Resources

This blog post is aimed to help people performing security code reviews on Golang code bases to identify dangerous code patterns.

This post is for vulnerability researchers looking at the ESP32 and would like a quick setup guide.

This blog post aims to highlight how EZ mode pairing implemented by Mirabella Genio and other Tuya Cloud IoT devices broadcast your WiFi credentials to the neighbourhood.

This blog post focuses on AES-GCM and the security impact of using the same IV (nonce) to encrypt data to the users of a web application.

This blog post details a root cause analysis for Project Zero Issue 2046 found by Sergey Glazunov.

This blog post explores how privileged Lua scripts can pop shells without dropping privileges.

A look into how scripting language interpreters can execute arbitrary commands when supplied with malicious environment variables.

This blog post takes a brief look at TLS and certificate pinning, the problem of trust in Certificate Authorities that pinning attempts to address.

This blog post details exploitation of arbitrary deserialization for the Ruby programming language and releases the first public universal gadget chain.

Reviewing the security of the Fuze card device revealed no trust boundary between the card and the connecting device, allowing access to stored credit-card information.

Analysing a vulnerability in all versions of the GoAhead web server < 3.6.5 that allowed for reliable remote code execution via LD_PRELOAD injection.

How to use Kubler to build hardened, minimalistic, Docker Images from scratch for better security.