2026-04-27T20:45:01Z https://yabu.me raptor :C_H: https://yabu.me/npub137swhpts57chhtgttt4tm23qprkjw7dh87v3fgck8sgyu8q0zy0q7u50fd https://media.infosec.exchange/infosec.exchange/accounts/avatars/109/286/695/100/533/910/original/83410d967c323e07.png https://media.infosec.exchange/infosec.exchange/accounts/avatars/109/286/695/100/533/910/original/83410d967c323e07.png https://yabu.me/nevent1qqs9mgk9vcl29j9uycuxy02dq6fg4hxdanj0w9ea28kczktmmdaw4hgzyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3uj2yq6t RIP one of our favorite techniques to bypass #PaloAlto #Cortex #XDR 🤷 <br/><br/><a href="https://labs.infoguard.ch/posts/decrypting-and-abusing_paloalto-cortex-xdr_behavioral-rules_biocs/">https://labs.infoguard.ch/posts/decrypting-and-abusing_paloalto-cortex-xdr_behavioral-rules_biocs/</a> 2026-03-24T05:25:20Z https://yabu.me/nevent1qqstq7frc22rnzzsa4x88elvsmyxfd047sfeh6ztd7fvyx9gn8f4nrgzyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3u4k7tv6 For my #Rust projects, I’ve finally migrated from #RustRover to <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1zxthua9ysn47c0l3fdj23hwh9pp25m3tez2pjskdce0vftzzc0eq33pwx0" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Zed</span> (<span class="italic">npub1zxt…pwx0</span>)</a></span>. <br/><br/>RR is a great IDE, but it feels much too bloated for me. #Zed, on the other hand, is a pleasure to use. So smooth!<br/><br/>Here’s my current config including a beautiful theme based on monokai-pro <a href="https://github.com/0xdea/dotfiles/tree/main/zed/.config/zed">https://github.com/0xdea/dotfiles/tree/main/zed/.config/zed</a><br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/225/846/089/104/604/original/6a31647377a1cba6.png"> <br/> 2026-03-14T05:21:12Z https://yabu.me/nevent1qqsvulkyewmqwz58tny20nj4s9ahnd76nh8d9cxwtfcrwqfmf6px2nqzyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3ujkx2na <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub17wvr8uywpuzew2lqvprnt4g7cuq0kyvdf8gz57dlv3rsjvfcer3qqgnag2" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>buherator</span> (<span class="italic">npub17wv…nag2</span>)</a></span> have you seen this? <a href="https://hex-rays.com/blog/plugin-spotlight-dbimporter">https://hex-rays.com/blog/plugin-spotlight-dbimporter</a> 2026-02-24T20:00:11Z https://yabu.me/nevent1qqsydymfqdngx9kq20hu6jk05rz3u8h2kstsd2rmrdautxstxtga7wqzyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3uv9572w Just shipped updates for rhabdomancer, haruspex, and augur. Now compatible with <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1wx2h7sduvqnfydhvt68vdyt7k9ecj2vykuh3znvu9w9zhu09ljfsusr8kv" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Hex-Rays SA</span> (<span class="italic">npub1wx2…r8kv</span>)</a></span> IDA 9.3 and <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub16xnrzagru4r0axh7macghhqfcgdwu6rq8c9dweklxay3a2h7mf5qa6y2dt" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>xorpse</span> (<span class="italic">npub16xn…y2dt</span>)</a></span>&#39;s idalib-rs 8.0.<br/><br/>These headless #IDA plugins are built for #VulnerabilityResearch workflows where you want IDA&#39;s power without the GUI. This release brings a bunch of small improvements and bug fixes.<br/><br/><a href="https://hnsecurity.it/blog/streamlining-vulnerability-research-with-the-idalib-rust-bindings-for-ida-9-2/">https://hnsecurity.it/blog/streamlining-vulnerability-research-with-the-idalib-rust-bindings-for-ida-9-2/</a> 2026-02-20T08:57:46Z https://yabu.me/nevent1qqs2lsc5p5k32sqs3q23yn5zh40ur7c8w004pr70dxmzws20rwgxkaszyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3uh07jd3 the watchers: how #openai, the US government, and #persona built an identity #surveillance machine that files reports on you to the feds<br/><br/><a href="https://vmfunc.re/blog/persona/">https://vmfunc.re/blog/persona/</a> 2026-02-19T06:49:51Z https://yabu.me/nevent1qqs00fkzm0gaqp3nq7uq98l7ax3jzqlay02u6pylktv2lq9k03g09uqzyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3un5uy67 Today is an excellent day to enjoy free, ad-free, non-stop #MTV #nostalgia <br/><br/><a href="https://wantmymtv.vercel.app/">https://wantmymtv.vercel.app/</a><br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/063/157/870/236/365/original/171ca1783ee56c07.jpeg"> <br/> 2026-02-13T11:47:27Z https://yabu.me/nevent1qqsv09fe43lhf2xecssxc5nkk6p9whu2uu2luuaz9lvyjz0z98hertgzyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3u52ntrt This is another incredible #talk from <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1zze7355mx7c3alpz4phsn7fkmetj8sv3cmhegx098xjf8u3exlas0t4ut8" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>RE//verse Conference</span> (<span class="italic">npub1zze…4ut8</span>)</a></span> 2025 <br/><br/>Full-stack Reverse Engineering of the Original Microsoft #Xbox (Markus Gaasedelen <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1yhpr8842sgkyksdyycw4j37dcpggkue4sfuvedtefrjrv96e7d3skhnsy6" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>gaasedelen</span> (<span class="italic">npub1yhp…nsy6</span>)</a></span>)<br/><br/><a href="https://youtu.be/hGlIkgmhZvc">https://youtu.be/hGlIkgmhZvc</a> 2026-02-12T16:50:52Z https://yabu.me/nevent1qqs23n2m84keg6mxk5cx20uvrwpgxsll58xgmvz0ayqkj7ydyapxseszyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3ucmduwa The path to #pwning the PS VR2 (part 1) - &#34;Recovery mode&#34; &lt;- yet another case study on how assumptions should always be checked in practice 🤷<br/><br/><a href="https://bnuuy.solutions/2026/02/01/ps-vr2-recovery-mode.html">https://bnuuy.solutions/2026/02/01/ps-vr2-recovery-mode.html</a> 2026-02-05T13:11:31Z https://yabu.me/nevent1qqsq0frqfamekauxd9m0gyf4x4pzwvdfm3tm67e2p4tvakxdky5cchszyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3u75shr5 While waiting for the upcoming release of #IDAPro 9.3 by <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1wx2h7sduvqnfydhvt68vdyt7k9ecj2vykuh3znvu9w9zhu09ljfsusr8kv" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Hex-Rays SA</span> (<span class="italic">npub1wx2…r8kv</span>)</a></span>, I have made some updates and bug fixes to my idalib-based headless IDA #plugins rhabdomancer, haruspex, and augur. <br/><br/>Check out the changelogs for all the details and enjoy!<br/><br/><a href="https://hnsecurity.it/blog/streamlining-vulnerability-research-with-the-idalib-rust-bindings-for-ida-9-2/">https://hnsecurity.it/blog/streamlining-vulnerability-research-with-the-idalib-rust-bindings-for-ida-9-2/</a> 2026-02-05T07:52:32Z https://yabu.me/nevent1qqsrptkltrn0w47r6mx3743vrkw4ltjkfwamaev0w0rcsx6qhsjpuqszyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3usshz3k RE: <a href="https://mastodon.social/@XC3LL/115990518822402879">https://mastodon.social/@XC3LL/115990518822402879</a><br/><br/>Very valuable insight if you are into #redteaming<blockquote class="border-l-05rem border-l-strongpink border-solid"><div class="-ml-4 bg-gradient-to-r from-gray-100 dark:from-zinc-800 to-transparent mr-0 mt-0 mb-4 pl-4 pr-2 py-2">quoting <br/><span itemprop="mentions" itemscope itemtype="https://schema.org/Article"><a itemprop="url" href="/note1e6a2fx55r6xckckq5w2rsczpkxf730gcneqrspdrkapnq55u4vfq0sl4y7" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1">note1e6a…l4y7</a></span><br/> </div> A small rant:<br/><br/>The State of Art in Red Team is whatever you want to believe<br/><br/><a href="https://x-c3ll.github.io/posts/Rant-Red-Team/">https://x-c3ll.github.io/posts/Rant-Red-Team/</a> </blockquote> 2026-02-01T16:54:38Z https://yabu.me/nevent1qqsvejxravzd2scntar4uflkl7hwmktc2ymllkayuvv6a8vd9wpp2lgzyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3u4pkd9j Can You Write A Web Server in PURE #BASH?! (no socat, no netcat, no external tools)<br/><br/><a href="https://www.youtube.com/watch?v=L967hYylZuc">https://www.youtube.com/watch?v=L967hYylZuc</a> 2026-01-21T15:49:50Z https://yabu.me/nevent1qqsdwj4hw5q8am4ujxsa8epzngzydyw9mzg4xmnt7xp7z9rw0t9cucszyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3uuyl5lg root@kaka:~ sudo apt-get install inetutils-telnetd telnet<br/>root@kaka:~ sudo sed -i &#39;s/#&lt;off&gt;# telnet/telnet/&#39; /etc/inetd.conf <br/>root@kaka:~ sudo /etc/init.d/inetutils-inetd start<br/>root@kaka:~ USER=&#39;-f root&#39; telnet -a localhost<br/>...<br/>root@kaka:~# <br/><br/><a href="https://seclists.org/oss-sec/2026/q1/89">https://seclists.org/oss-sec/2026/q1/89</a> 2026-01-20T18:07:24Z https://yabu.me/nevent1qqswncrjmze2v4678cpk423surqswd2csjgayjyu98h4vpp4fvrksngzyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3uf6z7q4 We are here<br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/808/686/767/699/248/original/ad318d35d29b9bc0.jpeg"> <br/> 2025-12-30T13:12:06Z https://yabu.me/nevent1qqsd6efvg45ultj2gs2qskx8p7c465e4lahwm2ywzfu5mnt4m3ds8kczyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3uxlru0j “We learn different lessons from finishing projects than we do from starting them. Starting teaches us about ideation and initial implementation. Finishing, on the other hand, teaches us about perseverance, attention to detail, and the art of knowing when to let go. These are invaluable skills that can only be honed through the act of completion.”<br/><br/><a href="https://www.bytedrum.com/posts/art-of-finishing/">https://www.bytedrum.com/posts/art-of-finishing/</a> 2025-12-29T07:54:58Z https://yabu.me/nevent1qqsqzc9r2j07rr4aveksnwejsvl6nwk6z3w9tfj2dkyv0gq7stgvm6czyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3ueqjg8n #PoC for CVE-2025-65945 (Improper Verification of Cryptographic Signature in node-jws)<br/><br/><a href="https://github.com/jedisct1/CVE-2025-65945-poc">https://github.com/jedisct1/CVE-2025-65945-poc</a> 2025-12-19T07:36:13Z https://yabu.me/nevent1qqswtfgxku25ycklaww9s4ypvyc74ah8mce20gqshfpnyzrqa30008qzyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3urv8hjv #FreeBSD-SA-25:12.rtsold Security Advisory<br/><br/>Remote code execution via ND6 Router Advertisements<br/><br/><a href="https://www.freebsd.org/security/advisories/FreeBSD-SA-25:12.rtsold.asc">https://www.freebsd.org/security/advisories/FreeBSD-SA-25:12.rtsold.asc</a> 2025-12-19T07:35:23Z https://yabu.me/nevent1qqs8e5gfz75yq69xymmkynnjrgk84pu89t495ph6gzv57vs9ergqewszyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3ud0rx2l This is my experience with LLMs. To paraphrase <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1mdhlmqg8dcwa4dx3yls0sgk7c79ezayh3q5r3l3tevf9nmy4sqlsvt52t9" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Federico Dotta</span> (<span class="italic">npub1mdh…52t9</span>)</a></span> “sometimes you just need to ask nicely”<br/><br/><a href="https://hnsecurity.it/blog/attacking-genai-applications-and-llms-sometimes-all-it-takes-is-to-ask-nicely/">https://hnsecurity.it/blog/attacking-genai-applications-and-llms-sometimes-all-it-takes-is-to-ask-nicely/</a><br/><a href="https://mastodon.cloud/@slashdot/115742100395423331">https://mastodon.cloud/@slashdot/115742100395423331</a> 2025-12-18T19:02:02Z https://yabu.me/nevent1qqsgyq7vf45mrluc72kgfpv4g00z2c7p8ur7ag4xx4dqd8yc38gsp8qzyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3us3y6kn A cool new project by a friend<br/><br/>Zynk - Move anything<br/>Between everything<br/><br/>Send folders, photos, and multi‑gig archives across phones, laptops, TVs, and servers. End‑to‑end encrypted, resumable, no size limits.<br/><br/><a href="https://zynk.it/">https://zynk.it/</a> 2025-12-07T10:01:47Z https://yabu.me/nevent1qqsrx6ny9qj8dqxj5ugfff55w0gykk2kf7g6ug4hjjcsdfwu3nhcdcqzyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3uhfhy4u Hey developers and vulnerability researchers!<br/><br/>I&#39;m currently working on improving my #Semgrep ruleset for C/C++ static code analysis, and I&#39;ve just published the new v1.1.0 release: <a href="https://github.com/0xdea/semgrep-rules">https://github.com/0xdea/semgrep-rules</a><br/><br/>Some notable changes since the previous battle-tested release: new rules for detecting high-entropy assignments and ReDoS vulnerabilities, numerous enhancements to existing rules, reduced false positives without sacrificing coverage, optimized patterns across the board, and overall better documentation. Check the changelog for the full list (yes, there’s a changelog now).<br/><br/>Please test it inside and out, and feel free to open issues or submit pull requests. Your feedback is invaluable and will help shape the project roadmap. I&#39;m aiming for a major release sometime before spring. 2025-12-03T15:17:36Z https://yabu.me/nevent1qqs8fvtztk83t87vyrv5fnnyse3wj8jn5u4kvwy4pzagy88lafpxkfczyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3uqvfms5 In reply to <a href='/nevent1qqswzwxlnmdnlkdg9f266acq66y3n4scy9fq0hq70j7qgvw65y550yqc7yru8'>nevent1q…yru8</a><br/>_________________________<br/><br/>does it depend on Frida by any chance? 😅 2025-10-17T16:22:09Z https://yabu.me/nevent1qqstjdvzvghu6jmweduzgwsy3hkywpn3qx4kfe3mdvqf7pwk03r0qzszyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3u5argfz Heads up to anyone doing #Mobile #ReverseEngineering and #PenetrationTesting: I&#39;ve just ported my <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub17rvk0cg8cq7wcrnf5tv7zqm3yh5g87kad059qtcq7p30n8mdqkmqf2x5dh" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>NowSecure</span> (<span class="italic">npub17rv…x5dh</span>)</a></span> #Frida instrumentation scripts (#iOS and #Android) to Frida 17, which introduced some breaking changes in the API. <br/><br/>The original, battle-tested scripts from 2017 are preserved as release 0.1 for retro compatibility and historical reference.<br/><br/><a href="https://github.com/0xdea/frida-scripts">https://github.com/0xdea/frida-scripts</a><br/><br/>Happy hacking! 🏴‍☠️🪐 2025-10-03T07:27:44Z https://yabu.me/nevent1qqsfhv9h5hlpkldttwfs9ur2akjkds7sxx4sru5976yzewhywwxw30czyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3u2cv39x #Styx Emulator Public Release (a #Rust-based #QEMU Alternative)<br/><br/><a href="https://stumbl.ing/posts/styx-emulator-release/">https://stumbl.ing/posts/styx-emulator-release/</a> 2025-10-02T08:06:22Z https://yabu.me/nevent1qqsz34m4sjqhskvmgy4u8hyqnkrantc65n70053tt89hugcspeymr0czyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3um88u5j Great VR talk by <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1pykre7ctlpzxjh20jwkcmgwzvn8t3q9xvy4tzqtdz2g2shgr3ktsjfmdt8" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>leonjza :verified:</span> (<span class="italic">npub1pyk…mdt8</span>)</a></span> at #RomHack2025<br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/275/888/060/179/225/original/5bd40ea275e8e912.jpeg"> <br/> 2025-09-27T10:54:35Z https://yabu.me/nevent1qqs9k509s3krve040hvxyhm0rzgcsuqelp3e04xa3r5tztw6h0st6qczyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3ujtgawc In reply to <a href='/nevent1qqszcu0gzg8yz7z7dqyqwgkmpxq3tqsdyagds25cuthxqgaeupm6tdcpjhmrz'>nevent1q…hmrz</a><br/>_________________________<br/><br/>Dirk-jan is a friend and a fantastic hacker, but I don’t think he was the original discoverer of ZeroLogon <a href="https://dirkjanm.io/a-different-way-of-abusing-zerologon/">https://dirkjanm.io/a-different-way-of-abusing-zerologon/</a> 2025-09-17T18:15:41Z https://yabu.me/nevent1qqsqteefg9z92shma8qhdz5q9ddf7mr805h6cken9k7pg03lgxd27kgzyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3utpfzds I&#39;ve updated my #VulnerabilityResearch and #ReverseEngineering tools to use the latest version of [@binarly_io](<a href="https://bird.makeup/users/binarly_io">https://bird.makeup/users/binarly_io</a> ) award-winning #idalib #Rust bindings, which support <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1wx2h7sduvqnfydhvt68vdyt7k9ecj2vykuh3znvu9w9zhu09ljfsusr8kv" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Hex-Rays SA</span> (<span class="italic">npub1wx2…r8kv</span>)</a></span> IDA Pro 9.2 and their freshly open-sourced SDK.<br/><br/>#Rhabdomancer - Vulnerability research assistant that locates calls to potentially insecure API functions in a binary file.<br/><a href="https://github.com/0xdea/rhabdomancer">https://github.com/0xdea/rhabdomancer</a><br/><br/>#Haruspex - Vulnerability research assistant that extracts pseudo-code from the IDA Hex-Rays decompiler.<br/><a href="https://github.com/0xdea/haruspex">https://github.com/0xdea/haruspex</a><br/><br/>#Augur - Reverse engineering assistant that extracts strings and related pseudo-code from a binary file.<br/><a href="https://github.com/0xdea/augur">https://github.com/0xdea/augur</a><br/><br/>For additional details:<br/><a href="https://security.humanativaspa.it/streamlining-vulnerability-research-with-ida-pro-and-rust/">https://security.humanativaspa.it/streamlining-vulnerability-research-with-ida-pro-and-rust/</a> 2025-09-16T10:43:51Z https://yabu.me/nevent1qqsdfysfudf6swj43r3f3tzpxgfsahlv005sagm0rthu55rjesuldvczyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3uyqh80f Entertaining and inspiring #pwn2own #xdev writeup 👏 (also from a few months back)<br/><br/>#Lorex 2K Indoor Wi-Fi Security Camera: RCE #Exploit Chain<br/><br/><a href="https://github.com/sfewer-r7/LorexExploit">https://github.com/sfewer-r7/LorexExploit</a><br/><br/><a href="https://www.rapid7.com/globalassets/_pdfs/research/pwn2own-iot-2024-lorex-2k-indoor-wi-fi-security-camera-research.pdf">https://www.rapid7.com/globalassets/_pdfs/research/pwn2own-iot-2024-lorex-2k-indoor-wi-fi-security-camera-research.pdf</a> 2025-08-30T10:47:36Z https://yabu.me/nevent1qqs86vf9fjyzlf7za7fnzq2f8xvk9q3njtl4wd5nurs3r3nu939n4gqzyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3u6p5j02 Eight years later, I’ve updated my most-starred <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1545e5cp26gheece3ggtv3mmqtcp6pavx2sjfmjr02u0q5tqlxhrse8mva5" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Github</span> (<span class="italic">npub1545…mva5</span>)</a></span> repository with some new <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1ne952pduk6ckhfp3nwh6tf9u09245rqg9g578qfkyw2wvvzae6uqkg0uhz" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Frida</span> (<span class="italic">npub1ne9…0uhz</span>)</a></span> scripts, inspired by <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1xwzkxxzq7a9k9l8dykelvjdkmazk3adv57v5lrrt29vl0vu8ewlsrjc2zl" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>spaceraccoon | Eugene Lim</span> (<span class="italic">npub1xwz…c2zl</span>)</a></span>&#39;s new book “From Day Zero to Zero Day”.<br/><br/>Check it out: <a href="https://github.com/0xdea/frida-scripts/">https://github.com/0xdea/frida-scripts/</a> 2025-08-28T13:09:54Z https://yabu.me/nevent1qqsvlgtt86aq0d2fq2tppuwr0z6neqt7nvul0xr609m4ma8g422avgszyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3urcfef5 I had missed this #linux #kernel discussion about #pathtraversal #vulnerabilities<br/><br/>[RFC] Add a prctl to disable &#34;..&#34; traversal in path resolution<br/><br/><a href="https://lore.kernel.org/linux-fsdevel/20241211142929.247692-1-mjg59@srcf.ucam.org/T/#u">https://lore.kernel.org/linux-fsdevel/20241211142929.247692-1-mjg59@srcf.ucam.org/T/#u</a> 2025-08-28T09:04:56Z https://yabu.me/nevent1qqsghe6scfeqmee6ccvrqrckf8hp98k5jxg08exunnzxmv4jvpqkp0czyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3uj3cxvl How it was to scan the whole Internet in 1998. Don’t skim over week 3, when an actual APT shows up 🍿 <br/><br/>The #Internet #Auditing Project (beta 1)<br/><br/><a href="https://www.focb.co.nz/audit/">https://www.focb.co.nz/audit/</a> 2025-08-27T06:11:53Z https://yabu.me/nevent1qqs2zsunrn3ux3p67swsr77vj8dr34x3hvhj4xkqvyhc0j927vs6myczyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3uguzkds I finally brought myself to read this essay<br/><br/><a href="https://www.structuredprocrastination.com">https://www.structuredprocrastination.com</a><br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/099/155/264/303/908/original/04766b6fd4172f18.jpeg"> <br/> 2025-08-27T05:48:54Z https://yabu.me/nevent1qqsy62lfhlew0h5827h7x0rg6dcyu2u43nhstywkjftzwkqsex2d69czyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3u7et7q5 This is great news 🤩 I guess it’s about time to start learning CodeQL seriously <br/><br/>#CodeQL can be enabled at scale on C/C++ repositories in public preview using build-free #scanning<br/><br/><a href="https://github.blog/changelog/2025-06-03-codeql-can-be-enabled-at-scale-on-c-c-repositories-in-public-preview-using-build-free-scanning/">https://github.blog/changelog/2025-06-03-codeql-can-be-enabled-at-scale-on-c-c-repositories-in-public-preview-using-build-free-scanning/</a> 2025-08-26T06:37:45Z https://yabu.me/nevent1qqsfpecphhqftsvhadus77zgvs0hynv3mas0us49fn6v78j8z2jdk7gzyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3uvnyd7g “Humans are hackers. We were put here to figure things out. Hacking is an innate skill to be tapped into and developed. The hacker spirit guides us through situations once thought hopeless. Hacking is a way to answer your own burning questions, a way to discover your own potential, and a way to create a world you want to live in.<br/><br/>There is a hacker born every day. It&#39;s our duty to share things that can inform them of the past and present, and give them hope for a better tomorrow. After all, we&#39;re all alike.”<br/><br/>❤️❤️❤️❤️❤️❤️❤️❤️<br/><br/>#Phrack72 40th anniversary edition is out!<br/><br/><a href="https://phrack.org">https://phrack.org</a> 2025-08-19T06:25:26Z https://yabu.me/nevent1qqszlxulwajmu3qykpew3askwzmrlrwgqaxrms06s4jgdkfce2cvxfgzyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3urvdhuv A fascinating story about a #DoS #vulnerability in the Expat #XML parser <br/><br/>#Recursion kills: The story behind CVE-2024-8176 / #Expat 2.7.0 released, includes security fixes<br/><br/><a href="https://blog.hartwork.org/posts/expat-2-7-0-released/">https://blog.hartwork.org/posts/expat-2-7-0-released/</a> 2025-08-18T07:07:38Z https://yabu.me/nevent1qqsghhh7anlqpsnn04808m536yua2taptd0umfvmve0k9kc69t8s04szyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3uh2dh35 Never been into the fan/celeb thing, but this is damn #inspiring 👏 <br/>ht <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub18e35w3ye4kd6jxadqkyys8hrp4kx3g5mr54jav6tg9d652j559aqv7kv8z" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Slashdot :verified:</span> (<span class="italic">npub18e3…kv8z</span>)</a></span><br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/039/000/381/035/919/original/281fca9597a1b67f.jpeg"> <br/> 2025-08-16T14:50:44Z https://yabu.me/nevent1qqs0xlqwglhxa5dhljf643murspnxpavke4mvpj7qcgcqede4fjehcszyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3ud4vf8q #TIL that last month some dimwits at Ventegus Anti-Piracy GmbH (likely on behalf of Hex-Rays?) submitted a #DMCA (Copyright) Complaint to #Google to remove these two pages from search results:<br/><br/><a href="https://0xdeadbeef.info/augur/augur/">https://0xdeadbeef.info/augur/augur/</a><br/><a href="https://0xdeadbeef.info/augur/src/haruspex/lib.rs.html">https://0xdeadbeef.info/augur/src/haruspex/lib.rs.html</a><br/><br/>See for yourself:<br/><a href="https://lumendatabase.org/notices/54378675">https://lumendatabase.org/notices/54378675</a><br/><br/>Not that I care, but WTAF...<br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/005/239/393/773/883/original/e25536ae42093a77.png"> <br/> 2025-08-10T15:46:48Z https://yabu.me/nevent1qqs9uz59hr8qfyvdn09zngse082udkgv3v8783phl5m22pu5ukuttxszyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3uv8lgqh CVE-2025-48708: #ghostscript can embed plaintext #password in encrypted #PDFs 😶 <br/><br/><a href="https://www.openwall.com/lists/oss-security/2025/05/23/2">https://www.openwall.com/lists/oss-security/2025/05/23/2</a> 2025-08-10T13:22:50Z https://yabu.me/nevent1qqsttka8s4q5s607yny0u0vzsyzfpg8n36zq2crhmp3mlawa4fst0agzyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3u8g2fnn Another fresh #Python #tarfile #vulnerability<br/><br/>Python TarFile.extractall(..., filter=&#39;tar&#39;) arbitrary file chmod<br/><br/><a href="https://github.com/python/cpython/issues/127987">https://github.com/python/cpython/issues/127987</a> 2025-08-09T07:52:25Z https://yabu.me/nevent1qqsq53y9wzvwj53hzkgl0f463t7uf32erhwz7e4llnn9j2klkx5qq8qzyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3uyx9ytf Here’s another fun one by <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1y7r7dpnl6neunu6zmt4lguhwhqg24pg568alvhtx7emcd9vlr0rs8h9kzp" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Snyk</span> (<span class="italic">npub1y7r…9kzp</span>)</a></span>! I’ve really enjoyed the clever building of the #exploit chain ✊ <br/><br/>Abusing #Ubuntu 24.04 features for root privilege escalation<br/><br/><a href="https://labs.snyk.io/resources/abusing-ubuntu-root-privilege-escalation/">https://labs.snyk.io/resources/abusing-ubuntu-root-privilege-escalation/</a><br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/991/935/978/582/012/original/dcc89857c81b6fee.jpeg"> <br/> 2025-08-08T07:21:38Z https://yabu.me/nevent1qqsylnfewsv8jwlzp2kmcgtdg3c9t3femk4fwq5jjxestz6hy7n53nczyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3u6y0nwd I love this kind of #bugs, especially when they are features 🤣<br/><br/>#arm64: Linear mapping is mapped at the same static virtual address<br/><br/><a href="https://project-zero.issues.chromium.org/issues/434208461">https://project-zero.issues.chromium.org/issues/434208461</a> 2025-08-04T09:22:25Z https://yabu.me/nevent1qqs8tuvugnpxth8yydwmrq8kyungmstd8hfnq7nn9qpt4ely6s4wx5czyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3uw0mh0c [CVE-2025-38001] #Exploiting All Google #kernelCTF Instances And Debian 12 With A #0Day For $82k: A RBTree Family Drama (Part One: LTS &amp; COS)<br/><br/><a href="https://syst3mfailure.io/rbtree-family-drama/">https://syst3mfailure.io/rbtree-family-drama/</a> 2025-07-13T19:21:07Z https://yabu.me/nevent1qqst2exwmnx0tfywtdca2eu5la65mxx444m86pmyfas5zlug3t5u89czyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3uklt7c2 #FortiWeb Pre-Auth #RCE (CVE-2025-25257)<br/><br/><a href="https://pwner.gg/blog/2025-07-10-fortiweb-fabric-rce">https://pwner.gg/blog/2025-07-10-fortiweb-fabric-rce</a> 2025-07-11T17:42:46Z https://yabu.me/nevent1qqsy4zd5lcpfxslyv2y4y4neyxxld8urkc7f0auul6v9ug4wg07f5rczyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3uynzjw3 As an old fart in #xdev, I get asked often, mostly by young coworkers, how to get into binary exploitation in 2025. I looked around, and here’s my recommendation:<br/><br/><a href="https://pwn.college">https://pwn.college</a> <br/><br/>#pwncollege is a huge collection of free #lectures and practical #challenges maintained by a team of #hackers at the Arizona State University. Check it out!<br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/827/559/743/371/338/original/5f256d79c7946a83.jpeg"> <br/> 2025-07-10T06:38:36Z https://yabu.me/nevent1qqsw3vyje3n949g4ct9q6u3ju75d6evqlfffeycnj3xnzk0zc48rt5czyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3u7k3gxu In reply to <a href='/nevent1qqswnsw4k7ndret86tek63d003rzd5p39werpsd8g7cyvyca9muw3usvlp43l'>nevent1q…p43l</a><br/>_________________________<br/><br/>he was the youngest researcher at zero day quest, and I was the oldest with an exact 30 year difference 😅 2025-07-02T18:43:02Z https://yabu.me/nevent1qqsqpu2h5t5rmq8fdy2daghk2r76rp9nstyzcpkcav99wnpwy8d94sgzyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3umpuxvn #TumpiCon2025 is happening now! 💚<br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/754/374/588/890/973/original/1f2dfceb31b7311e.jpeg"> <br/> 2025-06-27T08:26:39Z https://yabu.me/nevent1qqszrdx06afzd4metgplmj7a8mksxadw2ueh5x6yxgedpqwdcn84mqgzyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3u3cuggv This Video Can #Exploit Your #iPhone (CVE-2025-31200)<br/><br/><a href="https://www.youtube.com/watch?v=nTO3TRBW00E">https://www.youtube.com/watch?v=nTO3TRBW00E</a><br/><br/>Besides the clickbaity title, this video is actually a simple and fun initial analysis of the #1day in question. <br/><br/>As a side note, I started watching it on a device with no #adblocker and damn, YouTube has become so annoying and utterly unusable 😠 2025-06-11T08:32:53Z https://yabu.me/nevent1qqsp7qvsuqyena3dkmtw5m0hw3nx404j29pv9h06rx9kh060xdrykfgzyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3ukt7xdk #Hydroph0bia (CVE-2025-4275) - a trivial #SecureBoot bypass for UEFI-compatible firmware based on Insyde #H2O, part 1<br/><br/><a href="https://coderush.me/hydroph0bia-part1/">https://coderush.me/hydroph0bia-part1/</a> 2025-06-11T05:53:28Z https://yabu.me/nevent1qqsdc6mjs2gxv5u9npyeuxgymj7awf773ulsv6e42z7rgffek7s53qczyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3uhgh2p6 How to store data on #paper?<br/><br/><a href="https://www.monperrus.net/martin/store-data-paper">https://www.monperrus.net/martin/store-data-paper</a> 2025-06-09T06:17:34Z https://yabu.me/nevent1qqspdsgftyah0jv7qge4n9hrnecdve6yzpw9f776chyyk290cssfq8gzyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3uut7w04 “Certain 5400 RPM hard drives, for laptops and other PCs in approximately 2005 and later, allow physically proximate attackers to cause a denial of service (device malfunction and system crash) via a resonant-frequency attack with the audio signal from the Rhythm Nation music video. A reported product is Seagate STDT4000100 763649053447.”<br/><br/><a href="https://nvd.nist.gov/vuln/detail/CVE-2022-38392">https://nvd.nist.gov/vuln/detail/CVE-2022-38392</a> 2025-05-25T09:14:39Z https://yabu.me/nevent1qqs9uuw3kth66uw5h0c4ejrpkxyxq3czenkm2zjlmwkdz3lva8x0jsczyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3uje85r3 During the weekend, I’ve been working a bit on updating my battle-tested #semgrep ruleset for #c #vulnerability research <br/><br/><a href="https://github.com/0xdea/semgrep-rules">https://github.com/0xdea/semgrep-rules</a><br/><br/>Nothing major, just a couple of small updates. It feels good to be back doing some #security #research! Let’s see where this takes me… 2025-05-19T10:46:57Z https://yabu.me/nevent1qqsrpm9a6742qc0v6h3a9xclda3nytsgvzj7mcw3679nl2vscwqq37szyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3uqx2yev In reply to <a href='/nevent1qqsztjcxcjw6jwax5nl2ryzwn7gpnnj0lzl3emshjmt533a0lwg4kns2pd2ht'>nevent1q…d2ht</a><br/>_________________________<br/><br/>for some reason, this [@slashdot](<a href="https://mastodon.cloud/@slashdot">https://mastodon.cloud/@slashdot</a> ) headline from 2000 stuck with me and when I’m sleep deprived I often think about it <a href="https://science.slashdot.org/story/00/02/11/0648213/sleep-deprivation-increases-brain-activity">https://science.slashdot.org/story/00/02/11/0648213/sleep-deprivation-increases-brain-activity</a> 2025-05-15T06:20:45Z https://yabu.me/nevent1qqsx8ug2gayqd770umq8hqfz59rz9uv8e743xps6dvtau6tlq7e8mlszyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3uust5v5 In reply to <a href='/nevent1qqs07qd96hduvpz486z90l4l2t6ruf0570y8lg74xjn4ecaez5cjlwgmra64g'>nevent1q…a64g</a><br/>_________________________<br/><br/>reminds me a bit of GPS navigators TBH 2025-05-14T11:37:43Z https://yabu.me/nevent1qqsw6gqfj2mltp5kjzwy2tllezvjvgjjnl5t42f60pf8n779d7u0mxczyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3u6vykv3 In reply to <a href='/nevent1qqsttuawnd9x0kdpntqcfuvpwqdxtzvn6st6xtq3mddvzjy7306shzcsf370j'>nevent1q…370j</a><br/>_________________________<br/><br/>or maybe, even better, of #Troma’s “Surf Nazis Must Die” <a href="https://en.wikipedia.org/wiki/Surf_Nazis_Must_Die">https://en.wikipedia.org/wiki/Surf_Nazis_Must_Die</a> 2025-05-08T13:03:11Z https://yabu.me/nevent1qqsvl6xk0dec7esl4pvkkzwuhz48rjch0mwzw7l9e9jwktayswzacnqzyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3u4sh92l [CVE-2025-37752] Two Bytes Of Madness: Pwning The #Linux #Kernel With A 0x0000 Written 262636 Bytes Out-Of-Bounds 🔥<br/><br/><a href="https://syst3mfailure.io/two-bytes-of-madness/">https://syst3mfailure.io/two-bytes-of-madness/</a> 2025-05-07T04:54:41Z https://yabu.me/nevent1qqs99tv52rcewuu0xe6ly3wdhm4c2dx39zm6l4ffw2cvtl8pm97hk9gzyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3urlygyg This is a well-written, comprehensive #Rust guide for beginners that have experience with other languages<br/><br/><a href="https://www.chiark.greenend.org.uk/~ianmdlvl/rust-polyglot/index.html">https://www.chiark.greenend.org.uk/~ianmdlvl/rust-polyglot/index.html</a> 2025-04-19T08:35:37Z https://yabu.me/nevent1qqsrzhu26z4zr82eghjusjlk60tr9n0flth4xnrw5ducc6y6mphzu2qzyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3u5gk56r In reply to <a href='/nevent1qqsvgkn2m6smtfydpc8mlmwm0nretwfxmz4syvs58s4mn3dvv07v0esa7tfx6'>nevent1q…tfx6</a><br/>_________________________<br/><br/>interesting blog too <a href="https://platformsecurity.com/blog/CVE-2025-32433-poc">https://platformsecurity.com/blog/CVE-2025-32433-poc</a> 2025-04-18T09:46:51Z https://yabu.me/nevent1qqs2hxzwy95k888yzp8n8c7nt0jceu2gddhn0vg5td46xqlapwmw5wgzyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3uqkn4dw In reply to <a href='/nevent1qqs2wj7esjv0xyvpa7wm8sdt3w5r53g2yyt2264v5vlkgwzqm59w98gqp99mw'>nevent1q…99mw</a><br/>_________________________<br/><br/>Deja vu 😅 <a href="https://security.humanativaspa.it/multiple-vulnerabilities-in-eclipse-threadx/">https://security.humanativaspa.it/multiple-vulnerabilities-in-eclipse-threadx/</a> 2025-04-14T17:12:59Z https://yabu.me/nevent1qqsqhgclljg7w9pnzg6p4r43vu75r66yp5qjx47xdvxflcvpc7gspcszyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3u60phzp In reply to <a href='/nevent1qqsqqkh29zeuy5jhyy9s69s8numxyyp8pyz99c6l9uxyu4vut7kerdc8w2xkr'>nevent1q…2xkr</a><br/>_________________________<br/><br/>unclear. Maybe not <a href="https://news.ycombinator.com/item?id=43617413">https://news.ycombinator.com/item?id=43617413</a> 2025-04-08T08:21:28Z https://yabu.me/nevent1qqsx0q5zatu2xf23f9u45w53muh8zm4frpd75lu3ffpwy7za6eyu2jczyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3uraayua &#34;The designer of a new system must not only be the implementor and the first large-scale user; the designer should also write the first user manual. If I had not participated fully in all these activities, literally hundreds of improvements would never have been made, because I would never have thought of them or perceived why they were important.&#34;<br/><br/>-- Donald Knuth, “The Errors of TeX” 2025-03-27T14:04:40Z https://yabu.me/nevent1qqs8vwqyahj7nts6aygep5d05czamzxhsy6cyt0rvum3agcyztc69vczyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3ucsqspv Rejoice! 🎉<br/><br/>My idalib-based vulnerability research tools are now fully compatible with Windows 🪟 <br/><br/>Please test them and report any bugs 🪲<br/><br/><a href="https://security.humanativaspa.it/streamlining-vulnerability-research-with-ida-pro-and-rust/">https://security.humanativaspa.it/streamlining-vulnerability-research-with-ida-pro-and-rust/</a> <br/><br/>(PS. Ya like my GPT writing style? 🚀) 2025-03-21T07:20:16Z https://yabu.me/nevent1qqs8u2ne9nlfsqvpp3lh0y4djeker43k3smtdxwf23rsrchjyyj2k6szyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3u0nnl3j rotfl <a href="https://hackerone.com/reports/2293343">https://hackerone.com/reports/2293343</a> 2025-02-26T14:03:21Z https://yabu.me/nevent1qqsxuru2rg7ret7h85lfd23ujqyafs0sprkkf6d38rha5ge8ppfsmwqzyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3uywvl73 In reply to <a href='/nevent1qqsfrl4sufu9cy9mggysdljcntrzm5jzu4sxyec88028vv89a5sldnscjcejf'>nevent1q…cejf</a><br/>_________________________<br/><br/>so true 2025-02-25T17:53:23Z https://yabu.me/nevent1qqstf5yp63hcs70wny6a8weamt0m0cf968adlrda863ujulnx9qnxcszyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3ul08jp4 Lesser known tricks, quirks and features of #C<br/><br/><a href="https://jorenar.com/blog/less-known-c">https://jorenar.com/blog/less-known-c</a> 2025-02-21T13:17:12Z https://yabu.me/nevent1qqs9huck8lkwt3me0u0rv4e0wt5w3lnhg69u4lnf6gwtwp5xssd90mczyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3usgtxpy Tour of #Rust&#39;s Standard Library Traits<br/><br/><a href="https://github.com/pretzelhammer/rust-blog/blob/master/posts/tour-of-rusts-standard-library-traits.md">https://github.com/pretzelhammer/rust-blog/blob/master/posts/tour-of-rusts-standard-library-traits.md</a><br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/907/922/664/696/320/original/7864cf611b0c5762.png"> <br/> 2025-01-28T20:42:47Z https://yabu.me/nevent1qqs283vs58ujfxs3rfuyfehws9talx9l7yhuwcjv5a90je2hq7tv3wqzyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3u9rmcfj In reply to <a href='/nevent1qqstp6c3ettz72sqrgk8f7jlljkm3rx03xt2akqe6hcgz3n7vcx64kqfp24k5'>nevent1q…24k5</a><br/>_________________________<br/><br/>it’s not yesterday’s post, it’s an upcoming one in the near future 2025-01-16T12:10:42Z https://yabu.me/nevent1qqszxumq56jfjxe04rfcmva3mmh7405eug2nc5cn65dtrk5dddmlzkqzyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3uje4sga In reply to <a href='/nevent1qqsp09mtmt8wvrxerazhaer7ewdaxphdj2mnrqf38nrjexkgjd62x4srawd2c'>nevent1q…wd2c</a><br/>_________________________<br/><br/>my colleague wrote this, I expect it to be clean 😅 2025-01-16T11:06:50Z https://yabu.me/nevent1qqsrcm8ymnggh4sm9kc7skqvmldam0a49ze0npk28eacewc7upfu9tqzyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3urmt20u Safe #Rust AIN&#39;T SAFE!? (cve-rs explainer)<br/><br/><a href="https://youtu.be/vfMpIsJwpjU">https://youtu.be/vfMpIsJwpjU</a> 2024-12-26T11:08:44Z https://yabu.me/nevent1qqsymgz6r4jfn2z3u4xu4495qth7puuwe3kwxqz0kcjg600szje473gzyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3uz9ppgk 2025 is just around the corner. If #LearningRust is among your New Year’s resolutions, I’ve got you. <br/><br/>Following my ongoing #Rust series on the <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1fndye20kxsxh0d3wvsz436svhsxrnxuqnpw6qqsarrl732gxcalqtc8ya4" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>HN Security</span> (<span class="italic">npub1fnd…8ya4</span>)</a></span> blog (<a href="https://security.humanativaspa.it/tag/rust/">https://security.humanativaspa.it/tag/rust/</a>) and adding something along the way, in the next days I’ll recommend the learning resources that worked for me. <br/><br/>Stay tuned! 2024-12-26T06:54:43Z https://yabu.me/nevent1qqsz4kz4hk2uhmsmnpvcrsv6l2w8lzpw8kasgn79zdemaetmse92gyqzyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3uvpm3e3 Announcing #CodeQL Community Packs<br/><br/><a href="https://github.blog/security/vulnerability-research/announcing-codeql-community-packs/">https://github.blog/security/vulnerability-research/announcing-codeql-community-packs/</a> 2024-12-24T05:51:07Z https://yabu.me/nevent1qqs0k0vx080qee2q03869etacgwxf9f9uvw2eps34whqr0nqwvh55jczyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3u97yw8w Oasis Security Research Team Discovers Microsoft #Azure #MFA Bypass<br/><br/><a href="https://oasis.security/resources/blog/oasis-security-research-team-discovers-microsoft-azure-mfa-bypass">https://oasis.security/resources/blog/oasis-security-research-team-discovers-microsoft-azure-mfa-bypass</a> 2024-12-14T07:46:34Z https://yabu.me/nevent1qqstqgz4qrtdck7qlmrc52yp674yj5p8a75dnkp6890yvht0szrdqsqzyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3ufnx356 Pointers Are Complicated, or: What&#39;s in a Byte?<br/><a href="https://www.ralfj.de/blog/2018/07/24/pointers-and-bytes.html">https://www.ralfj.de/blog/2018/07/24/pointers-and-bytes.html</a><br/><br/>Pointers Are Complicated II, or: We need better language specs<br/><a href="https://www.ralfj.de/blog/2020/12/14/provenance.html">https://www.ralfj.de/blog/2020/12/14/provenance.html</a><br/><br/>Pointers Are Complicated III, or: Pointer-integer casts exposed<br/><a href="https://www.ralfj.de/blog/2022/04/11/provenance-exposed.html">https://www.ralfj.de/blog/2022/04/11/provenance-exposed.html</a> 2024-12-08T15:25:28Z https://yabu.me/nevent1qqsvv9x9t0gkge9kus9lu9e6u49rl70k4f5ysntse77xfsd26wk7s8czyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3uqzxyqs Breaking the most popular #Web Application Firewalls (#waf) in the market<br/><br/><a href="https://nzt-48.org/breaking-the-most-popular-wafs">https://nzt-48.org/breaking-the-most-popular-wafs</a> 2024-12-06T16:00:26Z https://yabu.me/nevent1qqs8gsr8w63xfhfuqyvx2vy3e5f9056n4gkpfwyyd9yt6hk3ly6wydszyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3uavaqar In reply to <a href='/nevent1qqsr4hketm6w4mxj56dkhw2tnphwzmfs3exzfaphjgyl4qpuc80qvksu2m8es'>nevent1q…m8es</a><br/>_________________________<br/><br/>done! <a href="https://bsky.app/profile/raptor.infosec.exchange.ap.brid.gy">https://bsky.app/profile/raptor.infosec.exchange.ap.brid.gy</a> 2024-11-16T18:25:29Z https://yabu.me/nevent1qqsqjcsxuq4653epdcxrjdajhlneahdc2rsmqlphfzd35c2j6799f2czyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3ue9eayl In reply to <a href='/nevent1qqsf809t0c635pvqmcy5399z69v8hzkdeaprrs9q0s3w4depenved0q58ypjn'>nevent1q…ypjn</a><br/>_________________________<br/><br/>funny that you mention keycloak on the very same day that we chose to disclose some vulnerabilities in it 🤷‍♂️ <a href="https://security.humanativaspa.it/an-analysis-of-the-keycloak-authentication-system/">https://security.humanativaspa.it/an-analysis-of-the-keycloak-authentication-system/</a> 2024-10-30T14:16:37Z https://yabu.me/nevent1qqs9g0st2eufg8jqm50tyk6k8a8s6uas3dl8kve5s4le607clz3dtdczyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3uvtu5vj Super useful diagram that explains all available transformations between Result and Option standard #Rust types and their interactions.<br/><br/>Source: <a href="https://docs.google.com/drawings/d/1EOPs0YTONo_FygWbuJGPfikO9Myt5HwtiFUHRuE1JVM/edit">https://docs.google.com/drawings/d/1EOPs0YTONo_FygWbuJGPfikO9Myt5HwtiFUHRuE1JVM/edit</a><br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/372/731/627/019/138/original/a60e52406eeff462.png"> <br/> 2024-10-26T08:17:51Z https://yabu.me/nevent1qqsqhl4rwge8uv3q2jaaq5jcpfj3hr6eqscekvnkm2meag55tu78cuczyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3unyz9ga Got some #MSRC #swag 😂<br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/362/131/121/808/064/original/4b5eecd61ec62809.jpeg"> <br/> 2024-10-24T11:20:49Z https://yabu.me/nevent1qqs2g9c8uug3la09f2ccghm6jx9epmc0atca36drn56d83ftp7rusvczyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3unur4n4 In reply to <a href='/nevent1qqswkgj2mhy7gld93t2fn3vdlten2h5lz3p5paw7wuhuf2997d3d9qqdr6smw'>nevent1q…6smw</a><br/>_________________________<br/><br/>yes! And it’s quite convenient to use, e.g. <a href="https://security.humanativaspa.it/big-update-to-my-semgrep-c-cpp-ruleset/">https://security.humanativaspa.it/big-update-to-my-semgrep-c-cpp-ruleset/</a> 2024-10-12T10:43:05Z https://yabu.me/nevent1qqszfx35j985ymuw50k60a82h643c3dwxrpxywnwt68exrjggmjjekszyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3udyt9za A step-by-step guide to writing an #iOS #kernel #exploit -&lt; short and to the point!<br/><br/>// by [@alfiecg_dev](<a href="https://bird.makeup/users/alfiecg_dev">https://bird.makeup/users/alfiecg_dev</a> ) <br/><br/><a href="https://alfiecg.uk/2024/09/24/Kernel-exploit.html">https://alfiecg.uk/2024/09/24/Kernel-exploit.html</a><br/><a href="https://github.com/alfiecg24/Vertex">https://github.com/alfiecg24/Vertex</a> 2024-10-10T14:58:55Z https://yabu.me/nevent1qqspla2clmp2rxyp4u3fdd72zuz2fkdzg58h07xzwxyd5qvjvd727tczyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3uuz4dt7 #Hacking is not just #OldSchool tooling and techniques. Modern #MobileApps are a fun target for #ReverseEngineers and #Pentesters alike. A fundamental tool to properly hack mobile apps is <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1ufe9jqagzytvuzkge3ur0jd3wv8azmcvvg5772jg8rkghgqw0qwqtcm7ps" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>npub1ufe9jqagzytvuzkge3ur0jd3wv8azmcvvg5772jg8rkghgqw0qwqtcm7ps</span> (<span class="italic">npub1ufe…m7ps</span>)</a></span> by [@oleavr](<a href="https://fosstodon.org/@oleavr">https://fosstodon.org/@oleavr</a> ). <br/><br/>We continue our tour of my [@github](<a href="https://infosec.exchange/@github">https://infosec.exchange/@github</a> ) projects with my humble contributions to this field:<br/><a href="https://github.com/0xdea/frida-scripts">https://github.com/0xdea/frida-scripts</a><br/><br/>For a well-maintained project that includes some of my #Frida scripts, check out #Brida by [@apps3c](<a href="https://infosec.exchange/@apps3c">https://infosec.exchange/@apps3c</a> ) and Piergiovanni Cipolloni:<br/><a href="https://github.com/federicodotta/Brida">https://github.com/federicodotta/Brida</a><br/><br/>And even after many years, if you search for well-crafted Frida scripts to bypass certificate pinning or root detection, there’s a very good chance that you’ll stumble upon the work of some of my colleagues… Very proud of my team at [@hnsec](<a href="https://infosec.exchange/@hnsec">https://infosec.exchange/@hnsec</a> )! 2024-10-04T06:37:39Z https://yabu.me/nevent1qqsgfkc59qq87y5uvpdavyv28qkywymd8xqpajwc8q88q7q582nggsgzyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3ujrdakr #patchfriday on #cups #vulnerabilities<br/><br/><a href="https://patchfriday.com/158/">https://patchfriday.com/158/</a><br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/220/804/297/042/971/original/ee02f3475df3e6ca.png"> <br/> 2024-09-29T12:19:33Z https://yabu.me/nevent1qqsqgxgm9dlq7vmkppgny4ueptrf2xegdmvu367tl5wv48wkztd7p8qzyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3uldmklx Continuing the tour of my <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1545e5cp26gheece3ggtv3mmqtcp6pavx2sjfmjr02u0q5tqlxhrse8mva5" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Github</span> (<span class="italic">npub1545…mva5</span>)</a></span> projects, the #TacticalExploitation toolkit deserves to be mentioned. It&#39;s now a bit old, but I believe the concept still applies, and very much so.<br/><br/><a href="https://github.com/0xdea/tactical-exploitation">https://github.com/0xdea/tactical-exploitation</a><br/><br/>&#34;The Other Way to Pen-Test&#34; -- <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub18pcs78pe5c63534qwvzf5c0gateeu9qk3g4grgj5n9gxn8wth8vsek787r" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>HD Moore</span> (<span class="italic">npub18pc…787r</span>)</a></span> &amp; <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub14pvpzkszwkahp2swnq7e0evn4z9jgfk0zsyk42dkghs860y7zzwsf5jqkx" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Valsmith</span> (<span class="italic">npub14pv…jqkx</span>)</a></span> <br/><br/>I&#39;ve always been a big proponent of a tactical approach to #PenetrationTesting that doesn&#39;t focus on exploiting known software #vulnerabilities, but relies on #OldSchool techniques such as #InformationGathering and #BruteForce. While being able to appreciate the occasional usefulness of a well-timed 0day, as a veteran penetration tester I favor an exploit-less approach. Tactical exploitation provides a smoother and more reliable way of compromising targets by leveraging process vulnerabilities, while minimizing attack detection and other undesired side effects.<br/><br/>Since a few years, I&#39;ve meant to give a talk on this very subject, with the working title of &#34;Empty Phist Style - Hacking Without Tooling&#34; (inspired by <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub18ymw3wfjeu627sd6r9s6elvd3vl232lrmnszedkux9c275xcje3qpu460u" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>the grugq</span> (<span class="italic">npub18ym…460u</span>)</a></span>). Sooner or later it will happen. 2024-09-20T07:17:52Z https://yabu.me/nevent1qqs87f903vuwqgq564jrrutxes0tkgxmqelmmjpq7ttat739trflruqzyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3uga999k In reply to <a href='/nevent1qqswnse3cy9xkfvws3m5s3uj697uejv57j6v6vwrylmn4tjeek85vrg6uhnpt'>nevent1q…hnpt</a><br/>_________________________<br/><br/>makes sense! 2024-09-17T08:19:18Z https://yabu.me/nevent1qqsy34gmkgs7un06x62lrec6esa209f7438n4jnn6lspr54hgshau2gzyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3u4r2yuk Not a fan of the #AI hype at all, but <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1nnwk8dgrytvkwqwwqv3ek5z6ys85thhl0s3f7agl30m3ywkluajspsytvc" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>JetBrains</span> (<span class="italic">npub1nnw…ytvc</span>)</a></span> #RustRover new full line code completion feature is impressive<br/><br/><a href="https://blog.jetbrains.com/blog/2024/04/04/full-line-code-completion-in-jetbrains-ides-all-you-need-to-know/">https://blog.jetbrains.com/blog/2024/04/04/full-line-code-completion-in-jetbrains-ides-all-you-need-to-know/</a> 2024-09-17T07:42:28Z https://yabu.me/nevent1qqsrt4dypyuu5lrk0nmzdthve7sadxtlhcmy2m6082q6h6f3j99fzdczyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3uxr0mvw I&#39;d like to share some of my projects that are hosted on <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1545e5cp26gheece3ggtv3mmqtcp6pavx2sjfmjr02u0q5tqlxhrse8mva5" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Github</span> (<span class="italic">npub1545…mva5</span>)</a></span>. Let&#39;s start with my public #exploits that span more than two decades of #pwning.<br/><br/><a href="https://github.com/0xdea/exploits">https://github.com/0xdea/exploits</a><br/><br/>&#34;You can&#39;t argue with a root shell.&#34; -- Felix &#34;FX&#34; Lindner<br/><br/>Probably the most known is raptor_udf.c that targets #MySQL (those of you who solved the <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1n4pt2ps5a3fhw8jhmngeerxkhmf2t02wdqy657gu8ff2r7r4tsyqa5t7gf" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>OffSec</span> (<span class="italic">npub1n4p…t7gf</span>)</a></span> #OSCP training labs should recognize it).<br/><br/>My favorite is still raptor_rlogin.c, a glorious #Solaris #RCE from the early 2000s. Take your pick! 2024-09-17T07:26:01Z https://yabu.me/nevent1qqsg32gvlsuul0j6gauy6ladp4yudu4n0gaz0uphl28pu9pdz5vjvdczyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3ufd4v45 I finally got my copy of #Phrack71! <br/><br/>Impressive work by the new <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1am3w48p7rdt932pdgq4wkskl8rvqvfxzxx8xjy7h65rrsr9kxvusyuj6qn" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Phrack</span> (<span class="italic">npub1am3…j6qn</span>)</a></span> staff 💚<br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/106/321/877/286/814/original/2e694c1122b0fd57.jpeg"> <br/> 2024-09-09T07:05:10Z https://yabu.me/nevent1qqsxf0enugp58mmh04zwcj7xxj4dlkum87uf2554ds9xkgv4dxsrw6qzyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3ut4xz72 Come for the #OffensiveRust content, stay for the #ThrashMetal revival 🎸 <a href="https://infosec.exchange/@hnsec/113072354880406361">https://infosec.exchange/@hnsec/113072354880406361</a> 2024-09-03T07:08:45Z https://yabu.me/nevent1qqsz2tchlt3h6gdc4jg8frclh45yj84na9zfwfeczz20enca7pn4czczyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3uhjxdq9 In reply to <a href='/nevent1qqsfwzznw4u4y9qtamcrwgpyqqgpaxfnv6ue4f929ueeapc5ak3u3psh50p74'>nevent1q…0p74</a><br/>_________________________<br/><br/>what is the source? 2024-08-28T19:13:58Z https://yabu.me/nevent1qqsygzmf6vh9jx7knkjxh8g4shacwwg69m8grefux9n2n2uqryek3mqzyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3utq0syx #patchfriday<br/><br/><a href="https://patchfriday.com/157/">https://patchfriday.com/157/</a><br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/026/608/301/814/892/original/8dc635f03000c4fd.png"> <br/> 2024-08-26T05:12:57Z https://yabu.me/nevent1qqsg4ed3h8v4y6hklde6hgvzrczwjgtekq6u3823uk49qjkj86mnzmszyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3uwxlhsj So cool to see my vulnerability research automation work integrated into such a powerful tool! Keep it up ✊<br/><a href="https://infosec.exchange/@securefirmware/112937856513629704">https://infosec.exchange/@securefirmware/112937856513629704</a> 2024-08-12T05:58:08Z https://yabu.me/nevent1qqsx59cq6c5z48hrh3awnzs64ea2829vef84xcey8h84peaszta6hdczyz86p6u9wznmz7adpddw40d2yqyw6fmekulej99rzc7pqnsupug3u4yy6zr &#34;Sometimes, hacking is just someone spending more time on something than anyone else might reasonably expect.”<br/><br/>— Jerry Gamblin 2022-11-22T16:33:09Z