Browse All

This post explores how BPF (Berkeley Packet Filter, a technology that allows running custom programs inside the Linux kernel) can be used offensively, specifically focusing on the bpf_probe_write_user function (a helper that lets BPF programs modify user-space data during execution). The author documents their process of learning to write advanced BPF programs in C using libbpf to manipulate filenames, hide directories, and simulate ransomware attacks while also considering detection methods.

This post describes how to use bpftrace (a tool for tracing system behavior) with uprobes (hooks into user-space functions) to intercept and read Firefox's encrypted traffic by hooking into the NSS library (Mozilla's Network Security Services, which Firefox uses for encryption). The author discovered that Firefox uses local NSS libraries rather than system-wide encryption libraries, and created a bpftrace script that hooks the PR_Write function to capture and display the data Firefox sends.

Tabnabbing is a web application security vulnerability that attackers can use to perform phishing attacks (tricking users into giving up sensitive information by impersonating legitimate websites). The video explains how tabnabbing works and how to defend against it, and notes that the vulnerability is relatively straightforward to prevent.

This post explores bpfcc-tools, a collection of existing BPF (Berkeley Packet Filter, a technology that runs custom programs inside the Linux kernel) programs used for system performance monitoring and observability. The author explains that BPF tools are becoming increasingly common in production environments because they're useful for analyzing system behavior without requiring custom code.

This post discusses detection strategies for identifying malicious use of BPF (Berkeley Packet Filter, a technology that allows programs to run safely inside the Linux kernel), specifically focusing on bpftrace (a tool for tracing system events using BPF). The author is exploring how attackers might misuse BPF and what defensive approaches Blue Teams (security defenders) could use to catch such misuse.

This post describes how to use bpftrace (a tool for tracing Linux kernel events) to create a backdoor that executes commands when it receives a specific secret message on any port. The author explains how to use enter and exit trace points (hooks into when functions start and finish) to capture data from network reads, then compare that data against a trigger message to run malicious commands.

This post explores how bpftrace, a tool for running BPF programs (eBPF, extended Berkeley Packet Filter, which lets programs monitor and modify system behavior at a low kernel level), could potentially be misused to create backdoors by observing network traffic and triggering malicious actions. The author is studying this offensive technique to better understand security threats and help defenders recognize such attacks.

eBPF (extended Berkeley Packet Filtering, a technology that lets users run small programs inside the Linux kernel without modifying kernel source code) is gaining attention for offensive security uses because it can hook into system calls, manipulate data, and even run on network hardware. The article introduces eBPF's structure (programs, maps, and events) and explains how attackers could potentially exploit its flexibility and power to hook into system functions, modify data, and spawn processes.

This is a 25-minute educational video covering the foundational concepts needed to understand web application security. It explains the basic building blocks of web applications, such as HTML, HTTP, JavaScript, and cookies, as well as core security concepts like the Same-Origin Policy (a rule that prevents websites from accessing each other's data without permission). The video prepares viewers to understand common security vulnerabilities like XSS (cross-site scripting, where attackers inject malicious code into web pages), CSRF (cross-site request forgery, where attackers trick users into performing unwanted actions), and SQLi (SQL injection, where attackers insert malicious database commands into input fields).

On Linux systems, users with uid=0 (user identifier zero) have root privileges, which bypass all security checks. An attacker can create a new account or modify an existing one to have uid=0 by editing the /etc/passwd file or using commands like 'usermod -u 0', giving them complete system control.