Source Byte
الذهاب إلى القناة على Telegram
هشیار کسی باید کز عشق بپرهیزد وین طبع که من دارم با عقل نیامیزد Saadi Shirazi 187
إظهار المزيد8 532
المشتركون
+924 ساعات
+417 أيام
+22630 أيام
أرشيف المشاركات
8 532
درود. من یک مطلب کوتاهی نوشتم برای درک پروسه‌ای که توی کرنل رخ می‌ده موقع Null-dereference (معماری x86) و مقداری در مورد Virtual Memory Management کرنل صحبت کردم. شاید برای بچه‌هایی که روی آسیب‌پذیری‌های سمت کرنل کار می‌کنن هم جالب باشه:
https://imanseyed.github.io/posts/the-flow-of-the-kernel-upon-receiving-a-sigsegv-for-null-dereferene/
8 532
Unauthenticated SSRF on Havoc C2 teamserver via spoofed demon agent
Credit : Evan Ikeda
https://blog.chebuya.com/posts/server-side-request-forgery-on-havoc-c2/
8 532
Emulating inline decryption for triaging C++ malware
Blog
References Glory Sprout string decryptor: gsprout_string_decryption.py Glory Sprout Hash resolver: gsprout_api_resolver.py GlorySprout sample: Malwarebazaar Insight from GlorySprout and Taurus Stelaer: RussianPanda Research Blog Let’s play (again) with Predator the thief An In-Depth analysis of the new Taurus Stealer#malware_analysis
8 532
Windows Internals Learning Resources
credit : Patrick Matula
A summary of learning resources in the categories:
+ Windows Internals + Windows Debugging and Troubleshooting + Windows Performance + Windows Programminghttps://github.com/pmatula/Windows-Internals-Learning-Resources
8 532
IAT-Tracer V2
IAT-Tracer V2 is a plugin for Tiny-Tracer framework Now, you can automatically trace and watch any Windows API function a binary uses, whether imported or *dynamically resolved*.
credit : Yoav Levi
https://github.com/YoavLevi/IAT-Tracer
8 532
Repost from 1N73LL1G3NC3
Ghostly Hollowing Via Tampered Syscalls
Implementing the ghostly hollowing (a hybrid technique between Process Hollowing and Process Ghosting) PE injection technique using tampered syscalls (to bypass userland hooks while simultaneously spoofing the invoked syscall's arguments).
8 532
New maldev academy module https://x.com/MalDevAcademy/status/1810659900218855536?t=tTCrTdfyJLNWI020OYN6Lg&s=19dive sleep obfuscation Credit: Austin Hudson [ Explanation -> Src ] #maldev #malware_dev
8 532
![Red Team infrastructure hardening resources [+] GitHub This wiki is intended to provide a resource for setting up a resilient](data:image/jpeg;base64,/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDACgcHiMeGSgjISMtKygwPGRBPDc3PHtYXUlkkYCZlo+AjIqgtObDoKrarYqMyP/L2u71////m8H////6/+b9//j/2wBDASstLTw1PHZBQXb4pYyl+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj/wAARCAARACgDASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwDPooooAAKkjjDvjOB1zTBU6KqFGZzHuz82OgoAjdNhxz7Zop8kOBuDlh1BzmigCCiiigB1JN/q0+tFFAD7b/UXH0H8xRRRQB//2Q==)
Red Team infrastructure hardening resources
[+] GitHub
This wiki is intended to provide a resource for setting up a resilient Red Team infrastructure. It was made to complement Steve Borosh (@424f424f) and Jeff Dimmock's (@bluscreenofjeff) BSides NoVa 2017 talk "Doomsday Preppers: Fortifying Your Red Team Infrastructure" (slides)[ Slides ] #c2 #redteam
8 532
CBS - Custom Breakpoint Setter
This is an IDA Plugin powered by Python that sets a disabled breakpoint on specific instruction's mnemonic.
credit : AmirMohammad Jahangirzad
https://github.com/Reodus/CBS
8 532
Research into removing strings & API call references at compile-time (Anti-Analysis)
GitHub
An example in C/C++ of how we can remove static string & function call references by using obfuscation paired with runtime function pointers. As a result, static analysis using tools such as IDA or x64Dbg increases in time/difficulty. You may be able to hide specific API calls from anti-malware systems. On the other hand, some AVs might also flag this behavior as being malicious due to there being a lack of "real looking behavior" in the binary.#malware_dev #evasion
