|
main menu
user menu
topics
|
latest postsKerberoasting: cracking service accounts without touching themAny domain user can ask Kerberos for a ticket encrypted with a service account's password, take it home and attack it offline. No exploit, no noise on the endpoint. How the protocol that enables it works and why the defence is almost entirely password length. JWT: when the public key becomes the secretA JWT is only as secure as the code that verifies its signature. Two recurring flaws — alg:none and RS256/HS256 confusion — let you forge valid tokens without knowing any secret. Why they arise, how they are exploited, and the single rule that closes both. Spectre: reading memory the CPU never really readThe CPU runs instructions ahead of time and then undoes them — but the cache keeps the traces. Spectre v1 turns those traces into an out-of-bounds memory read, even across a sandbox boundary. How the speculation window works, the flush+reload gadget, and why the mitigation costs performance. Tcache poisoning: turning a use-after-free into an arbitrary writeglibc's tcache is fast because it is naive. A single free-after-free lets you forge a chunk's next pointer and make malloc return an address of your choosing. A close look at how the freelist works, what 2020's safe-linking changed, and how it is still bypassed. ROP: building code when you cannot inject itNX made the stack non-executable and classic shellcode died. Return-oriented programming resurrects it by reusing pieces of the binary already mapped. Here is how a chain is stitched together, how you defeat ASLR with a leak, and why ret2csu saves you when gadgets are scarce. SQL injection: from UNION to blind time-basedWhen user input is concatenated into a query, the attacker rewrites the SQL logic. UNION to exfiltrate data, boolean and time-based blind when you see no output. XSS: stored, reflected and DOM-basedInjecting JavaScript that runs in the victim's browser. Three variants by where the payload lives, one defence that matters: context-aware encoding. CSRF: making the victim's browser actThe browser attaches cookies to every request, even ones started by another site. Without a token, a hidden form performs actions as the logged-in user. SSRF: turning the server into a proxyIf the server fetches a user-supplied URL, it can be forced to reach internal services — including the cloud metadata endpoint that leaks credentials. XXE: XML external entitiesAn XML parser that resolves external entities can read local files, do SSRF, or exhaust memory. An old flaw, still alive in every endpoint that accepts XML. Path traversal and Local File InclusionOne ../ too many and you read files outside the intended folder. With PHP include, reading becomes executing. Insecure deserialization: objects that run codeRebuilding an object from untrusted bytes can trigger magic methods and gadget chains all the way to code execution. PHP and Java are the classic grounds.
« newer
older »
|
latest posts
your IP address:
216.73.216.108
visitor #0
MOTD:
Every abstraction leaks somewhere. Here we look at where. |