EDR12 Internal NTDLL Functions for Shellcode Execution
The article tests a shellcode execution trick using a private NTDLL function as an indirect call gadget, but notes it may offer…
oxfemale·
May 4·
9 min
·12
//
299 postsEDR12 
LSASS10 Credential Dumping: Local Security Authority (LSA|LSASS.EXE)
The article surveys LSASS credential dumping techniques, explains what secrets LSASS stores, and recommends defenses such as Credential Guard, LSASS PPL, ASR…
oxfemale·
May 4·
10 min
·10
BYOVD32 gdrv3.sys – Reverse Engineering a Signed Kernel Driver with 13 Hardware Access Primitives
Reversing a legitimately signed Windows kernel driver to map 13 IOCTLs exposing physical memory access, MSR read/write, kernel memcpy, and more, and…
oxfemale·
May 4·
32 min
·32
Citrix21 89 vulnerabilities in XAPI / Citrix XenServer
Shittrix discloses 89 XAPI/Citrix XenServer flaws caused by unvalidated metadata fields, enabling low-privileged users to mount host disks, inject storage commands, redirect…
oxfemale·
Apr 30·
29 min
·21
AMSI28 Patchless AMSI Bypass via Page Guard Exceptions
The article shows a patchless AMSI bypass using Page Guard exceptions and VEH to intercept AmsiScanBuffer, force an early clean return, and…
oxfemale·
Apr 29·
13 min
·28
Android30 A Step-by-Step Guide to Uncovering Vulnerabilities in a Mobile App
The article shows how APK decompilation with Jadx exposed Cordova JavaScript code, hardcoded database keys, CryptoJS-derived secrets, backend endpoints, and a critical…
oxfemale·
Apr 28·
7 min
·30
BYOVD29 How Kernel Anti-Cheats Work: A Deep Dive into Modern Game Protection
The article explains how kernel anti-cheats monitor games from Ring 0 using callbacks, handle filtering, memory scans, driver checks, anti-debugging, VM detection,…
oxfemale·
Apr 27·
56 min
·29
CPL31 A Shortcut to Coercion: Incomplete Patch of APT28’s Zero-Day Leads to CVE-2026-32202
Akamai shows how Microsoft’s incomplete fix for an APT28 LNK exploit left CVE-2026-32202: a zero-click UNC path issue that coerces SMB/NTLM authentication…
oxfemale·
Apr 27·
7 min
·31
APC28 From MessageBox to Rootkit: A Practical Journey Through Windows Malware Internals
The article walks through Windows malware development from dynamic API resolution and PEB walking to injection, APC execution, driver basics, DKOM process…
oxfemale·
Apr 27·
72 min
·28
Driver25 Plug me If you can : Exploiting USB Printer Drivers in Windows
ENKI analyzes CVE-2026-32223, a heap overflow in Windows usbprint.sys triggered by malformed USB printer descriptors, leading to SYSTEM privilege escalation via crafted…
oxfemale·
Apr 27·
36 min
·25
ESXi28 Kyber Ransomware Double Trouble: Windows and ESXi Attacks Explained
Rapid7 analyzes Kyber ransomware’s Windows and ESXi variants, showing coordinated attacks on VM infrastructure, file systems, backups, recovery tools, and cryptographic claims.
oxfemale·
Apr 27·
16 min
·28
CSRF28 JWT, Part 13: XSS + JWT = Full Account Takeover
The article shows how XSS can steal or abuse JWTs from localStorage, sessionStorage, cookies, or memory, and recommends HttpOnly cookies, DPoP, BFF,…
oxfemale·
Apr 27·
13 min
·28
cpp24 Secure Code Review: Finding XML vulnerabilities in Code
The article explains how to spot XXE risks during C++ secure code review by checking XML parser configuration, especially Xerces-C++ entity handling…
oxfemale·
Apr 24·
8 min
·24
BYOVD20 Enumerating Windows Process Creation Callbacks
The article shows how to enumerate Windows process creation callbacks by reading PspCreateProcessNotifyRoutine from kernel memory using a BYOVD read primitive and…
oxfemale·
Apr 24·
14 min
·20
Claude AI19 Jenny was a Friend of Mine – MCPs and Friends
The article shows how Claude Code plus MCP can automate vulnerability hunting with RE, fuzzing, RAG, bounty scoring, and strict validation gates…
oxfemale·
Apr 24·
26 min
·19
Claude AI11 Leveling Up Secure Code Reviews with Claude Code
Claude Code can speed up secure code reviews by mapping code paths, sources, sinks, and risky patterns, but it works best with…
oxfemale·
Apr 24·
18 min
·11
Claude AI4 MAD Bugs: Feeding Claude Phrack Articles for Fun and Profit
The article shows Claude turning a Phrack rsync exploit write-up into a faster working ARM64 RCE, rebuilding missing pieces, debugging without GDB,…
oxfemale·
Apr 22·
11 min
·4