///
Depth Security in the reports for 2026 continue to find hosts vulnerable to CVE-2025-33073 (CVSS 8.8), including domain controllers and Tier-0 servers. "Whether its enterprise domain controllers, tier-zero servers, or random workstations, we are find hosts still affected by this issue on...
April 2026. McGraw Hill confirms the leak of 13.5 million records - names, emails, phones, physical addresses. Three days earlier, ShinyHunters announced the hacking of Amtrak – 2.1 million records with addresses and tickets. According to Have I Been Pwned, both incidents were recorded in the...
7.1. Detect on anomalies in the execution stream
Modern EDRs use hardware breakpoints and Execution Tracing. Theycan track where the syscalll call comes from.
Problem:When you call syscal from your code, the RIP (Instruction Pointer)registry points to the memory area that:
It does not belong...
What is a web pentest and why it is needed
Web applicationpenetration testing is a controlled imitation of an attack on awebsite or web service to find vulnerabilities before someone doeswith other intentions. According to Verizon DBIR, attacks on webapplications are consistently among the...
4. The executioner's toolkit (practical section). Continuation.
4.4. SysWhispers3: Behind the Scenes of Automation
Let’s understandwhat SysWhispers3 actually generates in order not to be just a user’scode.
After launching the script with the parameter--preset common, we get two key files...
Today, the conversation will not go about another “Malvari-invisible”from the Githab, which detects 5 minutes after pouring on VT. It'sabout the foundation. Direct system calls (direct syscals). Atechnique that, from the category of “magic for the chosen”category, goes into the category of...
Protection - how not to become a victim
Protection is not a“do it” list. This is an understanding of principles.
Always use WSS (TLS). None ws://in the production. The right ciphers are comfortable, disable old protocols.
A hard Origin test. On the server. Compare the...
NFCGate: radio magic that breaks the boundaries of NFC
When it comes tocontactless systems – be it subway, passes, payment cards or accesscontrol systems – most users and developers perceive them asreliable and secure mechanisms. After all, the technology promises aquick and convenient way to...
Spider Tools - What to Use in Intelligence and Attack
Let's get it alltogether. What does the WS testing process look like fromscratch?
1. Intelligence (Recon)
Search for endpoints: Parsim JS-files application (app.js, main.chunk.js) for the new WebSocket(ws://, wss://...
I want to disable access for ssh clients using password and allowonly authorization ssh with SSH keys. Howto disable password authentication for SSH in Linux operatingsystems?
First, you need to set up your usual useraccount. Then configure the SSH-keys for the input. Once you’veconfigured SSH...
Vulnerabilities of the application level - where logic lives
Let’s say theconnection is safe. Now the messaging begins. And here we are waitingfor the whole world.
1. Injections to the applicationprotocol
WS is transport. On top of it almost always worksyour protocol: JSON-RPC, GraphQLover...
Configuration Vulnerabilities - Daily Bread
Now, moving on from low-level intricacies, let’s look at what happens in 90% of cases. Configu (disambiguation) What admins and developers configure without thinking about WS.
1. No Verification (WebSocket Origin Hijacking)
The most common...
Today on the table is WebSocket.Not the picture that is drawn on the hackathons, but its throbbinginside out: the configurations that are cut into the living, andquiet, almost invisible exploitation.
WS Underworld: When a LiveChannel Becomes Your Back Door
Whydo we need this?
Everyone...
Introduction
The New Year holidays are over, but there are still plenty of topics for articles. Let's think about how often you reinstall your operating system. You've definitely had to do it at least once a year. So, let's look at creating a multiboot flash drive. Simply put, it's a device...
Introduction:
You've already seen a ton of articles reviewing or explaining this famous distribution. From its inception to the present day, news about Kali Linux has been ubiquitous. The operating system itself, as you may recall, is designed for pentesting, and it's almost unrivaled in this...
According to Palisade Research (palisaderesearch.org/blog/llm-honeypot), their modified Cowrie collected millions of SSH sessions over several months. A few passed the prompt injection test, and at least one was suspected to belong to an autonomous AI agent—the average response time was 1–2...
What's going on in network intelligence and why is it necessary?
Network reconnaissance methods are the first thing a penetration tester (or attacker) does when working with a target infrastructure. In MITRE ATT&CK terminology, several methods are used simultaneously:
Network Service...
By default, the SSH (Secure Socket Shell or just Secure Shell) protocol uses port 22.
More specifically, an SSH client connects on port 22 to the server running an sshd (SSH Daemon); a listener for the SSH protocol to function.
Let's go find these logs!
I am seeing these:
We can use a...
There are two main options for running WeeChat, I highly recommend using a Linux VPS to protect your IP address. Alternatively, may install directly on a Windows host.
TUTORIAL:
Click here and register with Vultr to launch a Linux VPS to protect your IP address.
Optionally check to enable...
Many people complain about Linux, writing commands, keeping in mind or not knowing what to write. Cockpit offers a solution.
A Web interface that can run on CentOS, Suse, Fedora, Clear Linux, Arch, RedHat, Atomic Project and Ubuntu. It allows us to do a lot of work without the need for a...
