Hiding data in Base64 padding: an RCTF crypto challenge
A look at an RCTF cryptography challenge that hid its answer inside the padding bits Base64 normally discards.
Read moreArchive: 2015
Notes first published in 2015.
Unpacking a layered crack-me: RCTF reverse engineering 300
Notes on a crack-me that stacked packing, anti-disassembly tricks and a multi-step encoding scheme before the real check.
Read moreFilename injection and a four-step privilege escalation: two RCTF web challenges
A filename-based SQL injection bypassing keyword filters, plus a four-stage privilege escalation chain ending in a filtered file upload.
Read moreFireEye's FLARE-On 2015: an eleven-challenge reverse engineering gauntlet
A round-up of the themes across FireEye's eleven-stage 2015 FLARE-On reverse-engineering competition.
Read moreWhen Baidu's traffic was hijacked to flood GitHub
How a March 2015 network-level hijack turned Baidu analytics traffic into an unwitting denial-of-service tool against GitHub.
Read moreBadIRET: a Linux kernel privilege escalation rooted in a CPU instruction quirk
An analysis of BadIRET (CVE-2014-9322), a Linux kernel flaw where a mishandled CPU exception let a local process redirect a kernel-internal pointer.
Read more