Release – ScoutSuite 5.10
    No content preview  ( 6 min )
    Tool Release – ScoutSuite 5.13.0
    No content preview  ( 6 min )
    Tool Release – ScoutSuite 5.9.0
    No content preview  ( 7 min )
    Tool Release: iOS SSL Kill Switch v0.5 Released
    No content preview  ( 8 min )
    Tool Release: SSLyze v 0.9 released – Heartbleed edition
    No content preview  ( 7 min )
    Tor Browser Research Report Released
    No content preview  ( 7 min )
    Understanding Ransomware: Impact, Evolution and Defensive Strategies
    No content preview  ( 6 min )
    Technical Advisory: Mitel MiVoice 5330e Memory Corruption Flaw
    No content preview  ( 7 min )
    LDAPFragger: Bypassing network restrictions using LDAP attributes
    No content preview  ( 15 min )
    Kubernetes Security: Consider Your Threat Model
    No content preview  ( 10 min )
    In-Depth Technical Analysis of the Bybit Hack
    No content preview  ( 15 min )
    Manifest Explorer
    No content preview  ( 6 min )
    NCC Group’s 2020 Annual Research Report
    No content preview  ( 55 min )
    Tool Release – Ghostrings
    No content preview  ( 9 min )
    Tool Release – Principal Mapper v1.1.0 Update
    No content preview  ( 6 min )
    Tool Release – ScoutSuite 5.12.0
    No content preview  ( 7 min )
    Tool Release – shouganaiyo-loader: A Tool to Force JVM Attaches
    No content preview  ( 8 min )
    Top of the Pops: Three common ransomware entry techniques
    No content preview  ( 9 min )
    TPM Genie
    No content preview  ( 6 min )
    Trust in the New Internet Survey
    No content preview  ( 6 min )
    Trusted Gateway
    No content preview  ( 6 min )
    Unauthenticated XML eXternal Entity (XXE) vulnerability
    No content preview  ( 7 min )
    Understanding cyber risk management vs uncertainty with confidence in 2017
    No content preview  ( 6 min )
    Understanding Microsoft Word OLE Exploit Primitives
    No content preview  ( 6 min )
    Understanding Microsoft Word OLE Exploit Primitives: Exploiting CVE-2015-1642 Microsoft Office CTaskSymbol Use-After-Free Vulnerability
    No content preview  ( 6 min )
    Understanding the insider threat & how to mitigate it
    No content preview  ( 6 min )
    Updated: Technical Advisory and Proofs of Concept – Multiple Vulnerabilities in U-Boot (CVE-2022-30790, CVE-2022-30552)
    No content preview  ( 13 min )
    USB attacks need physical access right? Not any more…
    No content preview  ( 6 min )
    USB Undermining Security Barriers:further adventures with USB
    No content preview  ( 6 min )
    Use and enforce Multi-Factor Authentication
    No content preview  ( 9 min )
    Username enumeration techniques and their value
    No content preview  ( 13 min )
    NCC Group researchers named amongst MSRC’s Most Valuable Security Researchers in 2020
    No content preview  ( 7 min )
    McAfee Email and Web Security Appliance Arbitrary file download is possible with a crafted URL, when logged in as any user
    No content preview  ( 6 min )
    NCC Group’s Upcoming Trainings at Black Hat USA 2021
    No content preview  ( 8 min )
    Local network compromise despite good patching
    No content preview  ( 6 min )
    McAfee Email and Web Security Appliance Reflective XSS allowing an attacker to gain session tokens
    No content preview  ( 6 min )
    log4j-jndi-be-gone: A simple mitigation for CVE-2021-44228
    No content preview  ( 11 min )
    Protecting stored cardholder data (an unofficial supplement to PCI DSS V3.0)
    No content preview  ( 6 min )
    Public Report – Entropy/Rust Cryptography Review
    No content preview  ( 6 min )
    Microsoft Office Memory Corruption Vulnerability
    No content preview  ( 6 min )
    Phishing Stories
    No content preview  ( 6 min )
    Preparing for Cyber Battleships – Electronic Chart Display and Information System Security
    No content preview  ( 6 min )
    IODIDE
    No content preview  ( 6 min )
    Properly Signed Certificates on CPE Devices
    No content preview  ( 11 min )
    iSEC Partners Releases SSLyze
    No content preview  ( 6 min )
    SAML Pummel
    No content preview  ( 6 min )
    Mature Security Testing Framework
    No content preview  ( 6 min )
    More Advanced SQL Injection
    No content preview  ( 6 min )
    Quantum Cryptography – A Study Into Present Technologies and Future Applications
    No content preview  ( 6 min )
    NCC Group placed first in global 5G Cyber Security Hack competition
    No content preview  ( 8 min )
    Potential false redirection of web site content in Internet in SAP NetWeaver web applications
    No content preview  ( 6 min )
    Nessus Authenticated Scan – Local Privilege Escalation
    No content preview  ( 6 min )
    Public Report – Matrix Olm Cryptographic Review
    No content preview  ( 6 min )
    iOS SSL Killswitch
    No content preview  ( 6 min )
    Samba on the BlackBerry PlayBook
    No content preview  ( 6 min )
    Technical Advisory – SonicWall SMA 100 Series – Unauthenticated File Upload Path Traversal (CVE-2021-20040)
    No content preview
    Technical Advisory – SonicWall SMA 100 Series – Unauthenticated Arbitrary File Deletion
    No content preview
    Technical Advisory: Adobe ColdFusion Object Deserialisation RCE
    No content preview
    Technical advisory: “ROHNP”- key extraction side channel in multiple crypto libraries
    No content preview
    Technical Advisory: Citrix Workspace / Receiver Remote Code Execution Vulnerability
    No content preview
    Technical Advisory: Authentication Bypass in libSSH
    No content preview
    Technical Advisory: Insufficient Proxyman HelperTool XPC Validation
    No content preview
    Technical Advisory: Dell SupportAssist Local Privilege Escalation (CVE-2021-21518)
    No content preview
    Technical Advisory: Multiple Vulnerabilities in HP Printers
    No content preview
    Technical Advisory: Mosquitto Broker DoS through a Memory Leak vulnerability
    No content preview
    Technical Advisory: Intel Driver Support & Assistance – Local Privilege Escalation
    No content preview
    Technical Advisory: OS Command Injection in Silver Peak EdgeConnect Appliances (CVE-2020-12148, CVE-2020-12149)
    No content preview
    Technical Advisory: Nexpose Hard‐coded Java Key Store Passphrase Allows Decryption of Stored Credentials
    No content preview
    Technical Advisory: Reflected Cross-Site Scripting (XSS) vulnerability in Jenkins Delivery Pipeline plugin
    No content preview
    Technical Advisory: Pulse Connect Secure – RCE via Uncontrolled Archive Extraction – CVE-2021-22937 (Patch Bypass)
    No content preview
    Technical Advisory: Unauthenticated SQL Injection in Lansweeper
    No content preview
    Technical Advisory: SMB Hash Hijacking and User Tracking in MS Outlook
    No content preview
    The Case of Missing File Extensions
    No content preview
    The Automotive Threat Modeling Template
    No content preview
    Testing HTTP/2 only web services
    No content preview
    The death of USB autorun and the rise of the USB keyboard
    No content preview
    The Challenges of Fuzzing 5G Protocols
    No content preview
    The Extended AWS Security Ramp-Up Guide
    No content preview
    The disadvantages of a blacklist-based approach to input validation
    No content preview
    The Password is Dead, Long Live the Password!
    No content preview
    The Paillier Cryptosystem with Applications to Threshold ECDSA
    No content preview
    The L4m3ne55 of Passw0rds: Notes from the field
    No content preview
    The Phishing Guide: Understanding & Preventing Phishing Attacks
    No content preview
    The Pentesters Guide to Akamai
    No content preview
    The Sorry State of Aftermarket Head Unit Security
    No content preview
    The role of security research in improving cyber security
    No content preview
    There’s A Hole In Your SoC: Glitching The MediaTek BootROM
    No content preview
    The Update Framework (TUF) Security Assessment
    No content preview
    The SSL Conservatory
    No content preview
    Threat Intelligence: Benefits for the Enterprise
    No content preview
    Third party assurance
    No content preview
    Tis the Season to Be…
    No content preview
    Threat Spotlight – Hydra
    No content preview
    Threat Profiling Microsoft SQL Server
    No content preview
    To dock or not to dock, that is the question: Using laptop docking stations as hardware-based attack platforms
    No content preview
    Tool Release – ICPin, an integrity-check and anti-debug detection pintool
    No content preview
    Tool Release – Collaborator++
    No content preview
    Tool Release – Monkey365
    No content preview
    Tool Release – HTTPSignatures: A Burp Suite Extension Implementing HTTP Signatures
    No content preview
    Tool Release – Web3 Decoder Burp Suite Extension
    No content preview
    Tool Release – Project Kubescout: Adding Kubernetes Support to Scout Suite
    No content preview
    Tool Release – JWT-Reauth
    No content preview
    Tool Release – Solitude: A privacy analysis tool
    No content preview
    Tool Release: Announcing the Release of RtspFuzzer
    No content preview
    Tool Release – Socks Over RDP Now Works With Citrix
    No content preview
    Tool Release: Code Credential Scanner (ccs)
    No content preview
    Tool Release: Calculating SQL Permissions
    No content preview
    Tool Release: Exploring SSL Pinning on iOS
    No content preview
    Tool Release: Code Query (cq)
    No content preview
    Tool Release: Redirecting traffic with dnsRedir.py
    No content preview
    Tool Release: PeachFarmer
    No content preview
    Tool Release: Introducing opinel: Scout2’s favorite tool
    No content preview
    Tool Release: tcpprox
    No content preview
    Tool Release: SSL pinning bypass and other Android tools
    No content preview
    Tool: WStalker – an easy proxy to support Web API assessments
    No content preview
    Tool Release: You’ll Never (Ever) Take Me Alive!
    No content preview
    Trust in the Internet Survey
    No content preview
    UK government cyber security guidelines for connected & autonomous vehicles
    No content preview
    U plug, we play
    No content preview
    typofinder
    No content preview
    Understanding and Hardening Linux Containers
    No content preview
    umap
    No content preview
    Understanding the Impact of Ransomware on Patient Outcomes – Do We Know Enough?
    No content preview
    Understanding Ransomware
    No content preview
    Understanding the root cause of F5 Networks K52145254: TMUI RCE vulnerability CVE-2020-5902
    No content preview
    Unveiling the Dark Side: A Deep Dive into Active Ransomware Families
    No content preview
    Unmasking Lorenz Ransomware: A Dive into Recent Tactics, Techniques and Procedures
    No content preview
    USB under the bonnet: Implications of USB security vulnerabilities in vehicle systems
    No content preview
    USB keyboards by post – use of embedded keystroke injectors to bypass autorun restrictions on modern desktop operating systems
    No content preview
    Using Semgrep with Jupyter Notebook files
    No content preview
    Use of Deserialisation in .NET Framework Methods and Classes
    No content preview
    Secure Application Development on Facebook
    No content preview  ( 6 min )
    LeaPFRogging PFR Implementations
    No content preview  ( 12 min )
    McAfee Email and Web Security Appliance Any logged-in user can bypass controls to reset passwords of other administrators
    No content preview  ( 6 min )
    Oracle Forensics Part 3: Isolating Evidence of Attacks Against the Authentication Mechanism
    No content preview  ( 6 min )
    NCC Group’s Juan Garrido named to Microsoft’s MSRC Office Security Researcher Leaderboard
    No content preview  ( 6 min )
    Research Insights Volume 3 – How are we breaking in: Mobile Security
    No content preview  ( 6 min )
    Security Considerations of zk-SNARK Parameter Multi-Party Computation
    No content preview  ( 16 min )
    Comparing AI Against Traditional Static Analysis Tools to Highlight Buffer Overflows
    No content preview  ( 11 min )
    Self-Driving Cars- The future is now…
    No content preview  ( 6 min )
    Insomnihack - Pioneering Zero Days at Pwn2Own Automotive 2024
    No content preview  ( 7 min )
    Analyzing Secure AI Design Principles
    No content preview  ( 16 min )
    PeachFarmer
    No content preview  ( 6 min )
    Latest threats to the connected car & intelligent transport ecosystem
    No content preview  ( 6 min )
    NSA & CISA Kubernetes Security Guidance – A Critical Review
    No content preview  ( 15 min )
    Microsoft Internet Explorer CMarkup Use-After-Free
    No content preview  ( 6 min )
    Lessons learned from 50 USB bugs
    No content preview  ( 6 min )
    Jackson Deserialization Vulnerabilities
    No content preview  ( 6 min )
    Launching the first in our series of Research Insights
    No content preview  ( 7 min )
    Machine Learning 104: Breaking AES With Power Side-Channels
    No content preview  ( 6 min )
    Kerberos Resource-Based Constrained Delegation: When an Image Change Leads to a Privilege Escalation
    No content preview  ( 10 min )
    Managing PowerShell in a modern corporate environment
    No content preview  ( 6 min )
    Nerve
    No content preview  ( 6 min )
    McAfee Email and Web Security Appliance v5.6 – Password hashes can be recovered from a system backup and easily cracked
    No content preview  ( 7 min )
    Microsoft’s SQL Server vs. Oracle’s RDBMS
    No content preview  ( 6 min )
    Optimizing Pairing-Based Cryptography: Montgomery Arithmetic in Rust
    No content preview  ( 20 min )
    RIFT: Detection capabilities for recent F5 BIG-IP/BIG-IQ iControl REST API vulnerabilities CVE-2021-22986
    No content preview  ( 11 min )
    Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 4: Architecture and Design
    No content preview  ( 13 min )
    ISM RAT
    No content preview  ( 10 min )
    Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 3: Understanding Existing Approaches and Attempts
    No content preview  ( 17 min )
    Replicating CVEs with KLEE
    No content preview  ( 10 min )
    Public Report – Confidential Space Security Review
    No content preview  ( 6 min )
    Oracle Java Installer Adds a System Path Which is Writable by All
    No content preview  ( 6 min )
    10 real-world stories of how we’ve compromised CI/CD pipelines
    No content preview
    A Back-to-Front TrueCrypt Recovery Story: The Plaintext is the Ciphertext
    No content preview
    5G security – how to minimise the threats to a 5G network
    No content preview
    44Con2013Game
    No content preview
    44CON Workshop – How to assess and secure iOS apps
    No content preview
    A Guide to Improving Security Through Infrastructure-as-Code
    No content preview
    A few notes on usefully exploiting libstagefright on Android 5.x
    No content preview
    A brief look at Windows telemetry: CIT aka Customer Interaction Tracker
    No content preview
    A Simple and Practical Approach to Input Validation
    No content preview
    A Peek Behind the Great Firewall of Russia
    No content preview
    A New Flying Kitten?
    No content preview
    A jq255 Elliptic Curve Specification, and a Retrospective
    No content preview
    Abusing Privileged and Unprivileged Linux Containers
    No content preview
    Abusing Blu-ray Players Part 1 – Sandbox Escapes
    No content preview
    A Survey of Istio’s Network Security Features
    No content preview
    Adobe flash sandbox bypass to navigate to local drives
    No content preview
    Adobe Flash Player Cross Domain Policy Bypass
    No content preview
    Adobe Acrobat Reader XML Forms Data Format Buffer Overflow
    No content preview
    Accessing Private Fields Outside of Classes in Java
    No content preview
    Adventures in Xen Exploitation
    No content preview
    Advanced SQL Injection in SQL Server Applications
    No content preview
    Advanced Exploitation of Oracle PL/SQL Flaws
    No content preview
    Alternative Approaches for Fault Injection Countermeasures (Part 3/3)
    No content preview
    Advisory-CraigSBlackie-CVE-2016-9795
    No content preview
    Advice for security decision makers contemplating the value of Antivirus
    No content preview
    Adversarial Machine Learning: Approaches & defences
    No content preview
    An adventure in PoEKmon NeutriGo land
    No content preview
    An Adventure in Contingency Debugging: Ruby IO#read/IO#write Considered Harmful
    No content preview
    An Adaptive-Ciphertext Attack Against “I ⊕ C” Block Cipher Modes With an Oracle
    No content preview
    An Introduction to Heap overflows on AIX 5.3L
    No content preview
    An Introduction to Fault Injection (Part 1/3)
    No content preview
    An Illustrated Guide to Elliptic Curve Cryptography Validation
    No content preview
    An Analysis of Mobile Geofencing App Security
    No content preview
    Analysing a recent Poison Ivy sample
    No content preview
    An offensive guide to the Authorization Code grant
    No content preview
    An Introduction to Ultrasound Security Research
    No content preview
    An Introduction to Quantum Computing for Security Professionals
    No content preview
    Android Cloud Backup/Restore
    No content preview
    Analysis of the Linux backdoor used in freenode IRC network compromise
    No content preview
    Analysis of Boomerang Differential Trials via a SAT-Based Constraint Solver URSA
    No content preview
    Announcing NCC Group’s Cryptopals Guided Tour: Set 2
    No content preview
    Android-OpenDebug
    No content preview
    Android SSL Bypass
    No content preview
    Apple CoreAnimation Heap Overflow
    No content preview
    Apache Struts Vulnerability
    No content preview
    Anti Brute Force Resource Metering
    No content preview
    Announcing the AWS blog post series
    No content preview
    Apple QuickTime Player m4a Processing Buffer Overflow
    No content preview
    Apple OSX/iPhone iOS ImageIO TIFF getBandProcTIFF TileWidth Heap Overflow
    No content preview
    Apple Mac OS X ImageIO TIFF Integer Overflow
    No content preview
    APT15 is Alive and Strong: An Analysis of RoyalCli and RoyalDNS
    No content preview
    Approximately 2000 Citrix NetScalers backdoored in mass-exploitation campaign
    No content preview
    Applying normalised compression distance for architecture classification
    No content preview
    Application Layer Attacks – The New DDoS Battleground
    No content preview
    ASE 12.5.1 datatype overflow
    No content preview
    Are you oversharing (in Salesforce)? Our new tool could sniff it out!
    No content preview
    Archived Technical Advisories
    No content preview
    Assessing the security and privacy of Vaccine Passports
    No content preview
    Assessing IIS Configuration Remotely
    No content preview
    ASP.NET Security and the Importance of KB2698981 in Cloud Environments Threat Brief
    No content preview
    ASP.NET Security and the Importance of KB2698981 in Cloud Environments
    No content preview
    Assuring Your DDoS Defences
    No content preview
    AssetHook
    No content preview
    Assessing Unikernel Security
    No content preview
    Attacks on SSL
    No content preview
    Attacking Web Service Security: Message Oriented Madness, XML Worms and Web Service Security Sanity
    No content preview
    Attacking the Windows Kernel (Black Hat Las Vegas 2007)
    No content preview
    AtHoc Toolbar
    No content preview
    Automated Reverse Engineering of Relationships Between Data Structures in C++ Binaries
    No content preview
    Automated enumeration of email filtering solutions
    No content preview
    Authorisation
    No content preview
    Azucar
    No content preview
    AWS environment security assessment with Scout2
    No content preview
    AutoRepeater: Automated HTTP Request Repeating With Burp Suite
    No content preview
    Automating extraction from malware and recent campaign analysis
    No content preview
    Batten down the hatches: Cyber threats facing DP operations
    No content preview
    BAT: a Fast and Small Key Encapsulation Mechanism
    No content preview
    Back Office Web Administration Authentication Bypass
    No content preview
    Beyond data loss prevention
    No content preview
    Best practices with BYOD
    No content preview
    Best Practices for the use of Static Code Analysis within a Real-World Secure Development Lifecycle
    No content preview
    Berserko: Kerberos Authentication for Burp Suite
    No content preview
    Black Hat 2013 – Cryptopocalypse Presentation Available
    No content preview
    Black Hat 2013 – Bluetooth Smart Presentation Available
    No content preview
    Bit51 Better Security WP Security Plugin – Unauthenticated Stored XSS to RCE
    No content preview
    BlackBerry PlayBook Security – Part One
    No content preview
    BlackBerry Link WebDav Server Bound to the BlackBerry VPN Adapter
    No content preview
    Black Hat USA 2015 presentation: Broadcasting your attack-DAB security
    No content preview
    Black Hat Europe 2013 Andy Davis: To dock or not to dock…
    No content preview
    BlackHat Asia USB Physical Access
    No content preview
    Blackbox iOS App Assessments Using idb
    No content preview
    BlackBerry PlayBook Security – Part Two – BlackBerry Bridge
    No content preview
    Breaking Pedersen Hashes in Practice
    No content preview
    Breaking into Security Research at NCC Group
    No content preview
    Blind Security Testing – An Evolutionary Approach
    No content preview
    Blind Return Oriented Programming
    No content preview
    Buffer Underruns, DEP, ASLR and improving the Exploitation Prevention Mechanisms (XPMs) on the Windows platform
    No content preview
    Browser Extension Password Managers
    No content preview
    Broadcasting your attack – DAB security
    No content preview
    Building Intuition for Lattice-Based Signatures – Part 1: Trapdoor Signatures
    No content preview
    Building an RDP Credential Catcher for Threat Intelligence
    No content preview
    Build Your Own Wi-Fi Mapping Drone Capability
    No content preview
    Business Insights: Cyber Security in the Financial Sector
    No content preview
    Building WiMap the Wi-Fi Mapping Drone
    No content preview
    Building Security In: Software Penetration Testing
    No content preview
    Building Intuition for Lattice-Based Signatures – Part 2: Fiat-Shamir with Aborts
    No content preview
    C Language Standards Update – Zero-size Reallocations are Undefined Behavior
    No content preview
    Bypassing Oracle DBMS_ASSERT (in certain situations)
    No content preview
    Bypassing Android’s Network Security Configuration
    No content preview
    CertPortal: Building Self-Service Secure S/MIME Provisioning Portal
    No content preview
    Celebrating NCC Con Europe 2018
    No content preview
    CECSTeR
    No content preview
    Call Map: A Tool for Navigating Call Graphs in Python
    No content preview
    Chrome Password Manager Cross Origin Weakness
    No content preview
    Choosing the Right MCU for Your Embedded Device — Desired Security Features of Microcontrollers
    No content preview
    Chafer backdoor analysis
    No content preview
    Cisco ASA series part six: Cisco ASA mempools
    No content preview
    Cisco ASA series part four: dlmalloc-2.8.x, libdlmalloc, & dlmalloc on Cisco ASA
    No content preview
    Cisco ASA series part five: libptmalloc gdb plugin
    No content preview
    Cisco ASA series part eight: Exploiting the CVE-2016-1287 heap overflow over IKEv1
    No content preview
    Cisco ASA series part three: Debugging Cisco ASA firmware
    No content preview
    Cisco ASA series part seven: Checkheaps
    No content preview
    Cisco ASA series part one: Intro to the Cisco ASA
    No content preview
    cisco-SNMP-enumeration
    No content preview
    Cisco VPN Client Privilege Escalation
    No content preview
    Cisco IPSec VPN Implementation Group Name Enumeration
    No content preview
    Cisco ASA series part two: Static analysis & datamining of Cisco ASA firmware
    No content preview
    Cloud Security Presentation
    No content preview
    Climbing Mount Everest: Black-Byte Bytes Back?
    No content preview
    Cleaning Up After Cookies
    No content preview
    Code Patterns for API Authorization: Designing for Security
    No content preview
    CMakerer: A small tool to aid CLion’s indexing
    No content preview
    CloudWatch: Amazon Web Services & Shellshock
    No content preview
    Common Insecure Practices with Configuring and Extending Salesforce
    No content preview
    Common Flaws of Distributed Identity and Authentication Systems
    No content preview
    Command Injection in XML Signatures and Encryption
    No content preview
    Combating Java Deserialisation Vulnerabilities with Look-Ahead Object Input Streams (LAOIS)
    No content preview
    Conference Talks – August 2020
    No content preview
    Compromising Apache Tomcat via JMX access
    No content preview
    Compromising a Hospital Network for £118 (Plus Postage & Packaging)
    No content preview
    Common Security Issues in Financially-Oriented Web Applications
    No content preview
    Conference Talks – February/March 2021
    No content preview
    Conference Talks – February 2020
    No content preview
    Conference Talks – December 2020
    No content preview
    Conference Talks – November 2020
    No content preview
    Conference Talks – May 2021
    No content preview
    Conference Talks – June 2022
    No content preview
    Conference Talks – January 2020
    No content preview
    Conference Talks – September/October 2022
    No content preview
    Conference Talks – September 2020
    No content preview
    Conference Talks – October 2020
    No content preview
    Conference Talks – November 2021
    No content preview
    Conference Talks – March 2022
    No content preview
    Conference Talks – June 2021
    No content preview
    Conference Talks – December 2021
    No content preview
    Content Security Policies Best Practices
    No content preview
    Content Security Policies and Popular CMS Systems
    No content preview
    Conference Talks – October 2021
    No content preview
    Cracking RDP NLA Supplied Credentials for Threat Intelligence
    No content preview
    Cracking Random Number Generators using Machine Learning – Part 2: Mersenne Twister
    No content preview
    Cracking Random Number Generators using Machine Learning – Part 1: xorshift128
    No content preview
    CowCloud
    No content preview
    Creating Arbitrary Shellcode In Unicode Expanded Strings
    No content preview
    Creating a Safer OAuth User Experience
    No content preview
    Crave the Data: Statistics from 1,300 Phishing Campaigns
    No content preview
    Cranim: A Toolkit for Cryptographic Visualization
    No content preview
    Critical Risk Vulnerability in SAP Message Server (Heap Overflow)
    No content preview
    Critical Risk Vulnerability in SAP DB Web Server (Stack Overflow)
    No content preview
    Critical Risk Vulnerability in Ingres (Pointer Overwrite 1)
    No content preview
    Curve9767 and Fast Signature Verification
    No content preview
    Cups-filters remote code execution
    No content preview
    Cross Site Request Forgery: An Introduction to a Common Web Application Weakness
    No content preview
    Cyber red-teaming business-critical systems while managing operational risk
    No content preview
    CVE-2019-1405 and CVE-2019-1322 – Elevation to SYSTEM via the UPnP Device Host Service and the Update Orchestrator Service
    No content preview
    CVE-2018-8611 – Diving into the Windows Kernel Transaction Manager (KTM) for fun and exploitation
    No content preview
    CVE-2017-8570 RTF and the Sisfader RAT
    No content preview
    Cyber Security of New Space Paper
    No content preview
    Cyber Security in UK Agriculture
    No content preview
    Cyber Essentials Scheme
    No content preview
    D0nut encrypt me, I have a wife and no backups
    No content preview
    D-Link routers vulnerable to Remote Code Execution (RCE)
    No content preview
    D-LINK DIR-850L web admin interface vulnerable to stack-based buffer overflow
    No content preview
    CyberVillainsCA
    No content preview
    Data-mining with SQL Injection and Inference
    No content preview
    DARPA OnStar Vulnerability Analysis
    No content preview
    Dangling Cursor Snarfing: A New Class of Attack in Oracle
    No content preview
    Dancing Offbit: The Story of a Single Character Typo that Broke a ChaCha-Based PRNG
    No content preview
    Database Security: A Christmas Carol
    No content preview
    Database Security Brief: The Oracle Critical Patch Update for April 2007
    No content preview
    DataArmor Full Disk Encryption 3.0.12c – Restricted Environment breakout, Privilege Escalation and Full Disk Decryption
    No content preview
    Decoder Improved Burp Suite Plugin
    No content preview
    Deception Engineering: exploring the use of Windows Installer Packages against first stage payloads
    No content preview
    DDoS Common Approaches and Failings
    No content preview
    Database Servers on Windows XP and the unintended consequences of simple file sharing
    No content preview
    Decrypting OpenSSH sessions for fun and profit
    No content preview
    Decoding network data from a Gh0st RAT variant
    No content preview
    Decoder Improved Burp Suite plugin release part one
    No content preview
    Demystifying AWS’ AssumeRole and sts:ExternalId
    No content preview
    Defeating the Stack Based Buffer Overflow Prevention Mechanism of Microsoft Windows 2003 Server
    No content preview
    Deep Dive into Real-World Kubernetes Threats
    No content preview
    DECTbeacon
    No content preview
    Detecting anomalous Vectored Exception Handlers on Windows
    No content preview
    Derusbi: A Case Study in Rapid Capability Development
    No content preview
    Denial of Service in Parsing a URL by ierutil.dll
    No content preview
    Demystifying Multivariate Cryptography
    No content preview
    Detection Engineering for Kubernetes clusters
    No content preview
    Detecting Rclone – An Effective Tool for Exfiltration
    No content preview
    Detecting Karakurt – an extortion focused threat actor
    No content preview
    Dissecting social engineering attacks
    No content preview
    Disclosure Policy
    No content preview
    DIBF – Updated
    No content preview
    Does TypeScript Offer Security Improvements Over JavaScript?
    No content preview
    Do not use your AWS root account
    No content preview
    DNS Pinning and Web Proxies
    No content preview
    Distributed Ledger (Blockchain) Security and Quantum Computing Implications
    No content preview
    dotnetpefuzzing
    No content preview
    dotnetpaddingoracle
    No content preview
    Don’t throw a hissy fit; defend against Medusa
    No content preview
    Domestic IoT Nightmares: Smart Doorbells
    No content preview
    Drupal Vulnerability
    No content preview
    Drones: Detect, Identify, Intercept, and Hijack
    No content preview
    Double-odd Elliptic Curves
    No content preview
    EasyDA – Easy Windows Domain Access Script
    No content preview
    Early CCS Attack Analysis
    No content preview
    E-mail Spoofing and CDONTS.NEWMAIL
    No content preview
    Dynamic Linq Injection Remote Code Execution Vulnerability (CVE-2023-32571)
    No content preview
    EDIDFuzzer
    No content preview
    eBook – Planning a robust incident response process
    No content preview
    eBook – Do you know how your organisation would react in a real-world attack scenario?
    No content preview
    Emissary Panda – A potential new malicious tool
    No content preview
    Embedded Device Security Certifications
    No content preview
    Elephant in the Boardroom Survey 2016
    No content preview
    Enumerating System Management Interrupts
    No content preview
    End-of-life pragmatism
    No content preview
    Encryption Does Not Equal Invisibility – Detecting Anomalous TLS Certificates with the Half-Space-Trees Algorithm
    No content preview
    Encryption at rest: Not the panacea to data protection
    No content preview
    Eurocrypt 2023: Death of a KEM
    No content preview
    EternalGlue part one: Rebuilding NotPetya to assess real-world resilience
    No content preview
    Erlang Security 101
    No content preview
    Enterprise-scale seamless onboarding and deployment of Azure Sentinel using Lighthouse for multi-tenant environments
    No content preview
    Exploit the Fuzz – Exploiting Vulnerabilities in 5G Core Networks
    No content preview
    Exploit mitigations: keeping up with evolving and complex software/hardware
    No content preview
    Exception Handling and Data Integrity in Salesforce
    No content preview
    Exploiting PL/SQL Injection Flaws with only CREATE SESSION Privileges
    No content preview
    Exploiting Noisy Oracles with Bayesian Inference
    No content preview
    Exploiting CVE-2015-2426, and How I Ported it to a Recent Windows 8.1 64-bit
    No content preview
    Exploiting CVE-2014-0282 (1)
    No content preview
    Exploiting the win32k!xxxEnableWndSBArrows use-after-free (CVE-2015-0057) bug on both 32-bit and 64-bit
    No content preview
    Exploiting Security Gateways Via Web Interfaces
    No content preview
    Exploiting Rich Content
    No content preview
    Exploring Overfitting Risks in Large Language Models
    No content preview
    Exploring macOS Calendar Alerts: Part 2 – Exfiltrating data (CVE-2020-3882)
    No content preview
    Exploring macOS Calendar Alerts: Part 1 – Attempting to execute code
    No content preview
    Exploring DeepFake Capabilities & Mitigation Strategies with University College London
    No content preview
    Exporting non-exportable RSA keys
    No content preview
    Exploring Verifiable Random Functions in Code
    No content preview
    Exploring the Security & Privacy of Canada’s Digital Proof of Vaccination Programs
    No content preview
    Extending a Thinkst Canary to become an interactive honeypot
    No content preview
    External Enumeration and Exploitation of Email and Web Security Solutions
    No content preview
    Finding the weak link in binaries
    No content preview
    Faux Disk Encryption: Realities of Secure Storage On Mobile Devices
    No content preview
    Fat-Finger
    No content preview
    Extractor
    No content preview
    Fix Bounty
    No content preview
    Five Essential Machine Learning Security Papers
    No content preview
    firstexecution
    No content preview
    From CSV to CMD to qwerty
    No content preview
    Freddy: An extension for automatically identifying deserialisation issues in Java and .NET applications
    No content preview
    FPGAs: Security Through Obscurity?
    No content preview
    Flash security restrictions bypass: File upload by URLRequest
    No content preview
    Fuzzing the Easy Way Using Zulu
    No content preview
    Fuzzing RTSP to discover an exploitable vulnerability in VLC
    No content preview
    From ERMAC to Hook: Investigating the technical differences between two Android malware variants
    No content preview
    Game Security
    No content preview
    G-Scout
    No content preview
    Fuzzing USB devices using Frisbee Lite
    No content preview
    Fuzzing the Easy Way Using Zulu (1)
    No content preview
    Getting per-user Conditional Access MFA status in Azure
    No content preview
    General Data Protection Regulation: Knowing your data
    No content preview
    General Data Protection Regulation – are you ready?
    No content preview
    Gizmo
    No content preview
    Ghost Vulnerability (CVE-2015-0235)
    No content preview
    Ghidra nanoMIPS ISA module
    No content preview
    Getting Shell with XAMLX Files
    No content preview
    Hacking a web application
    No content preview
    Grepify – a Small Tool for Code Reviewers
    No content preview
    Going “AUTH the Rails” on a Crazy Train
    No content preview
    Hackproofing MySQL
    No content preview
    Hacking the Extensible Firmware Interface
    No content preview
    Hacking Displays Made Interesting
    No content preview
    Hacking Appliances: Ironic exploits in security products
    No content preview
    HDMI Ethernet Channel
    No content preview
    Harnessing GPUs Building Better Browser Based Botnets
    No content preview
    Hardware & Embedded Systems: A little early effort in security can return a huge payoff
    No content preview
    Hackproofing Oracle Application Server
    No content preview
    Hiccupy
    No content preview
    Heartbleed OpenSSL vulnerability
    No content preview
    Heartbleed (CVE-2014-0160) Advisory
    No content preview
    HDMI – Hacking Displays Made Interesting
    No content preview
    How cryptography is used to monitor the spread of COVID-19
    No content preview
    hostresolver
    No content preview
    HIDDEN COBRA Volgmer: A Technical Analysis
    No content preview
    How To Spot a Penetration Tester in Your Network (and Catch the Real Bad Guys at the Same Time)
    No content preview
    How to protect yourself & your organisation from phishing attacks
    No content preview
    How to Backdoor Diffie-Hellman
    No content preview
    How much training should staff have on cyber security?
    No content preview
    How-to: Importing WStalker CSV (and more) into Burp Suite via Import to Sitemap Extension
    No content preview
    How will GDPR impact your communications?
    No content preview
    How we breach network infrastructures and protect them
    No content preview
    How to Spot and Prevent an Eclipse Attack
    No content preview
    IAM user management strategy (part 2)
    No content preview
    IAM user management strategy
    No content preview
    Hunting SQL Injection Bugs
    No content preview
    HTTP Profiler
    No content preview
    Impact of DNS over HTTPS (DoH) on DNS Rebinding Attacks
    No content preview
    Immunity Debugger Buffer Overflow
    No content preview
    ICS/OT Security & the evolution of the Purdue Model: Integrating Industrial and Business Networks
    No content preview
    Improving your Network and Application Assurance Strategy in an environment of increasing 0day vulnerabilities
    No content preview
    Impress Pages CMS Remote Code Execution
    No content preview
    Implementing the Castryck-Decru SIDH Key Recovery Attack in SageMath
    No content preview
    Implementing and Detecting a PCI Rootkit
    No content preview
    Integrity destroying malicious code for financial or geopolitical gain: A vision of the future?
    No content preview
    Integrating DigitalOcean into ScoutSuite
    No content preview
    Incremental Machine Learning by Example: Detecting Suspicious Activity with Zeek Data Streams, River, and JA3 Hashes
    No content preview
    In-depth analysis of the new Team9 malware family
    No content preview
    Introducing Azucar
    No content preview
    Internet of Things Security
    No content preview
    Inter-Protocol Communication
    No content preview
    Intent Sniffer
    No content preview
    Introduction to Anti-Fuzzing: A Defence in Depth Aid
    No content preview
    Introducing idb-Simplified Blackbox iOS App Pentesting
    No content preview
    Introducing Chuckle and the Importance of SMB Signing
    No content preview
    creep-web-app-scanner
    No content preview
    Shocker
    No content preview
    Shining New Light on an Old ROM Vulnerability: Secure Boot Bypass via DCD and CSF Tampering on NXP i.MX Devices
    No content preview
    Shellshock Bash Vulnerability
    No content preview
    Shellshock Advisory
    No content preview
    Singularity of Origin
    No content preview
    Signaturing an Authenticode anomaly with Yara
    No content preview
    Sign over Your Hashes – Stealing NetNTLM Hashes via Outlook Signatures
    No content preview
    SIAM AG23: Algebraic Geometry with Friends
    No content preview
    Smuggling HTA files in Internet Explorer/Edge
    No content preview
    Smart Contracts Inside SGX Enclaves: Common Security Bug Patterns
    No content preview
    SMACK, SKIP-TLS & FREAK SSL/TLS Vulnerabilities
    No content preview
    Slotting Security into Corporate Development
    No content preview
    Sobelow Update
    No content preview
    So long and thanks for all the 0day
    No content preview
    Sniffle: A Sniffer for Bluetooth 5
    No content preview
    SmarterMail – Stored XSS in emails
    No content preview
    Social Engineering
    No content preview
    SOC maturity & capability
    No content preview
    Sobelow: Static analysis for the Phoenix Framework
    No content preview
    Solaris 11 USB hubclass
    No content preview
    Solaris 11 USB Hub Class descriptor kernel stack overflow
    No content preview
    Software-Based Fault Injection Countermeasures (Part 2/3)
    No content preview
    Software Security Austerity Security Debt in Modern Software Development
    No content preview
    Spectre on a Television
    No content preview
    Spectre and Meltdown: What you Need to Know
    No content preview
    Some Notes About the Xen XSA-122 Bug
    No content preview
    Some Musings on Common (eBPF) Linux Tracing Bugs
    No content preview
    SSLyze v0.7 Released
    No content preview
    SSL checklist for pentesters
    No content preview
    Squiz CMS File Path Traversal
    No content preview
    Spy-Pi: Do you trust your laptop docking stations?
    No content preview
    Story of a Hundred Vulnerable Jenkins Plugins
    No content preview
    Stopping Automated Attack Tools
    No content preview
    State-of-the-art email risk
    No content preview
    SSLyze v0.8
    No content preview
    Symantec Backup Exec 2012 – Backup Exec Utility Stored XSS when adding Groups, Servers and Computers
    No content preview
    Supply Chain Security Begins with Secure Software Development
    No content preview
    Striking Back at Retired Cobalt Strike: A look at a legacy vulnerability
    No content preview
    StreamDivert: Relaying (specific) network connections
    No content preview
    Symantec Backup Exec 2012 Backup/Restore Data Traverses Memory with Weak ACLs
    No content preview
    Symantec Backup Exec 2012 – Persistent XSS Vulnerability Affecting Custom Reports
    No content preview
    Symantec Backup Exec 2012 – OS version and service pack information leak
    No content preview
    Symantec Backup Exec 2012 – Linux Backup Agent Heap Overflow
    No content preview
    Symantec Messaging Gateway – Out of band stored XSS via email
    No content preview
    Symantec Message Filter Unauthenticated verbose software version information disclosure
    No content preview
    Symantec Message Filter Session Hijacking via session
    No content preview
    Symantec Messaging Gateway – Unauthorised SSH access
    No content preview
    Symantec Messaging Gateway – Unauthenticated detailed version disclosure
    No content preview
    Symantec Messaging Gateway – Authenticated arbritary file download
    No content preview
    Symantec Messaging Gateway – Addition of a backdoor adminstrator via CSRF
    No content preview
    Symantec PC Anywhere Remote Code Extecution
    No content preview
    Symantec Messaging Gateway Out of band stored XSS delivered by email
    No content preview
    Symantec Messaging Gateway Easy CSRF to add a backdoor-administrator (for example)
    No content preview
    Symantec Messaging Gateway Arbitrary file download is possible with a crafted URL (authenticated)
    No content preview
    SysAid Helpdesk Pro – Blind SQL Injection
    No content preview
    SysAid Helpdesk blind SQL injection
    No content preview
    Symantec Messaging Gateway SSH with backdoor user account + privilege escalation to root due to very old Kernel
    No content preview
    TA505 exploits SolarWinds Serv-U vulnerability (CVE-2021-35211) for initial access
    No content preview
    SysPWN – VR for Pwn2Own
    No content preview
    Sysinternals SDelete: When Secure Delete Fails
    No content preview
    SysAid Helpdesk stored XSS
    No content preview
    TANDBERG Video Communication Server Static SSH Host Keys
    No content preview
    TANDBERG Video Communication Server Arbitrary File Retrieval
    No content preview
    Tales of Windows detection opportunities for an implant framework
    No content preview
    TA505: A Brief History Of Their Time
    No content preview
    Technical Advisory – Apple iOS / OSX: Foundation NSXMLParser XXE Vulnerability
    No content preview
    Technical Advisory – Apple HFS+ Information Disclosure Vulnerability
    No content preview
    tcpprox
    No content preview
    TANDBERG Video Communication Server Authentication Bypass
    No content preview
    Technical Advisory – Arbitrary Signature Forgery in Stark Bank ECDSA Libraries (CVE-2021-43572, CVE-2021-43570, CVE-2021-43569, CVE-2021-43568, CVE-2021-43571)
    No content preview
    Technical Advisory – Arbitrary File Read in Dell Wyse Management Suite (CVE-2021-21586, CVE-2021-21587)
    No content preview
    Technical Advisory – Apple XAR – Arbitrary File Write (CVE-2021-30833)
    No content preview
    Technical Advisory – BLE Proximity Authentication Vulnerable to Relay Attacks
    No content preview
    Technical Advisory – Authorization Bypass Allows for Pinboard Corruption
    No content preview
    Technical Advisory – Authenticated SQL Injection in SOAP Request in Broadcom CA Network Flow Analysis (CVE-2021-44050)
    No content preview
    Technical Advisory – ARM MbedOS USB Mass Storage Driver Memory Corruption
    No content preview
    Technical Advisory – DelTek Vision – Arbitrary SQL Execution (SQLi)
    No content preview
    Technical Advisory – Coda Filesystem Kernel Memory Disclosure
    No content preview
    Technical Advisory – Citrix Access Gateway Command Injection Vulnerability
    No content preview
    Technical Advisory – Bomgar Remote Support – Local Privilege Escalation
    No content preview
    Technical Advisory – Garuda Linux Insecure User Creation (CVE-2021-3784)
    No content preview
    Technical Advisory – FUJITSU CentricStor Control Center <= V8.1 – Unauthenticated Command Injection ( CVE-2022-31794 and CVE-2022-31795)
    No content preview
    Technical Advisory – FreePBX – Multiple Authenticated SQL Injections in UCP application
    No content preview
    Technical Advisory – ExpressLRS vulnerabilities allow for hijack of control link
    No content preview
    Technical Advisory – IBM WebSphere Commerce: Encrypted URL Parameter Vulnerable to Padding Oracle Attacks
    No content preview
    Technical Advisory – IBM TAM: Remote Directory Traversal and File Retrieval via web server plug-in
    No content preview
    Technical Advisory – HTC IQRD Android Permission Leakage
    No content preview
    Technical Advisory – libraptor – XXE in RDF/XML File Interpretation
    No content preview
    Technical Advisory – Lenovo ImController Local Privilege Escalation (CVE-2021-3922, CVE-2021-3969)
    No content preview
    Technical Advisory – KwikTag Web Admin Authentication Bypass
    No content preview
    Technical Advisory – Kwikset/Weiser BLE Proximity Authentication in Kevo Smart Locks Vulnerable to Relay Attacks
    No content preview
    Technical Advisory – Multiple Vulnerabilities in U-Boot (CVE-2022-30790, CVE-2022-30552)
    No content preview
    Technical Advisory – Multiple vulnerabilities in Nuki smart locks (CVE-2022-32509, CVE-2022-32504, CVE-2022-32502, CVE-2022-32507, CVE-2022-32503, CVE-2022-32510, CVE-2022-32506, CVE-2022-32508, CVE-2022-32505)
    No content preview
    Technical Advisory – macOS Installer Local Root Privilege Escalation (CVE-2020-9817)
    No content preview
    Technical Advisory – Linux RDS Protocol Local Privilege Escalation
    No content preview
    Technical Advisory – NXP i.MX SDP_READ_DISABLE Fuse Bypass (CVE-2022-45163)
    No content preview
    Technical Advisory – Nullsoft Scriptable Installer System (NSIS) – Insecure Temporary Directory Usage
    No content preview
    Technical Advisory – New York State Excelsior Pass Vaccine Passport Scanner App Sends Data to a Third Party not Specified in Privacy Policy
    No content preview
    Technical Advisory – New York State Excelsior Pass Vaccine Passport Credential Forgery
    No content preview
    Technical Advisory – play-pac4j Authentication rule bypass
    No content preview
    Technical Advisory – ParcelTrack sends all pasteboard data to ParcelTrack’s servers on startup
    No content preview
    Technical Advisory – OpenOffice.org Multiple Memory Corruption Vulnerabilities
    No content preview
    Technical Advisory – Open5GS Stack Buffer Overflow During PFCP Session Establishment on UPF (CVE-2021-41794)
    No content preview
    Technical Advisory – Shop app sends pasteboard data to Shopify’s servers
    No content preview
    Technical Advisory – Pulse Connect Secure – RCE via Template Injection (CVE-2020-8243)
    No content preview
    Technical Advisory – playSMS Pre-Authentication Remote Code Execution (CVE-2020-8644)
    No content preview
    Technical Advisory – SonicWall SMA 100 Series – Unauthenticated Stored XSS
    No content preview
    Technical Advisory – SonicWall SMA 100 Series – Post-Authentication Remote Command Execution (CVE-2021-20044)
    No content preview
    Technical Advisory – SonicWall SMA 100 Series – Multiple Unauthenticated Heap-based and Stack-based Buffer Overflow (CVE-2021-20045)
    No content preview
    Technical Advisory – SonicWall SMA 100 Series – Heap-Based Buffer Overflow (CVE-2021-20043)
    No content preview
    Technical Advisory – U-Boot – Unchecked Download Size and Direction in USB DFU (CVE-2022-2347)
    No content preview
    Technical Advisory – Tesla BLE Phone-as-a-Key Passive Entry Vulnerable to Relay Attacks
    No content preview
    Technical Advisory – Sunhillo SureLine Unauthenticated OS Command Injection (CVE-2021-36380)
    No content preview
    Technical Advisory – ICTFAX 7-4 – Indirect Object Reference
    No content preview
    Technical Advisory – Apple macOS XAR – Arbitrary File Write (CVE-2022-22582)
    No content preview
    Technical Advisory – wolfSSL TLS 1.3 Client Man-in-the-Middle Attack (CVE-2020-24613)
    No content preview
    Technical Advisory – VMware Tools Multiple Vulnerabilities
    No content preview
    Technical Advisory – Linksys WRT160NL – Authenticated Command Injection (CVE-2021-25310)
    No content preview
    Technical Advisory – Jitsi Meet Electron – Limited Certificate Validation Bypass (CVE-2020-27161)
    No content preview
    Technical Advisory – Jitsi Meet Electron – Arbitrary Client Remote Code Execution (CVE-2020-27162)
    No content preview
    Technical Advisory – NULL Pointer Derefence in McAfee Drive Encryption (CVE-2021-23893)
    No content preview
    Technical Advisory – Multiple Vulnerabilities in Juplink RX4-1800 WiFi Router (CVE-2022-37413, CVE-2022-37414)
    No content preview
    Technical Advisory – Linksys WRT160NL – Authenticated Remote Buffer Overflow (CVE-2020-26561)
    No content preview
    Technical Advisory – SonicWall Global Management System (GMS) & Analytics – Multiple Critical Vulnerabilities
    No content preview
    Technical Advisory – SerComm h500s – Authenticated Remote Command Execution (CVE-2021-44080)
    No content preview
    Technical Advisory – Ollama DNS Rebinding Attack (CVE-2024-28224)
    No content preview
    Tool Release – ScoutSuite 5.8.0
    No content preview
    Technical Advisory: Sonos Era 100 Secure Boot Bypass Through Unchecked setenv() call
    No content preview
    Technical Advisory: Multiple Vulnerabilities in Lexmark Printers
    No content preview
    Tool Release: iOS Secure State Preservation
    No content preview
    Tool Release – ScoutSuite 5.11.0
    No content preview
    Java Web Start File Inclusion via System Properties Override
    No content preview  ( 9 min )
    Reverse engineering and decrypting CyberArk vault credential files
    No content preview  ( 9 min )
    Public Report – AWS Nitro System API & Security Claims
    No content preview  ( 6 min )
    Public Report – Qredo Apache Milagro MPC Cryptographic Assessment
    No content preview  ( 6 min )
    iOS certificate pinning code updated for iOS 7
    No content preview  ( 6 min )
    iSEC audit of MediaWiki
    No content preview  ( 7 min )
    Variations in Exploit methods between Linux and Windows
    No content preview
    Using SharePoint as a Phishing Platform
    No content preview
    Using graph databases to assess the security of thingernets based on the thingabilities and thingertivity of things
    No content preview
    Virtual Access Monitor Multiple SQL Injection Vulnerabilities
    No content preview
    Violating the Virtual Channel – RDP Testing
    No content preview
    Violating Database – Enforced Security Mechanisms
    No content preview
    Vaccine Misinformation Part 1: Misinformation Attacks as a Cyber Kill Chain
    No content preview
    Vulnerabilities Found In Geofencing Apps
    No content preview
    VoIP Security Methodology and Results
    No content preview
    vlan-hopping
    No content preview
    Visualising Firewall Rulesets – Simplifying Firewall Administration and Spotting the Pivot Point
    No content preview
    Weak Randomness Part I – Linear Congruential Random Number Generators
    No content preview
    WastedLocker: A New Ransomware Variant Developed By The Evil Corp Group
    No content preview
    Vulnerability Overview: Ghost (CVE-2015-0235)
    No content preview
    Webinar: SMACK, SKIP-TLS & FREAK SSL/TLS vulnerabilities
    No content preview
    Webinar: 4 Secrets to a Robust Incident Response Plan
    No content preview
    Webinar – PCI Version 3.0: Are you ready?
    No content preview
    Weaknesses and Best Practices of Public Key Kerberos with Smart Cards
    No content preview
    Whatsupgold Premium Directory traversal
    No content preview
    Welcome to the new NCC Group Global Research blog
    No content preview
    WebSense content filter bypass when deployed in conjunction with Cisco filtering devices
    No content preview
    WebRATS
    No content preview
    WebLogic Plugin HTTP Injection via Encoded URLs
    No content preview
    Wheel of Fortune Outcome Prediction – Taking the Luck out of Gambling (1)
    No content preview
    Wheel of Fortune Outcome Prediction – Taking the Luck out of Gambling
    No content preview
    What the HEC? Security implications of HDMI Ethernet Channel and other related protocols
    No content preview
    White Paper: An Introduction to Authenticated Encryption
    No content preview
    Which database is more secure? Oracle vs. Microsoft
    No content preview
    When Security Gets in the Way: PenTesting Mobile Apps That Use Certificate Pinning
    No content preview
    When a Trusted Site in Internet Explorer was Anything But
    No content preview
    whitebox
    No content preview
    White Paper: Login Service Security
    No content preview
    White Paper: Cryptopocalypse Reference Paper
    No content preview
    White Paper: Browser Extension Password Managers
    No content preview
    Whitepaper – Coinbugs: Enumerating Common Blockchain Implementation-Level Vulnerabilities
    No content preview
    Whitepaper – A Heap of Trouble: Breaking the Linux Kernel SLOB Allocator
    No content preview
    Whitepaper – Double Fetch Vulnerabilities in C and C++
    No content preview
    Whitepaper – Microcontroller Readback Protection: Bypasses and Defenses
    No content preview
    Whitepaper – HTTP Digest Integrity: Another look, in light of recent attacks
    No content preview
    Whitepaper – Hardware-Backed Heist: Extracting ECDSA Keys from Qualcomm’s TrustZone
    No content preview
    Whitepaper – Exploring the Security of KaiOS Mobile Applications
    No content preview
    Whitepaper – XML Schema, DTD, and Entity Attacks: A Compendium of Known Techniques
    No content preview
    Whitepaper – Weaning the Web off of Session Cookies: Making Digest Authentication Viable
    No content preview
    Whitepaper – Project Triforce: Run AFL On Everything (2017)
    No content preview
    Whitepaper – Practical Attacks on Machine Learning Systems
    No content preview
    Windows 10 USB Mass Storage driver arbitrary code execution in kernel mode
    No content preview
    Why IoT Security Matters
    No content preview
    Whitepaper: Recognizing and Preventing TOCTOU
    No content preview
    Whitepaper: Perfect Forward Security
    No content preview
    Whitepaper: CA Alternative
    No content preview
    Windows Firewall Hook Enumeration
    No content preview
    Windows DACLs & Why There Is Still Room for Interest
    No content preview
    Windows DACL Enum Project
    No content preview
    Windows 2000 Format String Vulnerabilities
    No content preview
    Windows Phone 7 Application Security Survey
    No content preview
    Windows IPC Fuzzing Tools
    No content preview
    WindowsJobLock
    No content preview
    Windows USB RNDIS driver kernel pool overflow
    No content preview
    Windows remote desktop memory corruptoin leading to RCE on XPSP3
    No content preview
    Windows Remote Desktop Memory Corruption Leading to RCE on XPSP3
    No content preview
    Writing Exploits for Win32 Systems from Scratch
    No content preview
    Working with the Open Technology Fund
    No content preview
    Work daily with enforced MFA-protected API access
    No content preview
    Order Details Screens and PII
    No content preview  ( 9 min )
    Introspy for Android
    No content preview  ( 6 min )
    Oracle 11g TNS listener remote Invalid Pointer Read
    No content preview  ( 6 min )
    Multiple security vulnerabilities in SAP NetWeaver BSP Logon
    No content preview  ( 6 min )
    NCC Group Research at Black Hat USA 2021 and DEF CON 29
    No content preview  ( 17 min )
    Writing Robust Yara Detection Rules for Heartbleed
    No content preview
    Writing FreeBSD Kernel Modules in Rust
    No content preview
    WSBang
    No content preview
    Writing Small Shellcode
    No content preview
    Writing Secure ASP Scripts
    No content preview
    WSSiP: A Websocket Manipulation Proxy
    No content preview
    WSMap
    No content preview
    Xen HYPERVISOR_xen_version stack memory revelation
    No content preview
    xcavator
    No content preview
    Wubes: Leveraging the Windows 10 Sandbox for Arbitrary Processes
    No content preview
    YoNTMA
    No content preview
    Xendbg: A Full-Featured Debugger for the Xen Hypervisor
    No content preview
    Xen SMEP (and SMAP) Bypass
    No content preview
    Zulu
    No content preview
    ZigTools: An Open Source 802.15.4 Framework
    No content preview
    Zcash Overwinter Consensus and Sapling Cryptography Review
    No content preview
    Zcash Cryptography and Code Review
    No content preview
    A Census of Deployed Pulse Connect Secure (PCS) Versions
    No content preview
    Public Report – Electric Coin Company NU3 Specification and Blossom Implementation Audit
    No content preview
    Public Report - Security Risks of AI Hardware for Personal and Edge Computing Devices
    No content preview
    Nagios XI Network Monitor – Stored and Reflective XSS
    No content preview
    Making New Connections – Leveraging Cisco AnyConnect Client to Drop and Run Payloads
    No content preview
    Analysis of setting cookies for third party websites in different browsers
    No content preview
    Technical advisory: Remote shell commands execution in ttyd
    No content preview
    Remote Exploitation of Microsoft Office DLL Hijacking (MS15-132) via Browsers
    No content preview
    Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 5: Development of Prototype #1 – Text Processing and Semantic Relationships
    No content preview
    Technical Advisory: Ruby on Rails – Possible XSS Vulnerability in ActionView tag helpers (CVE-2022-27777)
    No content preview
    Technical Advisory: Stored and Reflected XSS Vulnerability in Nagios Log Server (CVE-2021-35478,CVE-2021-35479)
    No content preview
    Technical Advisory: SQL Injection and Reflected Cross-Site Scripting (XSS) Vulnerabilities in Oracle Communications Diameter Signaling Router (CVE-2020-14787, CVE-2020-14788)
    No content preview
    Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 7: Development of Prototype #3 – Adventures in Anomaly Detection
    No content preview
    Matty McMattface: Security implications, mitigations & testing strategies for biometric facial recognition systems
    No content preview
    Technical advisory: CVE-2017-8592 – XMLHttpRequest in IE followed 307 redirections with additional or customised headers
    No content preview
    Immortalising 20 Years of Epic Research
    No content preview
    Forensic Readiness in Container Environments
    No content preview
    Technical Advisory: Xiaomi 13 Pro Code Execution via GetApps DOM Cross-Site Scripting (XSS)
    No content preview
    Defending Your Directory: An Expert Guide to Securing Active Directory Against DCSync Attacks
    No content preview
    Technical Advisory: PDFTron JavaScript URLs Allowed in WebViewer UI (CVE-2021-39307)
    No content preview
    Treat your points as cash
    No content preview
    Hackproofing Lotus Domino Web Server
    No content preview
    Public Report: WhatsApp Contacts Security Assessment
    No content preview
    Defending Your Directory: An Expert Guide to Fortifying Active Directory Certificate Services (ADCS) Against Exploitation
    No content preview
    Public Report: eBPF Verifier Code Review
    No content preview
    Nameless and shameless: Ransomware Encryption via BitLocker
    No content preview
    Phish Supper: An Incident Responder’s Bread and Butter
    No content preview
    On Almost Signing Android Builds
    No content preview
    Defending Your Directory: An Expert Guide to Mitigating Pass-the-Hash Attacks in Active Directory
    No content preview
    Defending Your Directory: An Expert Guide to Fortifying Active Directory Against LDAP Injection Threats
    No content preview
    A deeper dive into CVE-2021-39137 – a Golang security bug that Rust would have prevented
    No content preview
    A Brief Review of Bitcoin Locking Scripts and Ordinals
    No content preview
    PMKID Attacks: Debunking the 802.11r Myth
    No content preview
    Public Report: XMTP MLS Implementation Review
    No content preview
    A Race to Report a TOCTOU: Analysis of a Bug Collision in Intel SMM
    No content preview
    A Look At Some Real-World Obfuscation Techniques
    No content preview
    A glimpse into the shadowy realm of a Chinese APT: detailed analysis of a ShadowPad intrusion
    No content preview
    Adventures in the land of BumbleBee – a new malicious loader
    No content preview
    ABSTRACT SHIMMER (CVE-2020-15257): Host Networking is root-Equivalent, Again
    No content preview
    Announcing the Cryptopals Guided Tour Video 17: Padding Oracles!
    No content preview
    Android Malware Vultur Expands Its Wingspan
    No content preview
    Analyzing a PJL directory traversal vulnerability – exploiting the Lexmark MC3224i printer (part 2)
    No content preview
    Adventures in Windows Driver Development: Part 1
    No content preview
    AWS Inventory: A tool for mapping AWS resources
    No content preview
    Avoiding Pitfalls Developing with Electron
    No content preview
    Autochrome
    No content preview
    Bypassing software update package encryption – extracting the Lexmark MC3224i printer firmware (part 1)
    No content preview
    BrokenPrint: A Netgear stack overflow
    No content preview
    Blue Coat BCAAA Remote Code Execution Vulnerability
    No content preview
    Back in Black: Unlocking a LockBit 3.0 Ransomware Attack
    No content preview
    CVE-2018-8611 Exploiting Windows KTM Part 1/5 – Introduction
    No content preview
    Cryptopals: Exploiting CBC Padding Oracles
    No content preview
    Constant-Time Data Processing At a Secret Offset, Privacy and QUIC
    No content preview
    CVE-2018-8611 Exploiting Windows KTM Part 4/5 – From race win to kernel read and write primitive
    No content preview
    CVE-2018-8611 Exploiting Windows KTM Part 3/5 – Triggering the race condition and debugging tricks
    No content preview
    CVE-2018-8611 Exploiting Windows KTM Part 2/5 – Patch analysis and basic triggering
    No content preview
    CVE-2021-31956 Exploiting the Windows Kernel (NTFS with WNF) – Part 2
    No content preview
    CVE-2021-31956 Exploiting the Windows Kernel (NTFS with WNF) – Part 1
    No content preview
    CVE-2018-8611 Exploiting Windows KTM Part 5/5 – Vulnerability detection and a better read/write primitive
    No content preview
    Decoder Improved Burp Suite plugin release part two
    No content preview
    Dangers of Kubernetes IAM Integrations
    No content preview
    Detecting and Protecting when Remote Desktop Protocol (RDP) is open to the Internet
    No content preview
    Detecting and Hunting for the PetitPotam NTLM Relay Attack
    No content preview
    Detecting and Hunting for the Malicious NetFilter Driver
    No content preview
    earlyremoval, in the Conservatory, with the Wrench: Exploring Ghidra’s decompiler internals to make automatic P-Code analysis scripts
    No content preview
    Discovering Smart Contract Vulnerabilities with GOATCasino
    No content preview
    Disabling Office Macros to Reduce Malware Infections
    No content preview
    Detecting Mimikatz with Busylight
    No content preview
    Hardware Security By Design: ESP32 Guidance
    No content preview
    Exploiting the Sudo Baron Samedit vulnerability (CVE-2021-3156) on VMWare vCenter Server 7.0
    No content preview
    Exploiting MS15-061 Use-After-Free Windows Kernel Vulnerability
    No content preview
    eBPF Adventures: Fiddling with the Linux Kernel and Unix Domain Sockets
    No content preview
    How I did not get a shell
    No content preview
    HITBAMS – Your Not so “Home” Office – Soho Hacking at Pwn2Own
    No content preview
    McAfee Email and Web Security Appliance v5.6 – Arbitrary file download is possible with a crafted URL, when logged in as any user
    No content preview
    Log4Shell: Reconnaissance and post exploitation network detection
    No content preview
    Improving Software Security through C Language Standards
    No content preview
    How Microsoft Office knows a document came from the Internet and might be dangerous
    No content preview
    Modelling Threat Actor Phishing Behaviour
    No content preview
    Mitigating the top 10 security threats to GCP using the CIS Google Cloud Platform Foundation Benchmark
    No content preview
    Metastealer – filling the Racoon void
    No content preview
    North Korea’s Lazarus: their initial access trade-craft using social media and social engineering
    No content preview
    NETGEAR Routers: A Playground for Hackers?
    No content preview
    Much Ado About Hardware Implants
    No content preview
    Popping Blisters for research: An overview of past payloads and exploring recent developments
    No content preview
    Past, Present and Future of Effective C
    No content preview
    OffensiveCon 2023 – Exploit Engineering – Attacking the Linux Kernel
    No content preview
    Remote Code Execution on Western Digital PR4100 NAS (CVE-2022-23121)
    No content preview
    Real World Cryptography Conference 2024
    No content preview
    Real World Cryptography Conference 2023 – Part II
    No content preview
    Puckungfu 2: Another NETGEAR WAN Command Injection
    No content preview
    Shaking The Foundation of An Online Collaboration Tool: Microsoft 365 Top 5 Attacks vs the CIS Microsoft 365 Foundation Benchmark
    No content preview
    SETTLERS OF NETLINK: Exploiting a limited UAF in nf_tables (CVE-2022-32250)
    No content preview
    Security Code Review With ChatGPT
    No content preview
    Reverse, Reveal, Recover: Windows Defender Quarantine Forensics
    No content preview
    Shooting Yourself in the .flags – Jailbreaking the Sonos Era 100
    No content preview
    Shining the Light on Black Basta
    No content preview
    Stepping Insyde System Management Mode
    No content preview
    State of DNS Rebinding in 2023
    No content preview
    SnapMC skips ransomware, steals data
    No content preview
    Sifting through the spines: identifying (potential) Cactus ransomware victims
    No content preview
    Technical Advisory – Multiple HTML Injection Vulnerabilities in KaiOS Pre-installed Mobile Applications
    No content preview
    Stepping Stones – A Red Team Activity Hub
    No content preview
    Technical Advisory – OpenJDK – Weak Parsing Logic in java.net.InetAddress and Related Classes
    No content preview
    Technical Advisory – Multiple Vulnerabilities in the Galaxy App Store (CVE-2023-21433, CVE-2023-21434)
    No content preview
    Technical Advisory – Multiple Vulnerabilities in Connectize G6 AC2100 Dual Band Gigabit WiFi Router (CVE-2023-24046, CVE-2023-24047, CVE-2023-24048, CVE-2023-24049, CVE-2023-24050, CVE-2023-24051, CVE-2023-24052)
    No content preview
    Technical Advisory – Multiple Vulnerabilities in Netgear ProSAFE Plus JGS516PE / GS116Ev2 Switches
    No content preview
    Technical Advisory – Multiple Vulnerabilities in Nagios XI
    No content preview
    Technical Advisory – Multiple Vulnerabilities in Faronics Insight (CVE-2023-28344, CVE-2023-28345, CVE-2023-28346, CVE-2023-28347, CVE-2023-28348, CVE-2023-28349, CVE-2023-28350, CVE-2023-28351, CVE-2023-28352, CVE-2023-28353)
    No content preview
    Technical Advisory – Multiple Vulnerabilities in Victure WR1200 WiFi Router (CVE-2021-43282, CVE-2021-43283, CVE-2021-43284)
    No content preview
    Technical Advisory – Multiple Vulnerabilities in Trendnet TEW-831DR WiFi Router (CVE-2022-30325, CVE-2022-30326, CVE-2022-30327, CVE-2022-30328, CVE-2022-30329)
    No content preview
    Technical Advisory – Multiple Vulnerabilities in PandoraFMS Enterprise
    No content preview
    Technical Advisory: containerd – containerd-shim API Exposed to Host Network Containers (CVE-2020-15257)
    No content preview
    Technical Advisory: Command Injection
    No content preview
    Technical Advisory: Adobe ColdFusion WDDX Deserialization Gadgets
    No content preview
    Technical Advisory: Multiple Vulnerabilities in Kyocera Printers
    No content preview
    Technical Advisory: Multiple Vulnerabilities in Brother Printers
    No content preview
    Technical Advisory: CyberArk EPM Non-paged Pool Buffer Overflow
    No content preview
    Testing Two-Factor Authentication
    No content preview
    Technical Advisory: Multiple Vulnerabilities in Xerox Printers
    No content preview
    Technical Advisory: Multiple Vulnerabilities in Ricoh Printers
    No content preview
    Threat Actors: exploiting the pandemic
    No content preview
    There’s Another Hole In Your SoC: Unisoc ROM Vulnerabilities
    No content preview
    The Next C Language Standard (C23)
    No content preview
    Tool Release – Reliably-checked String Library Binding
    No content preview
    Tool Release – insject: A Linux Namespace Injector
    No content preview
    Tool Release – Enumerating Docker Registries with go-pillage-registries
    No content preview
    Tool Update – ruby-trace: A Low-Level Tracer for Ruby
    No content preview
    Tool Release: Sinking U-Boots with Depthcharge
    No content preview
    Tool Release: Magisk Module – Conscrypt Trust User Certs
    No content preview
    Vehicle Emissions and Cyber Security
    No content preview
    Using AWS and Azure for Cost Effective Log Ingestion with Data Processing Pipelines for SIEMs
    No content preview
    Tracking a P2P network related to TA505
    No content preview
    Research Blog Test Playground
    No content preview
    RomHack – Revving Up: The Journey to Pwn2Own Automotive 2024
    No content preview
    The Dark Side: How Threat Actors Leverage AnyDesk for Malicious Activities
    No content preview
    BlackHat USA 2024 - Listen-Up: Sonos Over-The-Air Remote Kernel Exploitation and Covert Wiretap
    No content preview
    Machine Learning 101: The Integrity of Image (Mis)Classification?
    No content preview
    Proxying PyRIT for fun and profit
    No content preview
    Whitepaper – A Tour of Curve 25519 in Erlang
    No content preview
    Social Engineering Penetration Testing
    No content preview
    NCC Group’s 2024 Annual Research Report
    No content preview
    Technical Advisory: Cross-Site Scripting in Umbraco Rich Text Display
    No content preview
    Machine Learning 102: Attacking Facial Authentication with Poisoned Data
    No content preview
    Technical Advisory – Hash Denial-of-Service Attack in Multiple QUIC Implementations
    No content preview
    How organisations can properly configure SSL services to ensure the integrity and confidentiality of data in transit
    No content preview
    NCC Group’s Exploit Development Capability: Why and What
    No content preview
    Building Systems from Commercial Components
    No content preview
    Absolute Security
    No content preview
    A Primer On Slowable Encoders
    No content preview
    Security Tips For Your AI Cloud Infrastructure
    No content preview
    Aurora Response Recommendations
    No content preview
    Auditing Enterprise Class Applications and Secure Containers on Android
    No content preview
    An Introduction to Authenticated Encryption
    No content preview
    Car Parking Apps Vulnerable To Hacks
    No content preview
    Blind Exploitation of Stack Overflow Vulnerabilities
    No content preview
    BLEBoy
    No content preview
    Deception Engineering: exploring the use of Windows Service Canaries against ransomware
    No content preview
    CERT Oracle Secure Coding Standard for Java
    No content preview
    CERT C Secure Coding Standard
    No content preview
    HTML5 Security The Modern Web Browser Perspective
    No content preview
    Exposing Vulnerabilities in Media Software
    No content preview
    Developing Secure Mobile Applications for Android
    No content preview
    Defeating Windows DEP With A Custom ROP Chain
    No content preview
    Java Coding Guidelines: 75 Recommendations for Reliable and Secure Programs
    No content preview
    iSEC’s Analysis of Microsoft’s SDL and its ROI
    No content preview
    iOS Application Security: The Definitive Guide for Hackers and Developers
    No content preview
    Mallory: Transparent TCP and UDP Proxy
    No content preview
    Mallory and Me: Setting up a Mobile Mallory Gateway
    No content preview
    Jenkins Plugins and Core Technical Summary Advisory
    No content preview
    NCC Group Connected Health Whitepaper July 2019
    No content preview
    Modernizing Legacy Systems: Software Technologies, Engineering Processes, and Business Practices
    No content preview
    MeshyJSON: A TP-Link tdpServer JSON Stack Overflow
    No content preview
    Practical Considerations of Right-to-Repair Legislation
    No content preview
    Nine years of bugs at NCC Group
    No content preview
    NCLoader
    No content preview
    NCC Group WhitepaperUnderstanding and HardeningLinux ContainersJune 29, 2016 – Version 1.1
    No content preview
    Secure Coding in C and C++
    No content preview
    Professional C Programming LiveLessons, (Video Training) Part I: Writing Robust, Secure, Reliable Code
    No content preview
    Public Report – Kubernetes 1.24 Security Audit
    No content preview  ( 6 min )
    Technical Advisory: Code Execution by Viewing Resource Files in .NET Reflector
    No content preview  ( 7 min )
    The CERT® C Coding Standard, Second Edition: 98 Rules for Developing Safe, Reliable, and Secure Systems
    No content preview  ( 6 min )
    Analyzing Secure AI Architectures
    No content preview  ( 15 min )
    Secure Coding Rules for Java LiveLessons, Part 1
    No content preview  ( 6 min )
    The Browser Hacker’s Handbook
    No content preview
    Technical Advisory: Bypassing Workflows Protection Mechanisms – Remote Code Execution on SharePoint
    No content preview
    Software Verification and Analysis Using Z3
    No content preview
    SMB hash hijacking & user tracking in MS Outlook
    No content preview
    Security Compliance as an Engineering Discipline
    No content preview
    Secure Coding in C and C++, 2nd Edition
    No content preview
    The Mobile Application Hacker’s Handbook
    No content preview
    Technical Advisory: Multiple Vulnerabilities in SmarterMail
    No content preview
    Technical Advisory: IP Office Stored Cross Site Scripting (XSS) Vulnerability
    No content preview
    Tattler
    No content preview
    SQL Server Security
    No content preview
    Auditing K3s Clusters
    No content preview
    44CON - Charging Ahead: Exploiting an EV Charger Controller at Pwn2Own Automotive 2024
    No content preview
    The Shellcoder’s Handbook: Discovering and Exploiting Security Holes, 2nd Edition
    No content preview
    Technical Advisory: Unauthenticated Remote Command Execution through Multiple Vulnerabilities in Virgin Media Hub 3.0
    No content preview
    Weak Passwords Led to (SafePay) Ransomware…Yet Again
    No content preview
    Defending Your Directory: An Expert Guide to Combating Kerberoasting in Active Directory
    No content preview
    Announcing the Cryptopals Guided Tour Video 18: Implement CTR
    No content preview
    The Database Hacker’s Handbook
    No content preview
    A Rendezvous with System Management Interrupts
    No content preview
    Man-in-the-Middling Non-Proxy Aware Wi-Fi Devices with a Pineapple
    No content preview  ( 11 min )
    Mergers & Acquisitions (M&A) cyber security due diligence
    No content preview  ( 6 min )
    Machine Learning for Static Analysis of Malware – Expansion of Research Scope
    No content preview  ( 17 min )
    Java RMI Registry.bind() Unvalidated Deserialization
    No content preview  ( 6 min )
    Oracle Forensics Part 1: Dissecting the Redo Logs
    No content preview  ( 6 min )
    Mobile & web browser credential management: Security implications, attack cases & mitigations
    No content preview  ( 6 min )
    NCC Con Europe 2022 – Pwn2Own Austin Presentations
    No content preview  ( 8 min )
    metasploitavevasion
    No content preview  ( 6 min )
    iSEC Engages in TrueCrypt Audit
    No content preview  ( 6 min )
    Oracle Forensics Part 7 Using the Oracle System Change Number in Forensic Investigations
    No content preview  ( 6 min )
    Mobile World Congress – Mobile Internet of Things
    No content preview  ( 6 min )
    LAPSUS$: Recent techniques, tactics and procedures
    No content preview  ( 10 min )
    Medium Risk Vulnerability in Symantec Enterprise Security Management
    No content preview  ( 6 min )
    MSSQL Lateral Movement
    No content preview  ( 10 min )
    McAfee Email and Web Security Appliance Password hashes can be recovered from a system backup and easily cracked
    No content preview  ( 6 min )
    GSM/GPRS Traffic Interception for Penetration Testing Engagements
    No content preview
    Why AI Will Not Fully Replace Humans for Web Penetration Testing
    No content preview
    The why behind web application penetration test prerequisites
    No content preview
    IG Learner Walkthrough
    No content preview
    EAP-TLS: The most secure option?
    No content preview
    Online Casino Roulette – A guideline for penetration testers and security researchers
    No content preview
    Cross-Execute Your Linux Binaries, Don’t Cross-Compile Them
    No content preview
    Rustproofing Linux (Part 4/4 Shared Memory)
    No content preview
    Rustproofing Linux (Part 3/4 Integer Overflows)
    No content preview
    Rustproofing Linux (Part 2/4 Race Conditions)
    No content preview
    Rustproofing Linux (Part 1/4 Leaking Addresses)
    No content preview
    VeChain JavaScript SDK Cryptography and Security Review
    No content preview
    The Development of a Telco Attack Testing Tool
    No content preview
    An Engineer’s View: Operational Technology
    No content preview
    Technical Advisory – Lansweeper Privilege Escalation via CSRF Using HTTP Method Interchange (CVE-2020-13658)
    No content preview
    Lights, Camera, HACKED! An insight into the world of popular IP Cameras
    No content preview
    Handy guide to a new Fivehands ransomware variant
    No content preview
    Pumping Iron on the Musl Heap – Real World CVE-2022-24834 Exploitation on an Alpine mallocng Heap
    No content preview
    Analyzing AI Application Threat Models
    No content preview
    Technical Advisory: Espressif Systems - ESP32 BluFi Reference Application Vulnerabilities
    No content preview
    Technical Advisory: Multiple Vulnerabilities in TCPDF
    No content preview
    Security Best Practice: Host Naming & URL Conventions
    No content preview
    Securing PL/SQL Applications with DBMS_ASSERT
    No content preview
    SecureBigIP
    No content preview
    scenester
    No content preview
    Samba Andx Request Remote Code Execution
    No content preview
    RM3 – Curiosities of the wildest banking malware
    No content preview
    RIFT: F5 CVE-2020-5902 and Citrix CVE-2020-8193, CVE-2020-8195 and CVE-2020-8196 honeypot data release
    No content preview
    Research Insights Volume 9 – Modern Security Vulnerability Discovery
    No content preview
    Research Insights Volume 6: Common Issues with Environment Breakouts
    No content preview
    Research Insights Volume 2 – Defensive Trends
    No content preview
    Remote code execution in ImpressPages CMS
    No content preview
    Public Report – AWS Nitro System API & Security Claims German
    No content preview
    Public Report – WhatsApp Auditable Key Directory (AKD) Implementation Review
    No content preview
    Public Report – Lantern and Replica Security Assessment
    No content preview
    Public Report – Keyfork Implementation Review
    No content preview
    Public Report – IOV Labs powHSM Security Assessment
    No content preview
    Public Report – go-cose Security Assessment
    No content preview
    Premium Security Content Gateway
    No content preview
    Premium Practical Law Content Gateway
    No content preview
    Premium Content Gateway
    No content preview
    Practical SME security on a shoestring
    No content preview
    Practical Machine Learning for Random (Filename) Detection
    No content preview
    port-scan-automation
    No content preview
    Poison Ivy string decryption
    No content preview
    Pip3line
    No content preview
    Perfect Forward Security
    No content preview
    On Multiplications with Unsaturated Limbs
    No content preview  ( 14 min )
    Non Obvious PE Parsers – The .NET runtime – Part 1
    No content preview  ( 11 min )
    ncccodenavi
    No content preview  ( 6 min )
    Oracle Retail Integration Bus Manager Directory Traversal
    No content preview  ( 6 min )
    NCC Group Malware Technical Note
    No content preview  ( 6 min )
    RokRat Analysis
    No content preview  ( 10 min )
    Paper: Thematic for Success in Real-World Offensive Cyber Operations – How to make threat actors work harder and fail more often
    No content preview  ( 7 min )
    POC2021 – Pwning the Windows 10 Kernel with NTFS and WNF Slides
    No content preview  ( 6 min )
    Public Report – Caliptra Security Assessment
    No content preview  ( 7 min )
    Public cloud
    No content preview  ( 6 min )
    Post-exploiting a compromised etcd – Full control over the cluster and its nodes
    No content preview  ( 14 min )
    NCC Group’s Jeremy Boone recognized for Highest Quality and Most Eligible Reports through the Intel Circuit Breaker program
    No content preview  ( 6 min )
    Oracle Retail Invoice Manager SQL Injection
    No content preview  ( 6 min )
    Public Report – Confidential Mode for Hyperdisk – DEK Protection Analysis
    No content preview  ( 6 min )
    Post-quantum cryptography overview
    No content preview  ( 6 min )
    Secure Device Manufacturing: Supply Chain Security Resilience
    No content preview  ( 6 min )
    Public Report – Zendoo Proof Verifier Cryptography Review
    No content preview  ( 6 min )
    Security First Umbrella
    No content preview  ( 6 min )
    Research Insights Volume 1 – Sector Focus: Financial Services
    No content preview  ( 6 min )
    Non-flood/non-volumetric Distributed Denial of Service (DDoS)
    No content preview  ( 6 min )
    Multiple Vulnerabilities in MailEnable
    No content preview  ( 6 min )
    Password and brute-force mitigation policies
    No content preview
    Optimum Routers: Researching Managed Routers
    No content preview
    NCC Group’s 2021 Annual Research Report
    No content preview
    NCC CON Europe 2017
    No content preview
    Nagios XI Network Monitor Stored and Reflected XSS
    No content preview
    Multiple Buffer Overflows Discovered in AFFLIB
    No content preview
    McAfee Email and Web Security Appliance v5.6 – Session hijacking (and bypassing client-side session timeouts)
    No content preview
    McAfee Email and Web Security Appliance v5.6 – Any logged-in user can bypass controls to reset passwords of other administrators
    No content preview
    Low Cost Attacks on Smart Cards – The Electromagnetic Side-Channel
    No content preview
    Logs, Logs, the Audit Trail – Features of a Successful Log Management Solution
    No content preview
    Managing Cyber Risk in the Supply Chain
    No content preview
    LTair:  The LTE Air Interface Tool
    No content preview
    McAfee Email and Web Security Appliance Active session tokens of other users are disclosed within the UI
    No content preview
    Machine learning from idea to reality: a PowerShell case study
    No content preview
    Lessons learned from 50 bugs: Common USB driver vulnerabilities
    No content preview
    lapith
    No content preview
    Kivlad
    No content preview
    Medical Devices: A Hardware Security Perspective
    No content preview
    iOS 7 tool updates
    No content preview
    iSEC reviews SecureDrop
    No content preview
    iOS 7 arbitrary code execution in kernel mode
    No content preview
    Investigating Potential Security Vulnerability Manifestation through Various Analyses & Inferences Regarding Internet RFCs (and how RFC Security might be Improved)
    No content preview
    Non-stack Based Exploitation of Buffer Overrun Vulnerabilities on Windows NT 2000 XP
    No content preview
    Login Service Security
    No content preview
    iOS MobileSlideShow USB Image Class arbitrary code execution.txt
    No content preview
    Microsoft SQL Server Passwords
    No content preview
    Lending a hand to the community – Covenant v0.7 Updates
    No content preview
    Estimating the Bit Security of Pairing-Friendly Curves
    No content preview  ( 32 min )
    LibAVCodec AMV Out of Array Write
    No content preview  ( 7 min )
    Check out our new Microcorruption challenges!
    No content preview  ( 6 min )
    Nagios XI Network Monitor Blind SQL Injection
    No content preview  ( 7 min )
    Endpoint connectivity
    No content preview  ( 6 min )
    Critical Risk Vulnerability in Ingres (Pointer Overwrite 2)
    No content preview  ( 7 min )
    On Linux’s Random Number Generation
    No content preview  ( 13 min )
    Package Play
    No content preview  ( 6 min )
    SAML XML Injection
    No content preview  ( 14 min )
    easyda
    No content preview  ( 6 min )
    Mining data from Cobalt Strike beacons
    No content preview  ( 13 min )
    Black Hat 2013 – Femtocell Presentation Slides, Videos and App
    No content preview  ( 7 min )
    OS X Lion USB Hub Class Descriptor Arbitrary Code Execution
    No content preview  ( 6 min )
    Finding and Exploiting .NET Remoting over HTTP using Deserialisation
    No content preview  ( 11 min )
    grepify
    No content preview  ( 6 min )
    Helping Engineering Teams Tackle Security Debt in Embedded Systems: U-Boot Configuration Auditing Introduced in Depthcharge v0.2.0
    No content preview  ( 13 min )
    SecureCookies
    No content preview  ( 6 min )
    Exploiting Samba CVE-2015-0240 on Ubuntu 12.04 and Debian 7 32-bit
    No content preview  ( 16 min )
    FrisbeeLite
    No content preview  ( 6 min )
    My Hash is My Passport: Understanding Web and Mobile Authentication
    No content preview  ( 6 min )
    A WarCon 2017 Presentation: Cisco ASA – Exploiting the IKEv1 Heap Overflow – CVE-2016-1287
    No content preview  ( 6 min )
    Introduction to AWS Attribute-Based Access Control
    No content preview  ( 16 min )
    Ethics in Security Testing
    No content preview  ( 6 min )
    Multiple Format String Injections in AFFLIB
    No content preview  ( 9 min )
    Inter-Protocol Exploitation
    No content preview  ( 6 min )
    Conference Talks – September 2021
    No content preview  ( 7 min )
    Oracle Forensics Part 2: Locating Dropped Objects
    No content preview  ( 6 min )
    eBook: Breach notification under GDPR – How to communicate a personal data breach
    No content preview  ( 6 min )
    Is this the real life? Is this just fantasy? Caught in a landslide, NoEscape from NCC Group
    No content preview  ( 11 min )
    Exploiting CVE-2014-0282
    No content preview  ( 6 min )
    Passive Decryption of Ethereum Peer-to-Peer Traffic
    No content preview  ( 9 min )
    iOS Instrumentation Without Jailbreak
    No content preview  ( 11 min )
    IETF Draft: Indicators of Compromise and Their Role in Attack and Defen[c|s]e
    No content preview  ( 6 min )
    iOS User Enrollment and Trusted Certificates
    No content preview  ( 10 min )
    Exploring Prompt Injection Attacks
    No content preview  ( 14 min )
    Impersonating Gamers With GPT-2
    No content preview  ( 18 min )
    NIST Selects Post-Quantum Algorithms for Standardization
    No content preview  ( 10 min )
    Memory Gap
    No content preview  ( 6 min )
    osquery Application Security Assessment Public Report
    No content preview  ( 6 min )
    Android-KillPermAndSigChecks
    No content preview  ( 6 min )
    New Sources of Microsoft Office Metadata – Tool Release MetadataPlus
    No content preview  ( 10 min )
    Flash local-with-filesystem Bypass in navigateToURL
    No content preview  ( 6 min )
    Interfaces.d to RCE
    No content preview  ( 8 min )
    Revealing Embedded Fingerprints: Deriving intelligence from USB stack interactions
    No content preview  ( 6 min )
    Android-SSL-TrustKiller
    No content preview  ( 6 min )
    Flubot: the evolution of a notorious Android Banking Malware
    No content preview  ( 22 min )
    Security of Things: An Implementer’s Guide to Cyber Security for Internet of Things Devices and Beyond
    No content preview  ( 7 min )
    Intel BIOS Advisory – Memory Corruption in HID Drivers
    No content preview  ( 12 min )
    Announcing NCC Group’s Cryptopals Guided Tour!
    No content preview  ( 9 min )
    Public Report – WhatsApp End-to-End Encrypted Backups Security Assessment
    No content preview  ( 6 min )
    Image IO Memory Corruption
    No content preview  ( 6 min )
    HITB Phuket 2023 – Exploiting the Lexmark PostScript Stack
    No content preview  ( 6 min )
    Multiple Shell Metacharacter Injections in AFFLIB
    No content preview  ( 8 min )
    Medium Risk Vulnerability in Symantec Network Access Control
    No content preview  ( 6 min )
    NCC Group Research at Black Hat USA 2022 and DEF CON 30
    No content preview  ( 10 min )
    Conference Talks – March 2020
    No content preview  ( 8 min )
    Mobile apps and security by design
    No content preview  ( 6 min )
    Machine Learning 103: Exploring LLM Code Generation
    No content preview  ( 6 min )
    Open Banking: Security considerations & potential risks
    No content preview  ( 6 min )
    NX Server for Linux Arbitrary Files can be read with root privileges
    No content preview  ( 6 min )
    Increased exploitation of Oracle GlassFish Server Administration Console Remote Authentication Bypass
    No content preview  ( 7 min )
    House
    No content preview  ( 6 min )
    Nagios XI Network Monitor – OS Command Injection
    No content preview  ( 6 min )
    Oracle Forensics Part 6: Examining Undo Segments, Flashback and the Oracle Recycle Bin
    No content preview  ( 6 min )
    Passive Information Gathering – The Analysis of Leaked Network Security Information
    No content preview  ( 6 min )
    IP-reputation-snort-rule-generator
    No content preview  ( 6 min )
    Intel® Software Guard Extensions (SGX): A Researcher’s Primer
    No content preview  ( 16 min )
    Fuzzbox
    No content preview  ( 6 min )
    Improving Your Embedded Linux Security Posture With Yocto
    No content preview  ( 6 min )
    On the Use of Pedersen Commitments for Confidential Payments
    No content preview  ( 12 min )
    Microsoft Zero-Day Vulnerability – OLE2Link – Threat Intelligence and Signatures
    No content preview  ( 6 min )
    IAX Voice Over-IP Security
    No content preview  ( 6 min )
    DeLux Edition: Getting root privileges on the eLux Thin Client OS
    No content preview  ( 8 min )
    Securing Google Cloud Platform – Ten best practices
    No content preview  ( 10 min )
    Oracle Forensics Part 4: Live Response
    No content preview  ( 6 min )
    Oracle E-Business Suite Pre-Auth SQLi with DBA Privileges
    No content preview  ( 7 min )
    Ivanti Zero Day – Threat Actors observed leveraging CVE-2021-42278 and CVE-2021-42287 for quick privilege escalation to Domain Admin
    No content preview  ( 8 min )
    Detecting DNS implants: Old kitten, new tricks – A Saitama Case Study
    No content preview  ( 15 min )
    iSEC Completes TrueCrypt Audit
    No content preview  ( 7 min )
    OS X 10.6.6 Camera Raw Library Memory Corruption
    No content preview  ( 6 min )
    Public Report – Filecoin Bellman and BLS Signatures Cryptographic Review
    No content preview  ( 6 min )
    NCC Group co-signs the Electronic Frontier Foundation’s Statement on DMCA Use Against Security Researchers
    No content preview  ( 7 min )
    Lumension Device Control (formerly Sanctuary) remote memory corruption
    No content preview  ( 6 min )
    Experiments in Extending Thinkst Canary – Part 1
    No content preview  ( 7 min )
    Forensic Fuzzing Tools
    No content preview  ( 6 min )
    File Fuzzers
    No content preview  ( 6 min )
    Paradoxical Compression with Verifiable Delay Functions
    No content preview  ( 13 min )
    Oracle Hyperion 11 Directory Traversal
    No content preview  ( 6 min )
    Network Attached Security: Attacking a Synology NAS
    No content preview  ( 6 min )
    Demystifying Cobalt Strike’s “make_token” Command
    No content preview  ( 13 min )
    NCC Con Europe 2016
    No content preview  ( 7 min )
    McAfee Email and Web Security Appliance Session hijacking and bypassing client-side session timeouts
    No content preview  ( 6 min )
    McAfee Email and Web Security Appliance v5.6 – Active session tokens of other users are disclosed within the UI
    No content preview  ( 7 min )
    NCC Group’s 2022 & 2023 Research Report
    No content preview  ( 8 min )
    PDF Form Filling and Flattening Tool Buffer Overflow
    No content preview  ( 7 min )
    Jailbreak, updated and open-sourced
    No content preview  ( 6 min )
    Jailbreak
    No content preview  ( 6 min )
    Payment Card Industry Data Security Standard (PCI DSS) A Navigation and Explanation of Changes from v2.0 to v3.0
    No content preview  ( 6 min )
    Faster Modular Inversion and Legendre Symbol, and an X25519 Speed Record
    No content preview  ( 15 min )
    Pairing over BLS12-381, Part 1: Fields
    No content preview  ( 13 min )
    Pairing over BLS12-381, Part 2: Curves
    No content preview  ( 14 min )
    PRTG Network Monitor Command injection
    No content preview  ( 6 min )
    Pairing over BLS12-381, Part 3: Pairing!
    No content preview  ( 12 min )
    Lumension Device Control Remote Memory Corruption
    No content preview  ( 6 min )
    Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 2: Going off on a Tangent – AI/ML Applications in Social Engineering
    No content preview  ( 13 min )
    Maritime Cyber Security: Threats and Opportunities
    No content preview  ( 6 min )
    Oracle Forensics Part 5: Finding Evidence of Data Theft in the Absence of Auditing
    No content preview  ( 6 min )
    Firmware Rootkits: The Threat to the Enterprise
    No content preview  ( 6 min )
    Public Report – BLST Cryptographic Implementation Review
    No content preview  ( 6 min )
    Multiple Cisco CSS / ACE Client Certificate and HTTP Header
    No content preview  ( 15 min )
    Intent Fuzzer
    No content preview  ( 6 min )
    Microsoft announces the WMIC command is being retired, Long Live PowerShell
    No content preview  ( 9 min )
    My name is Matt – My voice is my password
    No content preview  ( 6 min )
    Live Incident Blog: June Global Ransomware Outbreak
    No content preview  ( 9 min )
    libtalloc: A GDB plugin for analysing the talloc heap
    No content preview  ( 10 min )
    Oracle Passwords and OraBrute
    No content preview  ( 6 min )
    OSX afpserver remote code execution
    No content preview  ( 6 min )
    On the malicious use of large language models like GPT-3
    No content preview  ( 30 min )
    Memory Scanning for the Masses
    No content preview  ( 8 min )
    Owning the Virgin Media Hub 3.0: The perfect place for a backdoor
    No content preview  ( 20 min )
    Proxy Re-Encryption Protocol: IronCore Public Report
    No content preview  ( 6 min )
    Overview of Modern Memory Security Concerns
    No content preview  ( 15 min )
    Phishing Mitigations: Configuring Microsoft Exchange to Clearly Identify External Emails
    No content preview  ( 9 min )
    Optimizing Pairing-Based Cryptography: Montgomery Multiplication in Assembly
    No content preview  ( 18 min )
    Oracle Gridengine sgepasswd Buffer Overflow
    No content preview  ( 7 min )
    Public Report – Google Enterprise API Security Assessment
    No content preview  ( 6 min )
    Non-Deterministic Nature of Prompt Injection
    No content preview  ( 8 min )
    Public Report – Electric Coin Company NU4 Cryptographic Specification and Implementation Review
    No content preview  ( 6 min )
    Public Report – AWS Nitro System API & Security Claims Spanish
    No content preview  ( 6 min )
    Porting the Misfortune Cookie Exploit: A Look into Router Exploitation Using the TD-8817
    No content preview  ( 6 min )
    Securing the continuous integration process
    No content preview  ( 6 min )
    Oracle 11g TNS listener remote Null Pointer Dereference
    No content preview  ( 6 min )
    Public Report – AWS Nitro System API & Security Claims Italian
    No content preview  ( 6 min )
    RIFT: F5 Networks K52145254: TMUI RCE vulnerability CVE-2020-5902 Intelligence
    No content preview  ( 13 min )
    Peeling back the layers on defence in depth…knowing your onions
    No content preview  ( 6 min )
    Project Triforce: Run AFL on Everything!
    No content preview  ( 15 min )
    Public Report – Pixel 4/4XL and Pixel 4a ioXt Audit
    No content preview  ( 6 min )
    Public Report – Android Cloud Backup/Restore
    No content preview  ( 6 min )
    Readable Thrift
    No content preview  ( 10 min )
    Public Report: Aleo snarkOS Implementation and Consensus Mechanism Review
    No content preview  ( 6 min )
    Pointer Sequence Reverser (PSR)
    No content preview  ( 7 min )
    Public Report – VPN by Google One: Technical Security & Privacy Assessment
    No content preview  ( 6 min )
    Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 10: Efficacy Demonstration, Project Conclusion and Next Steps
    No content preview  ( 11 min )
    Public Report – Coda Cryptographic Review
    No content preview  ( 6 min )
    Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 8: Development of Prototype #4 – Building on Takaesu’s Approach with Focus on XSS
    No content preview  ( 10 min )
    New Attack Vectors and a Vulnerability Dissection of MS03-007
    No content preview  ( 6 min )
    Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 1: Understanding the Basics and What Platforms and Frameworks Are Available
    No content preview  ( 11 min )
    Principal Mapper (pmapper)
    No content preview  ( 6 min )
    Project Bishop: Clustering Web Pages
    No content preview  ( 13 min )
    Securing Teradata Database
    No content preview  ( 7 min )
    Public Report – Zcash NU5 Cryptography Review
    No content preview  ( 6 min )
    Salesforce Security with Remote Working
    No content preview  ( 12 min )
    Pip3line – The Swiss Army Knife of Byte Manipulation
    No content preview  ( 7 min )
    Public Report – RustCrypto AES/GCM and ChaCha20+Poly1305 Implementation Review
    No content preview  ( 6 min )
    Public Report – Zcash FROST Security Assessment
    No content preview  ( 6 min )
    Public Report – Security Review of RSA Blind Signatures with Public Metadata
    No content preview  ( 6 min )
    Remote Directory Traversal and File Retrieval
    No content preview  ( 7 min )
    Public Report – Penumbra Labs Decaf377 Implementation and Poseidon Parameter Selection Review
    No content preview  ( 6 min )
    Research Paper – Machine Learning for Static Malware Analysis, with University College London
    No content preview  ( 9 min )
    PhanTap (Phantom Tap): Making networks spookier one packet at a time
    No content preview  ( 10 min )
    Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 9: Adventures with Expert Systems
    No content preview  ( 13 min )
    Public Report – VPN by Google One Security Assessment
    No content preview  ( 6 min )
    Setting a New Standard for Kubernetes Deployments
    No content preview  ( 8 min )
    Ransomware: How vulnerable is your system?
    No content preview  ( 10 min )
    Public Report – AWS Nitro System API & Security Claims French
    No content preview  ( 6 min )
    Public Report – WhatsApp opaque-ke Cryptographic Implementation Review
    No content preview  ( 6 min )
    Public Report – Google Privacy Sandbox Aggregation Service and Coordinator
    No content preview  ( 7 min )
    ProxMon
    No content preview  ( 6 min )
    RIFT: Analysing a Lazarus Shellcode Execution Method
    No content preview  ( 9 min )
    Security of Things: An Implementers’ Guide to Cyber-Security for Internet of Things Devices and Beyond
    No content preview  ( 6 min )
    Premium Practical Law Content Gateway(2)
    No content preview  ( 6 min )
    Rise of the machines: Machine Learning & its cyber security applications
    No content preview  ( 6 min )
    Public Report – Threshold ECDSA Cryptography Review
    No content preview  ( 6 min )
    Puckungfu: A NETGEAR WAN Command Injection
    No content preview  ( 11 min )
    Research Insights Volume 5 – Sector Focus: Automotive
    No content preview  ( 6 min )
    Public Report – Dell Secured Component Verification
    No content preview  ( 6 min )
    Research Paper – Recovering deleted data from the Windows registry
    No content preview  ( 6 min )
    RSA Conference – Mobile Threat War Room
    No content preview  ( 6 min )
    Public Report – Aleo snarkVM Implementation Review
    No content preview  ( 6 min )
    Reverse Engineering Coin Hunt World’s Binary Protocol
    No content preview  ( 28 min )
    Second-Order Code Injection Attacks
    No content preview  ( 6 min )
    Python Class Informer: an IDAPython plugin for viewing run-time type information (RTTI)
    No content preview  ( 6 min )
    Real World Cryptography Conference 2023 – Part I
    No content preview  ( 15 min )
    Public Report – Penumbra Labs R1CS Implementation Review
    No content preview  ( 6 min )
    Ransomware: what organisations can do to survive
    No content preview  ( 6 min )
    Scenester – A Small Tool for Cross-Platform Web Application
    No content preview  ( 6 min )
    Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 6: Development of Prototype #2 – Creating a SQLi PoC
    No content preview  ( 15 min )
    Ricochet Security Assessment Public Report
    No content preview  ( 6 min )
    pySimReader
    No content preview  ( 6 min )
    Revealing Embedded Fingerprints: Deriving Intelligence from USB Stack Interactions 2013
    No content preview  ( 6 min )
    Sakula: an adventure in DLL planting
    No content preview  ( 8 min )
    Samba _netr_ServerPasswordSet Expoitability Analysis
    No content preview  ( 10 min )
    Return of the hidden number problem
    No content preview  ( 6 min )
    SharkBot: a “new” generation Android banking Trojan being distributed on Google Play Store
    No content preview  ( 13 min )
    Reviewing Verifiable Random Functions
    No content preview  ( 13 min )
    Private sector cyber resilience and the role of data diodes
    No content preview  ( 6 min )
    Real World Cryptography Conference 2022
    No content preview  ( 25 min )
    Real World Cryptography Conference 2021: A Virtual Experience
    No content preview  ( 14 min )
    Secure Device Provisioning Best Practices: Heavy Truck Edition
    No content preview  ( 6 min )
    Public Report – Solana Program Library ZK-Token Security Assessment
    No content preview  ( 6 min )
    Readable Thrift (1)
    No content preview  ( 6 min )
    Secure Messaging for Normal People
    No content preview  ( 6 min )
    Ragweed
    No content preview  ( 6 min )
    RtspFuzzer
    No content preview  ( 6 min )
    Research Report – Zephyr and MCUboot Security Assessment
    No content preview  ( 7 min )
    Rise of the Sensors: Securing LoRaWAN Networks
    No content preview  ( 25 min )
    Research Insights Volume 4 – Sector Focus: Maritime Sector
    No content preview  ( 6 min )
    SecureCisco
    No content preview  ( 6 min )
    Sharkbot is back in Google Play
    No content preview  ( 11 min )
    Public Report – O(1) Labs Mina Client SDK, Signature Library and Base Components Cryptography and Implementation Review
    No content preview  ( 6 min )
    Secure Session Management With Cookies for Web Applications
    No content preview  ( 6 min )
    Research Insights Volume 7: Exploitation Advancements
    No content preview  ( 6 min )
    SecureIE.ActiveX
    No content preview  ( 6 min )
    SCOMplicated? – Decrypting SCOM “RunAs” credentials
    No content preview  ( 9 min )
    RIFT: Citrix ADC Vulnerabilities CVE-2020-8193, CVE-2020-8195 and CVE-2020-8196 Intelligence
    No content preview  ( 7 min )
    Ruxcon 2013 – Introspy Presentation Slides
    No content preview  ( 6 min )
    Rust for Security and Correctness in the embedded world
    No content preview  ( 12 min )
    Public Report – Zcash Zebra Security Assessment
    No content preview  ( 6 min )
    Ruling the rules
    No content preview  ( 11 min )
    Research Insights Volume 8 – Hardware Design: FPGA Security Risks
    No content preview  ( 6 min )
    Retro Gaming Vulnerability Research: Warcraft 2
    No content preview  ( 17 min )
    Shell Arithmetic Expansion and Evaluation Abuse
    No content preview  ( 10 min )
    Rigging the Vote: Uniqueness in Verifiable Random Functions
    No content preview  ( 10 min )
    Extracting the Payload from a CVE-2014-1761 RTF Document
    No content preview  ( 9 min )
    Conti-nuation: methods and techniques observed in operations post the leaks
    No content preview  ( 9 min )
    Padding the struct: How a compiler optimization can disclose stack memory
    No content preview  ( 15 min )
    Public Report – Protocol Labs Groth16 Proof Aggregation: Cryptography and Implementation Review
    No content preview  ( 6 min )
    Pentesting V. Red Teaming V. Bug Bounty
    Explore the differences between penetration testing, red teaming, and bug bounty programs. NCC Group helps you choose the right approach.  ( 9 min )
    Fake CAPTCHA led to LUMMA
    No content preview  ( 9 min )

  • Open

    Testing ChatGPT Agent Mode: A flawed concept?
    The new ChatGPT Agent Mode combines the Operator's ability to browse and interact with websites with Deep Research's ability to analyze and synthesize information from multiple sources. I tested ChatGPT's Agent Mode and was quite disappointed. Honestly, I find it surprising that OpenAI made this feature available to the public, considering that they have led the way with their chatbot so far. In my view, ChatGPT's Agent Mode is a flawed concept because it forces an AI agent to use a web browser, a relatively primitive tool designed for inferior human intelligence. Source

  • Open

    Policy and Disclosure: 2025 Edition
    ul.lst-kix_3v2pdbodo41s-8{list-style-type:none}ul.lst-kix_3v2pdbodo41s-7{list-style-type:none}ul.lst-kix_3v2pdbodo41s-6{list-style-type:none}li.li-bullet-0:before{margin-left:-18pt;white-space:nowrap;display:inline-block;min-width:18pt}.lst-kix_3v2pdbodo41s-5>li:before{content:"\0025a0 "}.lst-kix_3v2pdbodo41s-4>li:before{content:"\0025cb "}.lst-kix_3v2pdbodo41s-6>li:before{content:"\0025cf "}.lst-kix_3v2pdbodo41s-3>li:before{content:"\0025cf "}.lst-kix_3v2pdbodo41s-7>li:before{content:"\0025cb "}ul.lst-kix_3v2pdbodo41s-5{list-style-type:none}ul.lst-kix_3v2pdbodo41s-4{list-style-type:none}.lst-kix_3v2pdbodo41s-2>li:before{content:"\0025a0 "}ul.lst-kix_3v2pdbodo41s-3{list-style-type:none}.lst-kix_3v2pdbodo41s-8>li:before{content:"\0025a0 "}.lst-kix_3v2pdbodo41s-0>li:before{cont…  ( 12 min )

  • Open

    Crack the Riddle, Secure the Oasis: Core NetWars Version 11 is Here
    A blog about SANS Institute's new Core NetWars Version 11  ( 12 min )

  • Open

    Expanding on ChunkyIngress - Clippy Goes Rogue (GoClipC2)
    GoClipC2: A covert Windows clipboard-based C2 channel for VDI/RDP environments. Bypasses network monitoring with encrypted Base64 messaging.  ( 10 min )

  • Open

    The Cost Savings of Fixing Security Flaws in Development
    No content preview  ( 7 min )

  • Open

    A New Approach to Proving Cybersecurity Value (That Isn’t ROI)
    In this blog, we are excited to announce our white paper on Return on Mitigation (RoM), a framework we designed to quantify the financial impact of security programs in a way that speaks to business leaders.  ( 6 min )
    Celebrating 10 Years of Partnership: Snap and HackerOne Reach $1M in Bounties
    At Snap, security is more than a priority—it’s a core mission. Over the past decade, Snap has partnered with HackerOne to build and sustain a robust bug bounty program. This collaboration has led to major milestones, including paying security researchers over $1M in bounties. To celebrate this achievement and their 10-year partnership, we spoke with Jim Higgins, Snap's Chief Information Security Officer, Vinay Prabhushankar, Snap’s Security Engineering Manager, and Ilana Arbisser, Snap’s Privacy Engineer.

  • Open

    Women@ Kicks Off the Year with a Vision Board Event
    No content preview  ( 4 min )

  • Open

    Gain Actionable, Data-backed Insights with HackerOne Recommendations
    What if your security program could self-optimize: analyze trends, identify weak points, and proactively propose actionable steps to strengthen defenses? With HackerOne Recommendations, it can.  ( 5 min )

  • Open

    Welcome, Hackbots: How AI Is Shaping the Future of Vulnerability Discovery
    What are Hackbots and how are they impacting vulnerability discovery and the researcher community?  ( 6 min )

  • Open

    DORA Compliance Is Here: What Financial Entities Should Know
    The new DORA regulation: everything your organization needs to know about its impact and how to comply.  ( 5 min )

  • Open

    Protecting Critical Infrastructure: A Tale of Two National Cybersecurity Strategies
    The term “special relationship,” coined by Winston Churchill, describes the close, longstanding alliance between the United States and the United Kingdom. It has been applied to cooperation during war, to trade and commerce, and even to intelligence sharing. That special relationship has clearly influenced the two nations’ recent policy papers on national cybersecurity. The U.K. […] The post Protecting Critical Infrastructure: A Tale of Two National Cybersecurity Strategies appeared first on Synack.  ( 7 min )

  • Open

    Scoping Adventures: How to Get the Most Out of Your Synack Pentesting
    Scoping Adventures is a series of blogs about some of the more interesting penetration tests that the Synack Customer Success teams have worked on over the last few months. Each blog outlines how we engage with the client to achieve the best results from a pentest. Pentesters love colors—red, blue, purple, black, white and grey […] The post Scoping Adventures: How to Get the Most Out of Your Synack Pentesting appeared first on Synack.  ( 11 min )

  • Open

    Applying Strategic Thinking in Your Pentesting Program
    The Synack Platform & Five Pillars of Strategic Pentesting Why You Need to Think Strategically It’s no great revelation that tactics, techniques, and procedures utilized by nefarious hackers hacking activities are evolving on a daily basis. In 2022, 18,828 common vulnerabilities and exposures (CVEs) were published. At the same time, organization attack surfaces are expanding. […] The post Applying Strategic Thinking in Your Pentesting Program appeared first on Synack.  ( 7 min )

  • Open

    The U.S. has a new cybersecurity strategy. What’s next for CISOs?
    One week ago, the Biden administration unveiled its long-awaited U.S. National Cybersecurity Strategy, with an eye toward centralizing government cyber resources and holding IT vendors more accountable for their digital defenses. Now that the ink is dry on the 35-page document, top officials like Acting National Cyber Director Kemba Walden are busy putting it into […] The post The U.S. has a new cybersecurity strategy. What’s next for CISOs? appeared first on Synack.  ( 7 min )
2025-08-28T00:52:02.076Z osmosfeed 1.15.1