Public curated feed for visitors
Active view
21 of 21 entries
Hi,Guys I have recently working on an another project to find leaked data and vulnerable endpoints from an actual running site.I have spotted an Publically accessable AWS S3 bucket in the site.when I opened it I found several files dating back to 2019 ,but recently uploaded files
So recently there was an article regarding Claude Code profiling Chinese nationals (or more specifically timezone profiling) when someone RTFM’d and found out Anthropic was using the TZ setting, if set to either Shenzen or Urumqi, to change how access to their models where given. This was also
When a program needs to generate/retrieve code and run it, several steps are required. The program needs to allocate memory with read, write, and execution permissions, and perhaps remove the write permission afterward to resemble a normal program. Alternatively, it has to allocate memory with read and write permissions,
When choosing an initial access technique, I am a big fan of LNKs. Studying CTI reports, I noticed the constant recurrence of LNKs as an initial access vector across multiple APTs, including APT28, APT41, and Kimsuky. I was particularly drawn by a specific campaign run by Kimsuky, in which they
github.com GitHub - tc4dy/CVE-2026-41091-PoC-Exploit: 🔥 CVE-2026-41091 SolarFlare | Microsoft Defender... 🔥 CVE-2026-41091 SolarFlare | Microsoft Defender LPE exploit. Low-privileged users gain NT AUTHORITY\SYSTEM via Cloud Files API + NTFS junction trickery. Forces Defender to write malicious payloads to System32 with SYSTEM rights.
Following @pico and the spirit of the tradition of the old 0x00sec, this challenge will be focussing on easing beginners into reverse engineering in a fun format. More experienced players can join in just for fun too. This challenge was originally intended to be a follow-up series to [CrackMe]
Bypassing CFI What CFI Is Control Flow Integrity (CFI) is a security mitigation that protects against control-flow hijacking attacks by checking if function call is valid. Every compiler has its own implementation of CFI (if it has one at all), but the modern and complete version is that of
Introduction Every high-level language has built-in mechanisms designed to make life easier for programmers. Like any other programming language, C++ provides a wealth of ready-made solutions. Programmers usually don’t know how these work. Not because the source code is proprietary or anything like that, but
I realized that every time I talk about linker scripts, I say that most programmers won’t ever see one unless they work with embedded systems, but I never go deeper than this. I did that again in Making of Doppelgänger and Crypto/Reverse or how to
Original post by 0xf00s, from the 0x00sec forum. Hello, we meet again. Snagged a convo between c0z and pico the other day on real time encryption or Runtime Code Encryption, sometimes called IBI (Instruction-By-Instruction) though that name crawled out of the academic side (bunch of losers) Wanted to
Following @pico and the spirit of the tradition of the old 0x00sec, @john put this challenge together. to ease beginners into reverse engineering in a fun format. More experienced players can join in just for fun too. This challenge was originally intended to be a follow-up series to [CrackMe]
@import url('https://fonts.googleapis.com/css2?family=Share+Tech+Mono&family=Orbitron:wght@400;700;900&display=swap'); :root { --green: #00ff88; --dim-green: #00cc66; --dark-green: #003322; --bg: #050d07; --surface: #0a1a0f; --border: #1a3a22; --accent: #ff6b35; --text: #b0d4b8; --muted: #4a7a55; } * { margin: 0; padding: 0; box-sizing: border-box; } body { background:
Original post by w1sdom, from the 0x00sec forum. In this example, we will perform one of the basic kernel exploitation techniques which is essentially an arbitrary write (write-what-where). This vulnerability occurs when a kernel module does not filter functions that copy data from userspace to kernel space, where
About two weeks ago I completed an internal pentest structured as a purple team exercise. I conducted the attacks while the client’s SOC monitored for visibility gaps in real time. The environment was large and, for reasons I still don’t fully understand, I had roughly one
Original by Magnus on the forum. Most beginners get lost when it comes to exploiting the heap. That’s because there are a lot of techniques that differ depending on the glibc version and other variables, making them want to throw their computer in the trash. But it’s not really that complicated.
Keeping the old 0x00sec tradition alive, 0x00pico has dropped a new crypto / reverse challenge. It's a Linux x86_64 binary and the goal is straightforward: recover the password and get access. You can brute it, reverse it, or both. The challenge is for beginners, but there's
Bring Your Own Vulnerable Device (BYOVD) is a technique used in red teaming that allows users to perform kernel-level actions by exploiting a vulnerable, legitimately signed kernel device driver. Drivers run in ring 0 (kernel level), which is the most privileged level in the Windows OS. This gives an
dmcxblue writes in the forum: Hi everyone!! I’m excited to be back in this fantastic community and forum where my journey of publishing articles on Red Team techniques and Offensive Security first began. It’s been quite some time since the site came down and I am
After a long break, we’re relaunching 0x00sec and opening the doors to what it was always meant to be: a place for hackers, researchers, students, and curious minds to share real work, learn from each other, and push their skills forward. To kick things off, we’re
Introduction CVE-2025-27591 is a Local Privilege Escalation (LPE) vulnerability affecting below, a time-traveling resource monitor for Linux developed by Facebook Incubator. The issue stems from insecure permission handling during the initialization of log directories, where the application inadvertently creates world-writable directories and files. This flaw allows
Red team engagements are goal-driven, not gadget-driven. As much as we love C2s and malware that help us achieve our goal, the point isn’t to drop a flashy implant or chase CVE scoreboards. It’s to achieve an objective: access the asset, prove the risk,