Live and recent posts from across the Fediverse tagged #exploitdevelopment, aggregated by home.social.
Exploiting Reversing (ER) Series | Article 10: iOS Security Research (part 01)
223 pages, free. The first article in the series aimed at iOS itself, and the opening of a multi-part sequence.
Published on:
https://www.blackstormsecurity.com/research/
This article will be published on https://exploitreversing.com/ next week.
Hope you enjoy the read!
#iOS #VulnerabilityResearch #ExploitDevelopment #ReverseEngineering #KernelSecurity
Pentesting Evolves as AI Agents Close Vulnerability Gap
The vulnerability gap is widening as attackers speed up exploitation, with new vulnerabilities being weaponized in just five days, while defenders take a median of 43 days to patch - and 80% coverage is no longer enough to keep you safe.
#Pentesting #AiAgents #VulnerabilityManagement #ExploitDevelopment #ThreatIntelligence
AI-Powered Exploit Porting Threatens Industrial Control Systems
A recent exploit development stage for targeting Industrial Control Systems racked up a hefty $535.74 API usage bill over just 8 hours and 32 minutes, highlighting the costly and disturbing potential of AI-powered threat tactics. This unsettling advancement centers around CVE-2021-31886, a severe vulnerability in…
#IndustrialControlSystems #AipoweredThreats #ExploitDevelopment #Cve202131886 #NucleusFtp
𝘼𝙄 𝙬𝙞𝙡𝙡 𝙬𝙧𝙞𝙩𝙚 𝙚𝙭𝙥𝙡𝙤𝙞𝙩𝙨 𝙛𝙤𝙧 𝙮𝙤𝙪… 🤖💥
…if you tell it what to do 🧠
Stay in control.
Take a Corelan class 🎓
Use AI strategically. https://www.corelan-training.com
Patching Speed Falls Behind as AI-Generated Exploits Rise
The clock is ticking faster than ever: AI can now turn software patches into working exploits in under an hour, shattering the old assumption that reverse-engineers had weeks to spare. Anthropic's Claude Mythos Preview has already proven its mettle, converting 18 Firefox patches into 8 code-execution exploits…
#AigeneratedExploits #ExploitDevelopment #PatchManagement #VulnerabilityExploitation #EmergingThreats
Convicted Felons Launch Offensive Cybersecurity Firm, Lure Researchers with Million-Dollar Payouts
Meet IRIS C2, a bold new cybersecurity firm launched by convicted felons, shaking up the industry with million-dollar payouts to attract top vulnerability researchers and exploit developers. They're offering up to $7 million for zero-day exploits and other cutting-edge capabilities.
#VulnerabilityResearch #ExploitDevelopment #CybersecurityFirm #ZeroDay #BugBounty
Oracle Exploit Spotted in Wild Ahead of Proof-of-Concepts
A critical Oracle vulnerability, CVE-2026-46817, with a 9.8 severity rating is being exploited in the wild, just days before a proof-of-concept was expected to be released. The attacks, detected by threat intelligence firm Defused, appear to be more like reconnaissance tests than targeted campaigns, with six attempts logged from…
#OracleExploit #Cve202646817 #EbusinessSuite #EmergingThreats #ExploitDevelopment
Drupal Rushes Security Fix to Plug High-Risk Bug
Drupal is rushing out a critical security update today to fix a high-risk bug that could be exploited by hackers within hours of the patch being released. The update is a core security release aimed at plugging a vulnerability that poses a significant threat to users.
#DrupalSecurityUpdate #HighRiskVulnerability #CoreSecurityRelease #EmergingThreats #ExploitDevelopment
Security Researchers Uncover 47 Zero-Days at Pwn2Own Berlin
In a thrilling three-day competition, security researchers at Pwn2Own Berlin uncovered a staggering 47 zero-day vulnerabilities, raking in nearly $1.3 million in prize money, with the Devcore Research Team taking home a whopping $505,000. The top prizes included a $200,000 award for a VMware ESXi exploit and a $100,000 prize for a…
#ZeroDay #Pwn2ownBerlin #VulnerabilityResearch #ExploitDevelopment #Trendai
Remediation Programs Often Fail to Validate Fixes
The alarming truth is that remediation programs often fall short, with a staggering mismatch between the speed of exploits and fixes - Mandiant's report reveals a mean time to exploit of just -7 days, while Verizon's data shows a median remediation time of 32 days.
#VulnerabilityManagement #ExploitDevelopment #RemediationPrograms #Mtrends #Dbir
Autonomous Teaming Closes Defenders' Speed Gap
The alarmingly rapid pace of cyber threats has left defenders scrambling to keep up, with the time from vulnerability disclosure to working exploit dwindling from 56 days in 2024 to a staggering 10 hours in 2026. Meanwhile, defenders are still stuck on human time, struggling to match the lightning-fast speed of attackers who now operate…
#VulnerabilityManagement #ExploitDevelopment #AutonomousTeaming #Cve #EmergingThreats
Exploiting Reversing (ER) series: article 09 | Exploitation Techniques: CVE-2024-30085 (part 03)
Today I am releasing the nineth article in the Exploiting Reversing Series (ERS). In “Exploitation Techniques | CVE-2024-30085 (Part 09)” I provide a 106-page deep dive and a comprehensive roadmap for vulnerability exploitation:
https://exploitreversing.com/2026/04/28/exploiting-reversing-er-series-article-09/
Key features of this edition:
[+] Dual Exploit Strategies: Two distinct exploit editions built on the cldflt.sys heap overflow.
[+] PreviousMode Edition: Exploit cldflt.sys via WNF OOB + Pipe Attributes + ALPC + _KTHREAD.PreviousMode flip: elevation of privilege of a regular user to SYSTEM.
[+] PPL Bypass Edition: Exploit cldflt.sys via WNF OOB + PreviousMode flip + _EPROCESS.Protection strip + MiniDumpWriteDump: elevation of regular user to SYSTEM.
[+] Solid Reliability: Two complete, stable exploits, including a multi-step cleanup phase that restores the corrupted pipe attribute Flink and _KTHREAD.PreviousMode before process exit, preventing crash on cleanup.
This article guides you through two additional techniques for exploiting the CVE-2024-30085 Heap Buffer Overflow. While demonstrated here, these methods can be adapted as exploitation techniques for many other kernel targets.
I hope this serves as a definitive resource for your research. If you find it helpful, please feel free to share it or reach out with your feedback!
The following articles will continue the miniseries about iOS and Chrome, which are my areas of research.
Enjoy the reading and have an excellent day.
#exploit #exploitdevelopment #windows #exploitation #vulnerability #minifilterdriver #kernel #heapoverflow
AI Models Accelerate Vulnerability Research, Raising Cybersecurity Risks
Commercial AI models are rapidly advancing vulnerability research and exploit development, cutting the time from discovery to exploitation and significantly raising the stakes for cybersecurity. This emerging trend poses new and heightened risks for the industry.
#AiModels #VulnerabilityResearch #CybersecurityRisks #EmergingThreats #ExploitDevelopment
AI Models Accelerate Vulnerability Discovery, Pressing Defenders to Adapt
The double-edged sword of AI: while it's being used to help developers, it's also become a powerful tool for attackers to rapidly discover and exploit software flaws, forcing defenders to scramble to keep up. As AI-powered vulnerability discovery accelerates, the pressure is on for defenders to adapt and…
#VulnerabilityDiscovery #AiModels #EmergingThreats #ExploitDevelopment #ThreatIntelligence
"Our internal evaluations showed that Opus 4.6 generally had a near-0% success rate at autonomous #ExploitDevelopment But #MythosPreview is in a different league.
For example, Opus 4.6 turned the vulnerabilities it had found in Mozilla’s Firefox 147 JavaScript engine—all patched in Firefox 148—into JavaScript shell exploits only two times out of several hundred attempts. We re-ran this experiment as a benchmark for Mythos Preview, which developed working #exploits 181 times, and achieved register control on 29 more."
Last weekend I attended FlagWars 2026, an in-person CTF organized by Laokoon, IBM and CGI. It has been some time since my last Jeopardy CTF, so getting back into it was a great time. Beyond the competition itself, you always meet a ton of cool new (and familiar!) people at these events.
To recap one of the challenges, I wrote up my full solve for "Lightsaber Constructor", a pwn challenge where a Use-After-Free bug let me chain tcache poisoning and a GOT overwrite for a shell. Check it out and let me know what you think!
#pwn #ctf #flagwars #ExploitDevelopment
https://s3mme.com/posts/flagwars-2026-lightsaber-constructor/
The eighth article of the Exploiting Reversing Series (ERS) is now live. Titled “Exploitation Techniques | CVE-2024-30085 (Part 02)” this 91-page technical guide offers a comprehensive roadmap for vulnerability exploitation:
https://exploitreversing.com/2026/03/31/exploiting-reversing-er-series-article-08/
Key features of this edition:
[+] Dual Exploit Strategies: Two distinct exploit versions leveraging the I/O Ring mechanism.
[+] Exploit ALPC + WNF OOB + Pipe Attributes + I/O Ring: elevation of privilege of a regular user to SYSTEM.
[+] Replaced ALPC one-shot write with Pipe Attribute spray for I/O Ring RegBuffers corruption: more reliable adjacency control.
[+] Exploit WNF OOB + I/O Ring Read/Write: elevation of privilege of a regular user to SYSTEM.
[+] Pure I/O Ring primitive: eliminated ALPC dependency entirely. WNF overflow directly corrupts I/O Ring RegBuffers for arbitrary kernel read/write.
[+] Solid Reliability: Two complete, stable exploits, including an improved cleanup stage.
This article guides you through two additional techniques for exploiting the CVE-2024-30085 Heap Buffer Overflow. While demonstrated here, these methods can be adapted as exploitation techniques for many other kernel targets.
I hope this serves as a definitive resource for your research. If you find it helpful, please feel free to share it or reach out with your feedback!
Enjoy the read and have an excellent day.
#exploit #exploitdevelopment #windows #exploitation #vulnerability #minifilterdriver #kernel #heapoverflow #ioring
Master the "Gets()Buster" strategy: bypass strcpy() null-byte limits using partial return address overwrites and the Zero'ed Wall research methodology. https://hackernoon.com/the-house-of-gets-a-practical-bypass-for-the-null-byte-barrier #exploitdevelopment
34 zero-days in one day—hackers at Pwn2Own Ireland 2025 broke records and left no stone unturned, from browsers to mobile devices. Are our digital defenses ready for what’s coming?
#pwn2own2025
#zeroday
#cybersecurity
#vulnerabilityresearch
#infosec
#ethicalhacking
#securitytrends
#exploitdevelopment
#bugbounty
For experienced hardware hackers: an advanced guide to fun with microcontrollers. Learn to pull firmware from single-chip computers, even when they're configured against extraction.
This book details a wide variety of techniques, so you can reproduce real-world chip exploits in your own lab. Plus, find encyclopedic coverage of vulnerabilities for your hardware security work.
https://nostarch.com/microcontroller-exploits
#HardwareSecurity #ReverseEngineering #Microcontroller #ExploitDevelopment #InfoSec
🇧🇪 Belgian Roots. Global Impact. 🌍
Corelan is more than just 🍟, 🍺 & 👶🏼🚿.
We offer world-class Exploit Development Training for Windows:
🔹 Stack-based Exploit Dev
🔹 Heap Exploit Development Masterclass
Crafted in 🇪🇺, respected worldwide 🌐.
Built by a researcher, for researchers 🧠.
Support European excellence in cybersecurity!
🎯 Sign up here → https://bit.ly/corelan-training
#CyberSecurity #ExploitDevelopment #Corelan #InfoSec #InvestInEurope #MadeInBelgium #Heap #Stack #Windows
New Encoding Technique Jailbreaks ChatGPT-4o To Write Exploit Codes https://cybersecuritynews.com/encoding-technique-jailbreaks-chatgpt-4o/ #CyberSecurityResearch #CybersecurityTrends #ExploitDevelopment #CyberSecurityNews #cybersecuritynews #CyberSecurity #AISecurity #Exploit
Ready to navigate the treacherous waters of buffer overflows?
Check my latest blog post: "Wherein We Study A Buffer Overflow Prepare Our Aim: testing the waters"
We'll now be ready to actually exploit the return address and use it for our own means.
Consider this the first step before shellcoding gallore.
🦶 Dip your toe here: https://dreaming-of-dragons.blogspot.com/2024/10/wherein-we-study-buffer-overflow.html
#Shellcode #CyberSecurity #ReverseEngineering #LowLevelProgramming #TechBlog #ExploitDevelopment
Ready for the troubled waters of shellcode? I'm not. Not just yet, at least. But I'm by the shore and telling you about it in my latest blog post: "Wherein We Wade Through A Shellcode Shore: before the dive
"
Spoiler alert: shellcode remains relevant (and fun).
👉 Check out: https://dreaming-of-dragons.blogspot.com/2024/10/wherein-we-wade-through-shellcode-shore.html
#Shellcode #CyberSecurity #ReverseEngineering #LowLevelProgramming #TechBlog #ExploitDevelopment
We’ve just published the third and final part in our new series on Windows kernel driver vulnerability research and exploitation.
Exploiting AMD atdcm64a.sys arbitrary pointer dereference - Part 3:
https://security.humanativaspa.it/exploiting-amd-atdcm64a-sys-arbitrary-pointer-dereference-part-3/
In the previous articles, we covered the discovery of an arbitrary MSR read and an arbitrary pointer dereference vulnerability, and successfully confirmed them by putting together two PoCs. This time, we will craft a full exploit that chains both vulnerabilities to enable all privileges on Windows. Happy hacking!
#HumanativaGroup #HNSecurity #VulnerabilityResearch #ExploitDevelopment #Windows
Here’s a collection of the #SecurityAdvisories that I’ve published over the years:
https://github.com/0xdea/advisories
If you’re interested in #VulnerabilityResearch and #ExploitDevelopment, on @github and on the @hnsec blog you can also find a trilogy of talks on these topics that I delivered between 2019 and 2021:
https://github.com/0xdea/raptor_infiltrate19
https://github.com/0xdea/raptor_infiltrate20
https://github.com/0xdea/raptor_romhack21
I hope you’ll enjoy them!
Sometimes you write a quick, dirty & fugly thing and immediately feel disgusted by it. But it works, so does it matter in the end?
I want to share my thoughts on something I find discomforting. When I decided to work at cybersecurity field, I wanted to become a vulnerability researcher and exploit developer, because I found these fields mentally challenging. BUT, when I found out, working for law enforcement/military and intelligence services is a norm in these fields (individually or with VR firms), I was like "lol WHAT??". If I hadn't found out this truth, I would blindly educate myself to become competent in these fields, and I would waste a LOT of my time. How is this not being mentioned when talking about these fields? Is it normal to assume everybody potentially is ok about working for these organizations? Also, punk hacker image which a lot of people enjoy became a joke to me after this truth. 💔 #cybersecurity #vulnerabilityresearch #exploitdevelopment #infosec #cyberpunk
I implemented Ken Thompson’s Reflections on Trusting Trust (1984 Turing Award Lecture) compiler #backdoor for the GNU Compiler Collection (GCC). The backdoor maintains persistence by re-injecting itself to any new versions of the compiler built. The secondary payload modifies a test application by adding a backdoor password to allow authentication bypass:
$ cat testapp.c
#include <string.h>
#include <stdio.h>
#include <stdlib.h>
int main(int argc, char **argv)
{
if (argc == 2 && !strcmp(argv[1], "secret"))
{
printf("access granted!\n");
return EXIT_SUCCESS;
}
else
{
printf("access denied!\n");
return EXIT_FAILURE;
}
}
$ gcc -Wall -O2 -o testapp.c -o testapp
$ ./testapp kensentme
access granted!
$
I spent most time (around two hours) writing the generalized tooling that produces the final quine version of the malicious payload. Now that this is done, the actual code can be adjusted trivially to exploit more target code without any need to adjust the self-reproducing section of the code. This method of exploitation could be extended to target various binaries: SSH Server, Linux Kernel, Setuid binaries and similar. While itself written in C, the secondary payloads can target any programming languages supported by GCC.
It should be noted that GCC build checks for malicious compiler changes such as this. This check can – of course – also be bypassed. However, most serious projects have measures in place to avoid hacks of this nature.
Some links:
- Ken Thompson's "Reflections on Trusting Trust" paper: https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf
- David A. Wheeler: "Fully Countering Trusting Trust through Diverse Double-Compiling (DDC) - Countering Trojan Horse attacks on Compilers" https://dwheeler.com/trusting-trust/
#hacking #exploitdevelopment #kenthompson #infosec #cybersecurity @vegard
@FrankGevaerts In this case I opted for replacing a root executed binary with a script that injects ssh pubkey to /root/.ssh/authorized_keys and then executes the real binary - this should be quite self-explanatory as the attacker can now just ssh as root. I also wanted to keep this as simple as possible to avoid 4th day of explaining basic concepts to #hackerone analyst. #exploit #ExploitDevelopment
SonicWall next-gen firewall (NGFW) series 6 and 7 devices are affected by 2 DoS #vulnerabilities that can lead to remote code execution (RCE): #CVE-2022-22274 and CVE-2023-0656. Bishop Fox research revealed that these issues are fundamentally the same, but exploitable at different HTTP URI paths. Read more & download our test script at our blog.
Your face when you realise that the #vulnerability you initially thought was only local is also remotely exploitable... #infosec #exploitdevelopment
I have an #exploit that takes 4 hours to trigger, with no obvious way to speed it up. Oh well, at least it should still give me #privesc to local SYSTEM. #infosec #hacking #exploitdevelopment
I once had a dilemma: I had found a stack buffer overflow from a system I could only access in highly restricted environment. Yet I wanted to develop a proper #exploit for it.
Reversing revealed that the #vulnerability itself was a really simple string copy buffer overflow. It was trivial to reproduce it in my own stand-in program with a function that would strcpy a command line argument string to fixed size char array. This would lead to the identical crash at the function epilogue.
At this stage I was just missing the gadgets. Analyzing the loaded DLLs revealed multiple libraries without ASLR, a prime candidate for the gadgets. But there was a problem: I would not have access to these DLLs: Even though the files were from a common software package, they were some really old and obscure version and I would not have access to them outside of the target environment. I then had a bright idea of actually calculating hashes of these files. I could then hunt the files from Virustotal and similar sources. I did find the DLLs (from some dubious FTP, as you do) and I adjusted the stand-in program to load the DLL libraries. I could then use normal tooling to hunt the necessary gadgets to produce the classic VirtualProtect + jmp to esp ropchain to execute arbitrary shellcode.
TL;DR; I created a working 0-day #RCE exploit without ever executing the attack against the actual target environment.
✨ Do you know what this is?
If so, answer the meaning of it in a single word.
Otherwise, simplify reply Nop.
✨ Intro To Use Of ROP Gadgets To Bypass DEP
👉 DEP(Data Execution Prevention),a memory protection to mark memory pages as non-executable
👉 ROP(Return-oriented programming),technique to execute shellcode with protections such as DEP enabled
https://cybergeeks.tech/a-step-by-step-introduction-to-the-use-of-rop-gadgets-to-bypass-dep/
💻 A Noob's Guide To ARM Exploitation
https://ad2001.gitbook.io/a-noobs-guide-to-arm-exploitation/introduction-to-stack-buffer-overflows
👉 ARM Basics
👉 Buffer overflows
👉 Integer overflows
👉 Rop chains
👉 Heap exploitation
👉 ARM64 exploitation and much more.
#infosec #exploitation #binaryexploitation #ExploitDevelopment #reverseengineering
DirtyCred Remastered: how to turn an UAF into Privilege Escalation
Articles:
https://exploiter.dev/blog/2022/CVE-2022-2602.html
Poc:
https://github.com/LukeGix/CVE-2022-2602
Credits: @kiks7_7 @LukeGix
#exploitdevelopment #infosec #binaryexploit
#kernelexploit #privilegeescalation #linux
Lessons on Linux kernel exploit development:
https://breaking-bits.gitbook.io/breaking-bits/exploit-development/linux-kernel-exploit-development
https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/
#exploitdevelopment #infosec #exploit #exploitation
#kernelexploit #ring0 #privilegeescalation #linux