Research Archive

SHA-256/SHA-384 Type Confusion OOB Write Explained: When a struct Lies About Its Age, the Kernel Believes It

From 15 out-of-bounds bytes to full root and a walk out of a chroot jail: a technical teardown of a Linux kernel exploit chain that starts with a size mix-up between SHA-256 and SHA-384 inside a custom crypto module, travels through MSG_COPY, pipe_buffer, and struct page, and ends with a data-only write into cred followed by swapping task->fs for init_fs.

#linux-kernel #exploit-development #heap-exploitation +2

New

SafeStack Bypass Explained: The Vault Is Solid, the Ledger Isn't

SafeStack splits your stack so a buffer overflow can only smash the half nobody misses. Solid plan, except the pointer that defines where the smashable half lives is stored in TLS, and TLS was sitting right next to the overflow. This is the story of how one bad memory layout took down a shadow stack, a canary, and a homemade CFI check in a single chain.

#Binary Exploitation #Memory Safety #SafeStack +2

New

MQTT Debug Topic Leaks Explained: When Your Device Keeps a Diary Anyone Can Read

A retained MQTT debug topic is the IoT equivalent of leaving the master key on a public noticeboard that never gets cleaned. Here is how firmware analysis, weak broker credentials, and one forgotten retain flag turn a thermostat into a leaky vault.

#MQTT #IoT #Firmware Analysis +2

New

Side-Channel ECDSA Explained: When Your Division Algorithm Can't Keep a Secret

How a custom binary modular division implementation leaks the ECDSA nonce through traced function calls, and how an attacker can recover the private key from the execution trace alone.

#cryptography #ecdsa #side-channel +2

New

Non-Transitive Comparators Explained: When Sorting Quietly Walks Off the Array

A comparison function that looks innocent can turn qsort into an out-of-bounds write primitive. This article breaks down how integer overflow in comparators breaks the assumptions of insertion sort, forces the slow path with a memory limit, and opens a full chain from stack corruption to code execution.

#Memory Corruption #Integer Overflow #qsort +2

New

Browser Session Hijacking Explained: When the Cookie Walks Out the Front Door

You spent money on MFA, zero-trust policies, and password managers. Then a friendly-looking extension quietly copied your live session tokens out of Chrome's LevelDB and left. This write-up shows how the theft works, how the artifacts survive on disk, and why the browser itself became the weakest link.

#DFIR #Session Hijacking #Malicious Extensions +2

Hybrid Mobile Reward Check Explained: When Four Handoffs Still Mean Yes

A cross-platform mobile app splits its reward check across managed code and a tiny native helper, with mixing passes, a bytecode runner, and anti-debug on top. None of that moves the decision off the phone. Here is how to map the chain, port the transforms, and drive the native exports in order.

#Reverse Engineering #Mobile RE #Android +2

Heap Metadata Corruption Explained: When One Byte Starts Rewriting the Rules

A practical deep dive into turning a one-byte heap write into controlled memory corruption on modern glibc. We will walk from the bug itself to allocator metadata, dynamic linking structures, and a deterministic final code-execution primitive.

#Heap Exploitation #glibc #Memory Corruption +2

Obfuscated State Machine Explained: When Your Verifier Turns Into a Maze

Some binaries do not check a secret with a simple comparison. They turn the input into bits and drive it through a state machine filled with transitions, dictionary lookups, and 256-bit arithmetic constraints. This write-up shows how to reverse that verifier into a graph you can actually solve.

#Reverse Engineering #Binary Analysis #Obfuscation +2

Arbitrary Pointer Manipulation Explained: When Memory-Safe Code Hands You the Keys

A memory-safe language can prevent whole classes of memory corruption, then leave one perfectly valid pointer in exactly the wrong place. This write-up breaks down how pointer corruption, stale length metadata, and indirect callbacks can turn an innocent note cache into code execution.

#Memory Safety #Pointer Corruption #RCE +2

Replacement-String Injection Explained: When `$`` Steals the Template

An escape function can look perfectly safe while JavaScript quietly interprets the replacement string underneath it. Here's how the bug works, how the XSS chain develops, and why String.replace() makes a terrible template engine.

#XSS #JavaScript #CSP +2

Rend Asunder Explained: When the Browser Itself Becomes Your Playground and the Screenshot Is the Only Output Channel

Three years circling the same Hacker101 challenge. HeadlessChrome 67, an opaque iframe, an old V8 typer bug, and three flags. I finally broke all of them. This is not a short summary. It is the full map from the moment you open the instance until you read the file from disk, step by step, so anyone can reproduce the entire exploit.

#Browser Exploitation #V8 #Chrome 67 +4

Approximate GCD Explained: When Your Secret Prime Hides in Plain Arithmeti

A homemade encryption scheme hides a giant secret prime inside a pile of noise and multiplication. Turns out a lattice can filter out the noise faster than you can say 'I rolled my own crypto.' Here's the math, the break, and why you should never do this at home.

#Approximate GCD #Lattice Cryptanalysis #LLL +3

Predictable Quantum Randomness Explained: When Your Device-Independent Beacon Is Just a Fancy Hash Function

A cold wallet swears its private key came from an unbreakable quantum experiment. The experiment turns out to be pure math running on a public seed. Here is how that works, why it still fails the Bell test in practice, and how to stop treating deterministic code as physics.

#Quantum Cryptography #Random Number Generators #Key Generation +3

PRNG Stream Reuse Explained: When Randomness Repeats Itself

A random-looking validation flow can collapse when two code paths consume the same PRNG stream. Add an empty-iterator check and silently ignored values, and the whole thing starts behaving less like security and more like a vending machine that gives refunds.

#PRNG #Python #Logic Bugs +3

Client-Side Password Validation Explained: When Your Password Checker Builds Its Own Tiny CPU

A password checker can look wonderfully complicated, decrypt code at runtime, and even run a custom virtual machine. That still does not make the secret unbreakable. Here is how to pull the VM apart, recover its instructions, and reverse the final checks.

#Reverse Engineering #Virtual Machine #Obfuscation +3

Encrypted C2 Loader Explained: Correlating PCAP, Memory, and a Hidden Stage

This challenge started with exactly two artifacts: `capture.pcapng` and `DbgInfo.DMP`. From there, the investigation moved through C2 decryption, screenshot and binary recovery, and reverse engineering of a loader that hid an encrypted in-memory stage.

#Reverse Engineering #Forensics #PCAP +3

Insecure OPC-UA Write Access Explained: When the Safety Interlock Is Just a Boolean

OPC-UA is supposed to be the grown-up industrial protocol. Hand it a self-signed certificate and a writable safety node, and it becomes a remote kill switch. Here is how that happens and how to stop it.

#OPC-UA #ICS #SCADA +2

RF Protocol Reverse Engineering Explained: When the Airwaves Leak the Keys

A proprietary wireless security protocol looked solid on paper. Then someone opened the packets, fixed the CRC, and discovered that self-addressed commands plus one wrong transmission parameter were all that stood between locked sensors and open doors.

#RF #Protocol Reverse Engineering #CRC +2

Flutter App Reverse Engineering Explained: When the Crypto Is Just Fancy Wrapping Paper

A full walkthrough of pulling a Flutter banking app apart, recovering its custom RSA+AES API protocol from the Dart AOT snapshot, and talking to the backend like the real client. Spoiler: encrypting the wire does not mean the server checks who owns the account.

#Flutter #Mobile RE #Dart AOT +2

PHP Extension Heap Overflow Explained: When Metadata Owns the Allocator

A custom PHP extension that parses image metadata with a fixed-size buffer and classic strcpy can hand the entire process to an attacker. Pair it with a loose file reader and you get ASLR bypass plus reliable RCE.

#Heap Overflow #PHP Extensions #Zend Allocator +3

UPnP Command Injection Explained: When Your Gateway Trusts the Network Too Much

UPnP was supposed to make devices play nice automatically. Instead it often hands attackers a SOAP endpoint, a password, and a shell. Here's how a diagnostic service turns into remote code execution.

#UPnP #Command Injection #IoT +2

Insecure Deserialization Explained: When Your Data Comes Back to Bite You

A deep dive into insecure deserialization vulnerabilities, from Java gadgets to PHP object injection. Learn how attackers weaponize your own data formats, real breaches that made headlines, vulnerable examples, exploitation chains, and rock‑solid defenses. With jokes. Of course.

#Insecure Deserialization #Web Security #Serialization +2

Broken Authentication Explained: When Logins Leak Like a Sieve

An exhaustive, witty walkthrough of authentication failures: weak passwords, flawed reset flows, session fixation, MFA bypass, and more. Learn from real breaches, vulnerable code samples, and defense checklists that'll harden your login system without hurting UX.

#Broken Authentication #Web Security #OWASP +2

Path Traversal Explained: The Art of Escaping the Filesystem Prison

A massively detailed, story-driven deep dive into Path Traversal vulnerabilities. From classic ../ tricks to modern cloud, container, zip slip, and symlink abuse. Real-world breaches, vulnerable code in every major language, advanced exploitation chains, and defense strategies that actually work.

#Path Traversal #Directory Traversal #Web Security +3

Command Injection Explained: When Your Server Becomes the Attacker's Terminal

A massively detailed, entertaining deep dive into Command Injection (OS Command Injection). We're covering every injection variant, real-world breaches that rocked the industry, vulnerable code examples in multiple languages, exploitation techniques from basic to advanced, and rock-solid defense strategies. Plus plenty of humor because system shells don't have to be terrifying... okay, they do.

#Command Injection #Web Security #OS Security +2

How to Hack an Iranian Nuclear Plant (A Lazy Hacker's Guide)

The satirical step-by-step guide nobody asked for, followed by the absolutely wild true story of Stuxnet - the cyber weapon that physically destroyed centrifuges while making the world rethink everything about security. Spoiler: It involves USB sticks, zero-days, and a whole lot of 'wait, that actually worked?!'

#Stuxnet #Cyber Warfare #SCADA +3

SQL Injection Explained: The Bobby Tables Hall of Fame

A massively detailed, entertaining deep dive into SQL Injection attacks. We're covering every injection type, real-world breaches that shook the industry, vulnerable code in multiple languages, exploitation techniques from basic to advanced, and bulletproof defense strategies. Plus plenty of jokes because SQL doesn't have to be boring!

#SQL Injection #Web Security #Database Security +2

CSRF Explained: The Art of Making Users Do Your Bidding Without Their Knowledge

The ultimate deep dive into Cross-Site Request Forgery (CSRF). We're covering the mechanics, attack vectors, real-world breach case studies, exploitation techniques, vulnerable code examples across multiple languages, advanced bypasses, and a comprehensive defense strategy. From basic concepts to advanced mitigation, everything you need to protect your applications.

#CSRF #Web Security #Authentication +2

XSS Explained: When Your Website Becomes a Puppet Show

A ridiculously detailed, humor-filled deep dive into Cross-Site Scripting (XSS). We're talking every flavor of XSS, vulnerable code in all your favorite languages, real-world breaches that made headlines, exploitation techniques, and comprehensive mitigation strategies. Buckle up for a wild ride through the world of malicious scripts!

#XSS #Web Security #JavaScript +2

OWASP Top 10: The Wild World of Web App Security Risks!

Buckle up for a super-detailed, hilarious deep dive into the OWASP Top 10. We're talking explanations that go on forever, code snippets that actually make sense, real-world horror stories, and enough mitigation tips to make your head spin. Oh, and some dad jokes because why not?

#OWASP #Web Security #Cybersecurity +1

Research & Investigations

2026