Source Byte

Advanced Software Exploitation by Ptrace Security, 2019 In the first half of the course, attendees will use fuzzing, reverse engineering, and source code auditing, to attack a wide variety of applications (e.g. iTunes, Firefox, Vulnserver, etc.) and then use proven exploitation techniques to develop an exploit for one of the VMs (Windows 7, Windows 8.1 and Windows 10). Then, in the second half of the course, the focus will shift from classic vulnerabilities to more advanced ones. In this section, students will learn how to escape Java sandbox using a type confusion vulnerability, how to circumvent the ASLR without pointer leaks, and how to use precise heap spraying, just to name a few. By the end of this course, students will know how to find software vulnerabilities using fuzzing, reverse engineering, and source code auditing, and then how to write their own exploits in Python, JavaScript, or Java. GitHub About the course Official page #education #reverse #coding #python

Anatomy of Offensive Tool Development credit : Alex Reid https://redsiege.com/blog/2024/01/graphstrike-developer/

Program in C

Donex a new ransomware gang malware technical analysis https://www.shadowstackre.com/analysis/donex #malware_analysis

UNDERSTANDING A PAYLOAD’S LIFE Featuring Meterpreter & other guests credit : Daniel López Jiménez

winsos-poc: A PoC demonstrating code execution via DLL Side-Loading in WinSxS binaries. https://github.com/thiagopeixoto/winsos-poc.git

Аналог GetProcAddress, но написан на ассемблере. Гуд... https://github.com/WKL-Sec/FuncAddressPro #redteam #maldev #evasion

SyzRetrospector: A Large-Scale Retrospective Study of Syzbot credit : Ardalan Amiri Sani , Zhiyun Qian

#memes

The HKEY_CLASSES_ROOT (HKCR) key in the Windows registry is a merged view of the HKEY_LOCAL_MACHINE\Software\Classes and HKEY_CURRENT_USER\Software\Classes keys. By default, only users with administrator privileges can modify the keys and values under HKCR. If a non-administrator user attempts to write to a key under HKCR, and the key already exists under HKEY_CURRENT_USER\Software\Classes, the system will store the information there instead of under HKEY_LOCAL_MACHINE\Software\Classes. However, writing directly to HKCR typically requires administrator access because it affects system-wide settings²³.

In the simplest terms possible, this registry hive contains the necessary information for Windows to know what to do when you ask it to do something, like to view the contents of a drive, or open a certain type of file, etc. HKEY_CLASSES_ROOT\.avi HKEY_CLASSES_ROOT\.bmp HKEY_CLASSES_ROOT\.exe HKEY_CLASSES_ROOT\.html HKEY_CLASSES_ROOT\.pdf HKEY_CLASSES_ROOT\AudioCD HKEY_CLASSES_ROOT\dllfile ... Each of these keys stores information on what Windows should do when you double-click or double-tap a file with that extension in File Explorer. It might include the list of programs found in the "Open with..." section when right-clicking/tapping a file, and the path to each application listed. For example, when you open a file called draft.rtf, WordPad might open it. The registry data that makes that happen is stored in the HKEY_CLASSES_ROOT\.rtf key, which defines WordPad as the program that should open the RTF file.