Vulnerability research and offensive security engineering notes by @ropbear.
TL;DR VirusTotal has an AI analysis API called Code Insights . I discovered it was very easy to suppress or alter analysis results by forcing the API to return an undocumented schema as well as create false negative and false positive analysis by embedding false pretext in large block comments. This means that attackers could pollute malware analysis pipelines which rely on this API endpoint and…
There have been a large number of blog posts in the past month or two talking about the end of the CTF as we know it. I've been working on this post since April, and have trimmed it down to ensure it is additive and not redundant. Background About a decade ago, I participated in my first Capture the Flag (CTF) competition and was immediately hooked. The rush of solving a challenge, getting the…
The content of this blog will primarily be focused on content relevant to vulnerability research, exploit development, and offensive security engineering. All of the content will be written without LLMs to keep things genuine, although I may use them for spelling and grammar checks (but not rewording). This helps the site remain a no-javascript-required blog. Other topics may include CTFs,…