[Research] Bypassing Windows Kernel Mitigations: Part0 - Deep Dive into KASLR Leaks Restriction
hackyboiz.github.io/2025/04/13/l0c…
In this post, we’ll take a closer look at the new KASLR-related mitigation introduced in Windows 11 and Windows Server 24H2, and explore a novel method for…
I have recently been in the V8 vulnerability research/exploitation topic and in this post I will briefly talk about the key points at the very start of the study:
@HaifeiLi I ran probably the largest office fuzzing program in the world at one point
We had 128 IBM blade systems fuzzing concurrently + office UI analysis @ 25k fuzzing attempts a minute, with crash analysis + crash confirmation + rewind + automated variation + user interaction…
Write-up of my v8 bug: Critical type confusion in V8's Turboshaft compiler allowed stale pointers to bypass GC, leading to exploitable memory corruption.
Full details + PoC: bushido-sec.com/index.php/2025…
The most elegant V8 Wasm Turboshaft typer exploit that I've reported. This primitive converts **any** Wasm type confusion in **any type hierarchy** into fully controlled arbitrary type confusion - e.g. what happens if you type `null : ref extern`? RCE :) crbug.com/372269618
Sharing slides for another #blackhat EU 2024 talk of us: (Enhancing Automatic Vulnerability Discovery for Windows RPC/COM in New Ways)
github.com/edwardzpeng/pr…
Sharing our slides for #Blackhat EU 2024: Diving into Spooler: Discovering LPE and RCE Vulnerabilities in Windows Printer Driver
github.com/edwardzpeng/pr…
This new Project Zero blog post is sick. It offers a glimpse into how folks do UAF in the "real world". (i.e. in the wild)
You have to be smart about what to spray, etc. especially when you don't have a leak
Vulnerability research may feel directionless if you haven't yet worked out metaskill of strategy crafting, particularly scope narrowing. To deal with that, you may use existing bugs to serve as a glorified dice. For example, suppose there is an integer overflow in a regexp
New blog post about OSS-Fuzz AI-powered fuzzing is live!
We talk about what went into making LLMs work well enough for this use case to find 26 new vulnerabilities (including a CVE in OpenSSL), as well as what else we have planned to make this better.
security.googleblog.com/2024/11/leveli…
In our new article, we sat down with one of our SSD Labs researchers to discuss how he found a critical vulnerability in Windows. Learn about the challenges, breakthroughs, and techniques behind a security researcher’s process: medium.com/ssd-secure-dis…
To pwners and reversers:
Have you tried my GEF fork?
Features:
- Kernel commands (without "vmlinux with symbols"; for qemu-system)
- More architectures support (for qemu-user)
- Minor heap allocator dumper
And many more!
Bugs? Please report them:) Enjoy!
github.com/bata24/gef
Excited to share my latest blog post: "Breaking Control Flow Flattening: A Deep Technical Analysis"
I showcase usage of formal proofs and graph theory to automate CFF deobfuscation, among other things !
Might make it a talk...? 👀
zerotistic.blog/posts/cff-remo…
Another big step towards becoming a security boundary: today we’re expanding the VRP for the V8 Sandbox
* No longer limited to d8
* Rewards for controlled writes increased to $20k
* Any memory corruption outside the sandbox now in scope
bughunters.google.com/about/rules/ch…
Happy hacking!
M4 Mac Mini AI Cluster
Uses @exolabs with Thunderbolt 5 interconnect (80Gbps) to run LLMs distributed across 4 M4 Pro Mac Minis.
The cluster is small (iPhone for reference). It’s running Nemotron 70B at 8 tok/sec and scales to Llama 405B (benchmarks soon).
1K Followers 380 FollowingHacker in the fast lane.. 🫠
밝게 빛나는 무수한 별빛 중 하나가 될 그날까지 💫
be the special st4rlight in the world.. 🌠
protected tweet @twilight_priv
Rhythm-tic @rhythm_setin
1K Followers 242 FollowingA premier gathering of offensive cybersecurity professionals, researchers, thought leaders and innovators from around the region.
709 Followers 847 Following🇻🇳. RIT grad. Malware Analysis. Vulnerability Research (browsers) 😄😄😄
@\ret2life on the infosec,exchange thing. bruh.
like @[email protected] bruh
4 Followers 189 FollowingOffensive security researcher | Exploiting the gaps between business logic and security controls | Financial systems specialist
4K Followers 4K FollowingPrincipal Security Researcher - Tweets and opinions are my own and not of my employer. #fuzzing #trainings #security YouTube: https://t.co/grWZKdQlqr
22K Followers 9 FollowingYour new async coding agent by @GoogleLabs. Built for devs, open to feedback, evolving with you. Dive in → https://t.co/iIzFEMmWgv
1K Followers 242 FollowingA premier gathering of offensive cybersecurity professionals, researchers, thought leaders and innovators from around the region.
44K Followers 3K FollowingChoose disfavour where obedience does not bring honour.
I do math. And was once asked by R. Morris Sr. : "For whom?"
@[email protected]
1K Followers 70 FollowingAdvanced sandbox-based system specifically designed and built for detecting file-based zero-day and hard-to-detect exploits. By @HaifeiLi.
4K Followers 4K FollowingPrincipal Security Researcher - Tweets and opinions are my own and not of my employer. #fuzzing #trainings #security YouTube: https://t.co/grWZKdQlqr
2K Followers 144 Followinghttps://t.co/bmyDmTlFKv
Senior Staff Eng @ Google Open Source Security. Founder of https://t.co/K575lba4tt, lead/co-founder for OSS-Fuzz.
223 Followers 290 FollowingWeeb bounty hunter 🇧🇷, 2024 Top 20 Chrome VRP Researcher.
Interested in browser/kernel security, GFX and AI driven text games.
Miqu!
875 Followers 70 FollowingAn open-eyed man falling into the well of weird warring state machines. I talk about reverse engineering, vulnerability research and exploit development.
8K Followers 150 FollowingFor contact in the security community. NOTE: All the tweets are totally my personal opinions, not about any of my current employer stuff.
20K Followers 271 FollowingOffensive security company. Dojo of many ninjas. Red teaming, reverse engineering, vuln research, dev of security tools and incident response.
2K Followers 2 FollowingInfoSec boutique.
Owning things since 2014.
We love to go for the extra mile, where we usually find the best 🦟🐞🪲🪳🐛🐜🕷 the others miss.
5K Followers 9 FollowingPaged Out! is a free magazine about programming, hacking, security hacking, retro computers, modern computers, electronics, demoscene, and other amazing topics.
No recent Favorites. New Favorites will appear here.