Goals: Add links that are reasonable and good explanations of how stuff works. No hype and no vendor content if possible. Practical first-hand accounts and experience preferred (super rare at this point).
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#include <objc/runtime.h> | |
#include <Foundation/Foundation.h> | |
#include <IOKit/IOKitLib.h> | |
#include <spawn.h> | |
#include <unistd.h> | |
#include <stdio.h> | |
#include <stdlib.h> | |
#include <err.h> | |
#include <sys/wait.h> | |
#include <sys/stat.h> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
// 3D Dom viewer, copy-paste this into your console to visualise the DOM as a stack of solid blocks. | |
// You can also minify and save it as a bookmarklet (https://www.freecodecamp.org/news/what-are-bookmarklets/) | |
(() => { | |
const SHOW_SIDES = false; // color sides of DOM nodes? | |
const COLOR_SURFACE = true; // color tops of DOM nodes? | |
const COLOR_RANDOM = false; // randomise color? | |
const COLOR_HUE = 190; // hue in HSL (https://hslpicker.com) | |
const MAX_ROTATION = 180; // set to 360 to rotate all the way round | |
const THICKNESS = 20; // thickness of layers | |
const DISTANCE = 10000; // ¯\\_(ツ)_/¯ |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
""" | |
31-round sha256 collision. | |
Not my research, just a PoC script I put together with numbers plugged in from the slide at | |
https://twitter.com/jedisct1/status/1772647350554464448 from FSE2024 | |
SHA256 impl follows FIPS 180-4 | |
https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf | |
""" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#include <Core.h> | |
#include <Win32.h> | |
#include <Structs.h> | |
#include <Sleep.h> | |
#include <Utils.h> | |
SEC( text, C ) VOID Ekko ( DWORD SleepTime, PINSTANCE Instance) | |
{ |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
using System; | |
using System.Runtime.CompilerServices; | |
using System.Reflection; | |
using System.Reflection.Emit; | |
namespace FunkyJit | |
{ | |
class Program | |
{ | |
public static void Nothing() { Console.WriteLine(); } | |
static void Main(string[] args) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
// Compiles with Visual Studio 2008 for Windows | |
// This C example is designed as more of a guide than a library to be plugged into an application | |
// That module required a couple of major re-writes and is available upon request | |
// The Basic example has tips to the direction you should take | |
// This will work with connections on port 587 that upgrade a plain text session to an encrypted session with STARTTLS as covered here. | |
// TLSclient.c - SSPI Schannel gmail TLS connection example | |
#define SECURITY_WIN32 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
/** | |
Compression using undocumented API in rdpbase.dll | |
RDPCompressEx supports four algorithms : MPPC-8K, MPPC-64K, NCRUSH and XCRUSH. | |
This code supports all except NCRUSH. | |
The MPPC compression ratio is very similar to LZSS, so this could be quite useful for shellcode trying to evade detection. | |
NCRUSH compression appears to work but fails for decompression. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
// | |
// How to locate the NT Delegate Callback Table in x86 builds of ntdll.dll | |
// | |
// @modexpblog | |
// | |
#define PHNT_VERSION PHNT_THRESHOLD | |
#include <phnt_windows.h> | |
#include <phnt.h> |
NewerOlder