༧

tl;dr i found that when macOS’s Archive Utility extracts a ZIP archive containing symlinks, the symlinks themselves do not inherit the com.apple.quarantine extended attribute. when a user executes the symlink, Gatekeeper checks the symlink’s quarantine st…

art by fdkubba tl;dr in the first post , i described the initial design and plan behind iota. since then, i’ve evolved the design and added some more features. i still haven’t deployed to production, so this post is also still about design choices and imp…

tl;dr i’m building a lightweight detection engine called iota: https://github.com/bilals12/iota . it reads CloudTrail logs from S3, runs Python rules against them, and sends alerts to Slack. these are design notes on the core implementation, before we head

tl;dr earlier this year, i discovered that macOS’s genatsdb binary (Generate Apple Type Services Databas, i.e. font processing tool) runs without inheriting sandbox restrictions from its parent processes, creating a universal sandbox escape. this was assi…

part of the attack sim from the last post was an eBPF module that provided extended kernel-level monitoring and interference with processes. i thought it would be fun to reverse engineer it in a restricted environment, like a docker container. container t…

tl;dr clusterfuck is a multi-stage attack simulation against k8s environments. it performs executing privilege escalation, container escape, credential theft, lateral movement, and crypto mining techniques. it’s designed to validate detection capabilities…

tl;dr how can we leverage PEB walking + dynamic API resolution to locate/use Windows APIs without relying on static imports?

tl;dr rootkit-style code that uses the Microsoft Detours library to perform system call hooking. this tool allows us to: hide malicious processes (like backdoors) from Task Manager and security tools. conceal files and directories from file explorers and…

tl;dr in part 1 , i talked about bypassing ASLR via information leaks. this time, we’ll try to bypass DEP (Data Execution Prevention) using a very specific method: leveraging WriteProcessMemory to copy shellcode into an already-executable region. this post

tl;dr ROP (Return Oriented Programming) techniques made many stack buffer overflows exploitable, despite DEP (Data Execution Prevention), leading to the introduction of ASLR (Address Space Layout Randomization) as a countermeasure (that randomizes memory…

tl;dr drivers are software components that facilitate communicatioon between the OS and hardware devices. since they operate at the kernel level, they’re granted extensive privileges and direct access to system resources. as a result, exploiting vulnerabi…

previously, we discussed/mapped all the fundamental Windows PE structures and parsing capabilities needed by every other component for our custom minidumper tool. in this part, we’ll define the minidump format structures that build upon the PE definitions.

credential management in macOS is not dissimilar to that in Windows, but with some additional quirks. let’s take a look at some of the ways they can be accessed, both legitimately and illegitimately. securityd credentials are managed by the securityd proc…

imagine if your computer kept a journal. a journal not merely consisting of poetic silicon muses, but moment-by-moment accounts of all its inner workings. these journals exist, and they’re called minidumps. minidumps are compact snapshots of a computer’s…

currently reading [*] there is no antimemetics division by qntm [*] structure and interpretation of computer programs by sussman + abelson [*] poc or gtfo by manul laphroaig [*] an inventory of losses by judith schalansky [*] applied cryptography: protoco…

during a recent penetration test, i encountered two linked web apps that i thought would be good case studies for a blog post. let’s call them Ren + Stimpy.

in part 1, i covered the first act of the post-exploitation phase, pivoting from the user workstation to the UAT server and then the dev server. in this part, i’ll use the privileges gleaned from the dev server to pivot to the production server, the child…

introduction corporate networks face a constant and ever-evolving array of threats. at the heart of many enterprise IT infrastructures lies Active Directory [AD]. this is a directory service developed by Microsoft that provides authentication (AuthC) and…

LATRODECTUS is an emerging malware loader that i first encountered during my research at the start of 2024. initially discovered by walmart’s security team, it quickly gained attention due to the similarities it held with ICEDID, particularly in the use of

if you ever find yourself in between jobs for an extended period of time, remember to take time off from bouncing from constantly worrying to being completely nihilistic. if you can spare the time and energy, it can be quite rewarding to find something th…

as part of a post-layoff glow-up, i began to delve deeper into programming and building my own tools. a lot of these tools are based on specific actions, like attacks, analysis, etc. one thing i’ve always been fascinated with though is object-oriented pro…

first time running with the cinestill 400d. it’s quite a finicky film, and i’m not sure i have the skill or patience (yet) to deal with its many quirks.

a fun aspect of pentesting is finding interesting ways to get authenticated sessions running. usually, a session authentication relies on the user entering some kind of key (password) that corresponds to their user ID (username). however, in some cases an…

since splurging on a new macbook m3 pro, that came with a 12-core CPU, 18-core GPU, 16-core neural engine, and 36GB of RAM, i thought to myself: i should probably use this to train some version of a local AI (LLM) i can use to boost my security and hacking

i really love this film.

a number of years ago, i received advice that would deeply change my outlook on engineering and understanding of technology. if you want to understand how something works, build it. at the time, i was a little too impatient to actually grasp the nuances of

over the past few days, i’ve been writing tools that automate cumbersome manual tasks and make my workflow/toolchain cleaner and pushing them to my personal github. the latest one in this series is a tool i call gdbExtract . as a security researcher, i sp…

this was my first roll of black + white film. i have to say, i had a lot of fun shooting with it because i wasn’t preoccupied with colour and got to focus instead on the moods and shadows of the shots. people here’s my friend sib, writing a message to his…

portra 800 is probably my favourite film to shoot with. once i’d gotten comfortable enough with the gold 200, i wanted to elevate my colour game with a more light sensitive film and this one is definitely up there. people some shots of friends: sib + kubb…

more work with the gold 200, my first and favourite film (until i discovered portra 800 at least). wrapping up the month of october. warm, sunny days and the leaves just starting to change.

the last roll of the manitoba trip. even though it’s a technically “inferior” film, i still love the gold 200 and these shots are some of my favourites.

second roll for the manitoba trip. first time shooting with the portra 800, and it turned out great (even if some shots are blurry).

first time shooting with ultramax 400. the colours seem a little cooler than the gold 200, and definitely not as rich as the portra 800, but i do like the “real” feel of some of these photos. it was also the first of 3 rolls i took along with me on my trip

still practicing. stuck with the gold 200 because it’s a low-cost film, and nice for summer days.

my first ever roll of film + my first ever analog camera. during the summer, i became increasingly disillusioned with our (my) over-dependence on technology, especially given both my career and hobbies are steeped in digitalia. i decided to shoot film, and

lately, i’ve been getting more and more into reverse engineering executable programs and using them to gain control of a target machine. it brings to mind what i learned in “microcontrollers and microprocessors”, a really interesting but tough course i to…

if you’ve worked in any sort of SaaS/tech company, odds are you’ve used a CI/CD (continuous integration/continuous delivery and deployment) and DevOps tool.

hello!

as i’ve been studying and preparing for my next big certification, the eCPPT (certified professional penetration tester), i had to remind myself to try and keep my skills sharp. since the course material for the eCPPT goes deeply into the fundamentals of…

i’m going to talk about one of my favourite rooms on thm, and that is overpass 2. overpass 2 is the 7th room in the “advanced exploitation” chapter, of the “offensive pentesting” path. it’s also the 2nd room in the overpass series, which is about a bunch…

this is a walkthrough for the room “game zone” on tryhackme. this was the 4th room in the “advanced exploitation” chapter, part of the “offensive pentesting” path. i liked this room because i like sql (yes, i know). database security is a very important c…

over the past year, i felt something i haven’t felt in a long time. passion, for a new hobby and possibly a new field of work: cybersecurity. more specifically, pen(etration)testing. the story is pretty boring. as a kid, i was fascinated by computers. the…

cracks in the asphalt, cracks in the curb cracks in the sidewalk, cracks in the doors cracks in the walls and cracks in the floor cracks in the glass, cracks in the steel cracks in the marble and cracks in the pillars crack my eyes open to see a little mo…