Attack and defence in web games: a structured overview
A tour of the recurring weak points in browser-based games: tamperable network protocols, memory edits, save-file edits, and account or payment fraud.
Read moreArchive: 2012
Notes first published in 2012.
How malicious Android apps used activity hijacking to steal data
A look at activity hijacking: a non-root Android technique where a malicious app watches for a target app, then overlays a convincing fake login screen.
Read moreA lesson in privilege escalation from an old Novell directory service
A legacy Novell/ConsoleOne environment illustrates how group self-enrolment and concurrent sessions turn modest access into full account takeover.
Read moreAnti-debugging techniques from Hack.lu's mealtime challenge
A tour of the anti-debugging tricks in Hack.lu's mealtime CTF binary: PEB-flag checks, deferred VEH registration, and injection across two processes.
Read moreClassic character and filter bypass patterns in cross-site scripting
Overview of how testers historically got around single-character filtering and browser XSS filters, and what it taught defenders about input handling.
Read moreHow a PHP escaping feature undermined a browser XSS filter
How an old PHP input-escaping feature changed request content in a way a browser's XSS filter did not account for, allowing a bypass.
Read moreDEF CON CTF forensics: finding a key inside a router firmware image
A firmware-analysis CTF challenge solved by identifying the device, extracting its filesystem, and locating a flag file inside it.
Read moreReverse engineering an unfamiliar instruction set under CTF time pressure
A CTF binary challenge shipped a packet capture plus an executable for an unfamiliar architecture, solved mainly through protocol-flow reasoning.
Read moreMimikatz and why Windows stopped trusting lsass.exe with plaintext
Mimikatz showed that lsass.exe held reversibly encrypted credentials, not just hashes, and that discovery reshaped how Windows protects memory.
Read moreCVE-2012-0053: a quiet reminder that httponly is not absolute
Apache's handling of oversized headers once echoed full cookie values back in an error page, defeating the httponly flag that was meant to hide them from scripts.
Read moreWhen a bundled upload component ships without its own checks
A reported flaw in a CMS's upload component showed how outsourcing an upload widget's front end can leave its backend endpoint unchecked.
Read moreHow an oversized-cookie error page turned into an httponly bypass
Exploiting the Apache cookie-disclosure flaw needed a second weaker XSS, not a direct document.cookie read, to push the cookie jar over the server's size limit.
Read more