Vulnerability Research

OffensiveCon23 talk recordings are up on YouTube Byte

CVE-2023-25136 - Pre-auth double free in OpenSSH 9.1 sshd Vulnerability

Dota 2 with V8 from 2018 Byte

Trail of Bits audit of cURL finds two security bugs Byte

CVE-2022-23521 - X41 audit finds critical heap overflows in Git Vulnerability

CVE-2023-22809 - sudoedit policy bypass allows editing any file Vulnerability

CVE-2022-3602 - Why fuzzing missed the OpenSSL punycode overflow Vulnerability

CVE-2022-41674 - Linux kernel WiFi bugs exploitable over the air Vulnerability

STAR Labs walks through the Safari JIT bug CVE-2022-32792 Byte

3rd Annual Binary Golf Grand Prix (BGGP3) Byte

Software developer cracks Hyundai car security with Google search Byte

CVE-2022-22715 - Windows Dirty Pipe: a ushort overflow in npfs.sys escapes the Adobe Reader sandbox Vulnerability

CVE-2022-27255 - Realtek eCos SDK SIP ALG buffer overflow Vulnerability

CVE-2022-34713 - DogWalk MSDT flaw exploited and finally patched Vulnerability

CVE-2022-30333 - unrar symlink check bypass gives pre-auth RCE on Zimbra Vulnerability

CVE-2022-21233 - ÆPIC Leak reads stale data from Intel APIC registers Vulnerability

Black Hat USA 2022 and DEF CON 30 Byte

Microsoft links Austrian firm DSIRF to Subzero spyware attacks Byte

Gitlab Project Import RCE Analysis (CVE-2022-2185) Byte

CVE-2022-34918: A crack in the Linux firewall Byte

CVE-2022-29900 - Retbleed: Spectre-BTI via return instructions Vulnerability

CVE-2022-2274 - OpenSSL 3.0.4 RSA memory corruption on AVX-512 CPUs Vulnerability

CVE-2022-24436 - Hertzbleed: frequency scaling as a remote timing side channel Vulnerability

CVE-2022-30190 - Follina: Office documents run code via the MSDT handler Vulnerability

GIAC Exploit Researcher and Advanced Penetration Tester 6 min read

May 2016 I had the chance to participate in the SANS SEC660: Advanced Penetration Testing, Exploit Writing, and Ethical Hacking in Amsterdam. The course syllabus gave a good outline about what to …