𝙍𝙤𝙤𝙩𝙎𝙚𝙘
Open in Telegram
Free content of OFF-SEC, SANS, ec-council, INE, eLearnSecurity, udemy coupons and many more #Malware_analysis #RootSec
Show more1 774
Subscribers
+224 hours
+127 days
+2830 days
Posts Archive
1 774
#AIOps
#Threat_Research
"FragBench: Cross-Session Attacks Hidden in Benign-Looking Fragments", May 2026.
// FragBench - benchmark pipeline for evaluating whether LLM agents can complete multi-step attack chains when prompts are fragmented, rewritten, and executed through tool access. The workflow has three stages: generate fragment datasets from campaign seeds, optionally rewrite then validate execution through the Dockerized MCP agent harness
1 774
#tools
#NetSec
"GhostLock: SMB Deny-Share Handles as a Zero-Privilege Availability Weapon", May 2026.
]-> https://github.com/kimd155/ghostlock
// GhostLock demonstrates that a low-privileged Windows domain user with standard read access to an SMB share can produce ransomware-equivalent organizational availability impact with zero writes, zero encryption, and zero signals in every behavioral defense the modern enterprise security stack deploys
1 774
#AIOps
#MLSecOps
#Whitepaper
"AI Security Maturity Model:
A Practical Framework for Building a Mature AI Security Program", May 2026.
// This framework was developed in alignment with the OWASP AI Exchange and the OWASP Agentic Top 10, incorporating SANS's formal partnership with OWASP on AI security standards, and maps to NIST AI RMF, ISO 42001, and CSA AICM. It is the connective tissue between what the broader security community has agreed upon and what your team actually implements in day-to-day practice
1 774
#Research
"Benchmarking Large Language Models for IoC Recovery under Adversarial Code Obfuscation and Encryption", May 2026.
]-> https://github.com/jaimemorales52/llm-ioc-detection
// This paper introduces a systematic benchmark for secret detection under adversarial code transformations, designed to evaluate the capacity of LLMs to recover IoCs embedded in obfuscated and encrypted JavaScript programs
1 774
#Malware_analysis
1⃣ PamDOORa Linux PAM-Based Backdoor
https://flare.io/learn/resources/blog/pamdoora-new-linux-pam-based-backdoor-sale-dark-web
2⃣ Fake Claude site spreads backdoor
https://www.sophos.com/en-us/blog/donuts-and-beagles-fake-claude-site-spreads-backdoor
3⃣ New TrickMo Variant
https://www.threatfabric.com/blogs/new-trickmo-variant-device-take-over-malware-targeting-banking-fintech-wallet-auth-app
1 774
Repost from CrackCodes 🇮🇳
SYSTEM32 SHUTDOWN
Now All system32.in Resources are Now Available On Crackcodes.in
👉 All System32.in User accounts also work on Crackcodes.in
1 774
#Purple_Team_Exercises
Cross-Session Activation
https://ipurple.team/2026/05/04/cross-session-activation
// Cross-Session activation attacks enable threat actors to run code or commands under the context of another user (local) or perform lateral movement (remote). Although the blast radius is limited by the requirement to identify hosts with interactive sessions in which the compromised user has privileges, the technique is considered highly effective, and detection has several constraints..
1 774
#NetSec
#Fuzzing
#Mobile_security
"ARIstoteles - Dissecting Apple’s Baseband Interface",
Apr. 2026.
]-> Wireshark dissector for ARI protocol + ghidra scripts
// reverse-engineering and fuzz-test the ARI interface on iOS. Ghidra scripts automatically generate a Wireshark dissector, called ARIstoteles, by parsing closed-source iOS libraries for this undocumented protocol
1 774
#Hardware_Security
"GPUBreach: Privilege Escalation Attacks on GPUs using Rowhammer", Apr. 2026.
]-> https://gpubreach.ca
]-> Repo
// GPUBreach shows that GPU Rowhammer attacks can move beyond data corruption to real privilege escalation. By corrupting GPU page tables, an unprivileged CUDA kernel can gain arbitrary GPU memory read/write, and then chain that capability into CPU-side escalation by exploiting newly discovered memory-safety bugs in the NVIDIA driver. The result is system-wide compromise up to a root shell, without disabling IOMMU, unlike contemporary works, making GPUBreach a more potent threat
1 774
#NetSec
"One Char to Rule Them All:
Systematically Exploring and Exploiting DNS Silent Vulnerabilities in Domain Name Resolution", BlackHat Asia 2026.
// we conducted the first systematic study of special character handling logic in DNS, reviewing DNS RFCs and analyzing 31 widely-used DNS software implementations through source code review and gray-box testing. Our systematic analysis reveals two new DNS logic vulnerabilities arising from inconsistencies and silent handling behaviors, leading to two classes of attacks that affect all DNS roles, including stub resolvers, forwarders, recursive resolvers, and authoritative nameservers
See also:
]-> RebirthDay Attack: Reviving DNS Cache Poisoning with the Birthday Paradox (.pdf)
1 774
#IoT_Security
#Automotive_Security
"When Flash Reveals Its Secrets:
Advanced Glitching Leveraging Hidden CPU-eMMC Behavior", BlackHat Asia 2026.
]-> https://github.com/xcatx9527/wfm_cmp
// Complete process of successfully bypassing Secure Boot on real embedded devices using this method and reveal the physical leakage paths that exist between the CPU and peripheral storage during runtime
1 774
#Hardware_Security
"Qualcomm BootROM:
A journey through Sahara", BlackHat Asia 2026.
// This Briefing will present a comprehensive analysis of new vulnerabilities found by our team at the BootROM level: vulnerabilities in Emergency Download Mode and its Sahara protocol, which allow bypassing cryptographic verification of Secondary Boot Loader images and subsequent boot stages
See also:
]-> BlackHat Asia 2026 - ALL Briefings
1 774
#AppSec
#Fuzzing
#Space_Security
"Security Advisory CFITSIO Library", Apr. 2026.
]-> CFITSIO Fuzzing: Memory Corruptions and a Codex-Assisted Pipeline
// Fuzzing CFITSIO v.4.6.3 revealed 16 security vulnerabilities related to filename parsing and memory handling
1 774
#WebApp_Security
#Infosec_Standards
"Securing Web Transactions:
TLS Server Certificate Management",
June 2020.
// Volumes A, B provide enterprises with actionable guidance to help them establish and implement a formal TLS server certificate management program. Vol.C explains the approach, architecture, and security characteristics of the example solution demonstrated in NCCoE laboratory, and Vol.D contains the how-to-guides with instructions for building the example solution
1 774
#tools
#exploit
#Offensive_security
Hooking Windows Named Pipes
https://www.synacktiv.com/publications/hooking-windows-named-pipes.html
// The article introduces a Frida-based tool, Thats No Pipe, which intercepts system calls to read/write data on Named Pipes, enabling data modification and injection in non-privileged processes
1 774
#tools
#AIOps
"Beyond Pattern Matching: Seven Cross-Domain Techniques for Prompt Injection Detection", Apr. 2026.
]-> Prompt-shield
// Open-source prompt injection firewall for LLM Apps. Combines 27 input detectors (10 languages, 7 encoding schemes, Smith-Waterman sequence alignment for paraphrased attacks), 6 output scanners (toxicity, code injection, prompt leakage, PII, schema validation, jailbreak detection), a semantic ML classifier (DeBERTa), parallel execution, and a self-hardening feedback loop that gets smarter with every attack
1 774
#Threat_Research
"Terminal Wrench: A Dataset of 331 Reward-Hackable Environments and 3,632 Exploit Trajectories", Apr. 2026.
]-> https://github.com/few-sh/terminal-wrench
1 774
#exploit
#NetSec
#Kernel_Security
Out-of-Cancel: A Vulnerability Class Rooted in Workqueue Cancellation APIs
https://v4bel.github.io/linux/2026/03/23/ooc.html
// In this work, a race-based vulnerability class arising from the usage patterns of the cancel_work_sync() and cancel_delayed_work_sync() APIs is organized under the name Out-of-Cancel and it is shown that the same issue can repeatedly appear in teardown paths across multiple network subsystems, including espintcp. The core of this bug class is that "cancellation" does not guarantee that a work item will never be scheduled again, which creates a critical gap between object lifetime management and worker scheduling
