JF / 2026 Available
JF / 2026 Machine walkthroughs, malware analysis, and technique deep-dives — always with a defender's eye on detection.
Wildcard injection is a class of privilege escalation that abuses the way shells expand glob patterns before executing a command. When a root-owned script uses * in a shell command, the filenames in the current directory become arguments to that command — including filenames crafted to look like options. This article covers three variants: tar checkpoint actions, 7z listfile injection, and the symlink-plus-listfile combination that bypasses both -- and -snl.
Two local privilege escalation vulnerabilities that were patched in early 2023 but remain present in unpatched systems: CVE-2023-23946, a symlink path traversal in git apply, and CVE-2023-20052, an XML External Entity in ClamAV's DMG parser. This article explains the mechanics of each, why they work in restrictive environments, and how the exploits are constructed.
Three techniques for intercepting credentials in environments that assume their infrastructure is trustworthy: abusing BIND's dynamic update capability to redirect a mail subdomain, capturing password reset tokens through SMTP interception, and harvesting SSH credentials via chat bot provisioning features pointed at fake SSH servers. Each technique exploits a gap between what the infrastructure is supposed to do and what it can be made to do.
A technical deep dive into two attack surfaces that chain together: how Git history preserves credentials that were supposedly deleted, and how a misconfigured HashiCorp Vault SSH OTP engine turns a low-privileged token into root access.
How Kerberos constrained delegation works, why protocol transition (TRUSTED_TO_AUTH_FOR_DELEGATION) makes it exploitable, how SeEnableDelegationPrivilege can be hidden in a Group Policy file, and how a single GenericAll permission over a computer account becomes a full Active Directory compromise via S4U2Self and S4U2Proxy.
How automation code stored on an anonymous SMB share, encrypted with a weak Ansible Vault password, and a PWM instance left in configuration mode, combine with an ESC1 certificate template to enable full Active Directory compromise.
How schema version 1 certificate templates enable arbitrary EKU injection (ESC15 / CVE-2024-49019), and how the Reanimate-Tombstones permission can be abused to recover a deleted certificate admin account and chain both techniques into a full Active Directory compromise.
How to escalate from any domain credential to Domain Admin by coercing the DC to authenticate, relaying that authentication to Active Directory Certificate Services, and extracting a certificate for the machine account. A deep dive into the AD CS misconfiguration that requires no template abuse — and the Kerberos relay technique that bypasses a domain-wide NTLM block.
How to build and detect a covert channel over ICMP. The protocol most networks allow by default, why it works, and the specific telemetry that catches it — including a defense that costs nothing to deploy.
A Go binary on a Windows service embeds an encrypted credential and the key that decrypts it. Both are recoverable without executing the binary, using only strings, objdump, xxd and a Python one-liner. This article walks the full static extraction: how to find the symbols, how to translate virtual addresses to file offsets, why the disk and memory representations coexist, and why a cipher and a key of identical length almost always mean XOR.
A practical workflow for running untrusted binaries in a controlled environment: how CAPE extracts behavior and IOCs, why anti-VM evasion breaks most sandboxes, and the configuration changes that make a VM look like a real machine.
Windows exposes a process mitigation policy that blocks any DLL not signed by Microsoft from loading into a newly created process. It sounds like a defense, and in many contexts it is one. This article explains how the policy is enforced at the loader level, how it is applied during process creation through the attribute list mechanism, why local processes require a self-re-execution pattern, and where the approach hits a ceiling that kernel-level telemetry does not care about.
Direct syscalls bypass ntdll hooks but leave a detectable artifact: the syscall instruction executes from memory that does not belong to ntdll.dll. This article explains the ProcessInstrumentationCallback detection mechanism, how indirect syscalls defeat it by jumping to ntdll's own syscall gadgets, and why the choice of gadget matters.
Reading ntdll.dll from disk to overwrite the EDR's userland hooks — the step-by-step technique, the two offset representations (1024 vs 4096), and the modern context: why unhooking alone is dead and what replaced it.
Combining PPID Spoofing, Memory Mapping, and Early Bird APC injection to hide process lineage, dodge WriteProcessMemory detections, and execute before a process's own entry point — plus why ETW-Ti still catches it.
How runtime SSN resolution works, why indirect syscalls still leave a trail, and how Module Stomping hides a payload inside a legitimate DLL to defeat static memory classification — plus the four ways modern EDRs still find it.
How endpoint security products hook ntdll in userland to see every kernel call, and the three main techniques offensive tooling uses to bypass that visibility — with the exact artifacts each one leaves behind.
The two-VM design that makes Whonix different from every other anonymity tool, why stream isolation matters more than encryption, and a practical workflow for downloading files from the dark web without becoming the next victim.
A Docker-based hacking environment that replaces the monolithic Kali VM with per-engagement containers. How the wrapper works, why isolation matters more than tools, and the security trade-offs that the container model introduces.
Rolling your own VPN instead of trusting a provider: SSH hardening, OpenVPN setup, certificate management, and the honest trade-offs — maintenance, attribution, and what a self-hosted tunnel does and does not protect against.
A single USB drive that boots a dozen operating systems, each with its own persistent storage. How Ventoy's architecture works, how the persistence plugin binds data to ISOs, and why the project's security posture has drawn comparison to the xz-utils backdoor.
Microsoft removed it in 2020. The community kept it alive. A technical analysis of the architecture behind booting a full Windows installation from a USB drive, why feature upgrades break it, and the forensic traces it leaves on every host it touches.
Running Windows apps on Linux without Wine, without dual-booting, and without noticing the VM underneath. A technical analysis of how WinBoat works, the critical RCE that exposed its local API, and why seamless cross-system integration is a security trade most users never see.
Open-source face-swapping used to be a research toy. It is now a pipeline that runs on a consumer GPU, produces broadcast-quality results, and defeats the liveness checks that KYC and video verification rely on.
Modern voice cloning needs seconds of audio and a few dollars of compute. What that means for the phone-based verification that every bank, help desk, and government office still relies on — and why the defense is not better voice authentication.
A phishing technique that runs a real Firefox inside a Docker container, redirects the victim through a hosts file modification, and steals the authenticated session — no cloned login page, no certificate warning, no URL to spot.
The FBI used a Microsoft Global Device Identifier (GDID) to track a member of Scattered Spider across countries, despite his use of a VPN. A technical deep-dive into the persistent Windows identifier that makes anonymity on Windows a myth — including how to see your own.
The Grayhat Warfare problem: a walkthrough of how misconfigured S3 buckets are discovered, indexed, and exploited, why the default configuration makes this easy, and what actually fixes it.
A practical guide to FOFA, Shodan, Censys and ZoomEye for attack surface discovery. Query syntax, real workflows, the differences between engines, and how defenders can reduce their exposure.
The EXIF data is gone. It doesn't matter. A complete workflow for going from a photo to a name, a city, or a map pin using open-source tools, reverse image search, and disciplined pivoting.