Browse All

This post explores bpfcc-tools, a collection of existing BPF (Berkeley Packet Filter, a technology that runs custom programs inside the Linux kernel) programs used for system performance monitoring and observability. The author explains that BPF tools are becoming increasingly common in production environments because they're useful for analyzing system behavior without requiring custom code.

This post discusses detection strategies for identifying malicious use of BPF (Berkeley Packet Filter, a technology that allows programs to run safely inside the Linux kernel), specifically focusing on bpftrace (a tool for tracing system events using BPF). The author is exploring how attackers might misuse BPF and what defensive approaches Blue Teams (security defenders) could use to catch such misuse.

This post describes how to use bpftrace (a tool for tracing Linux kernel events) to create a backdoor that executes commands when it receives a specific secret message on any port. The author explains how to use enter and exit trace points (hooks into when functions start and finish) to capture data from network reads, then compare that data against a trigger message to run malicious commands.

This post explores how bpftrace, a tool for running BPF programs (eBPF, extended Berkeley Packet Filter, which lets programs monitor and modify system behavior at a low kernel level), could potentially be misused to create backdoors by observing network traffic and triggering malicious actions. The author is studying this offensive technique to better understand security threats and help defenders recognize such attacks.

eBPF (extended Berkeley Packet Filtering, a technology that lets users run small programs inside the Linux kernel without modifying kernel source code) is gaining attention for offensive security uses because it can hook into system calls, manipulate data, and even run on network hardware. The article introduces eBPF's structure (programs, maps, and events) and explains how attackers could potentially exploit its flexibility and power to hook into system functions, modify data, and spawn processes.

This is a 25-minute educational video covering the foundational concepts needed to understand web application security. It explains the basic building blocks of web applications, such as HTML, HTTP, JavaScript, and cookies, as well as core security concepts like the Same-Origin Policy (a rule that prevents websites from accessing each other's data without permission). The video prepares viewers to understand common security vulnerabilities like XSS (cross-site scripting, where attackers inject malicious code into web pages), CSRF (cross-site request forgery, where attackers trick users into performing unwanted actions), and SQLi (SQL injection, where attackers insert malicious database commands into input fields).

On Linux systems, users with uid=0 (user identifier zero) have root privileges, which bypass all security checks. An attacker can create a new account or modify an existing one to have uid=0 by editing the /etc/passwd file or using commands like 'usermod -u 0', giving them complete system control.