CVE-2026-40369: Twelve Bytes to Escape the Browser Sandbox
The post CVE-2026-40369: Twelve Bytes to Escape the Browser Sandbox appeared first on VoidSec .
VoidSec
Some things in life are unpredictable, your Cyber Security doesn’t have to be one of them
Latest posts
AI Vulnerability Research and the Fuzzer Era Déjà Vu: Why the Numbers Are Only Half the Story
The post AI Vulnerability Research and the Fuzzer Era Déjà Vu: Why the Numbers Are Only Half the Story appeared first on VoidSec .
Home-made LLM Recipe
It’s been a long time since I posted on my blog, and while many of you will expect something related to Windows vulnerability research or exploit development. I have to manage expectations, as this one will be on LLMs. Not because everyone is jumping on the AI bandwagon and I felt the urge to do […] The post Home-made LLM Recipe appeared first on VoidSec .
OffSec EXP-401 Advanced Windows Exploitation (AWE) – Course Review
In November of last year, I took the OffSec EXP-401 Advanced Windows Exploitation class (AWE) at Black Hat MEA. While most of the blog posts out of there focus on providing an OSEE exam review, this blog post aims to be a day-by-day review of the AWE course content. OffSec Exp-401 (AWE) During the first […] The post OffSec EXP-401 Advanced Windows Exploitation (AWE) – Course Review appeared first…
Reverse Engineering Terminator aka Zemana AntiMalware/AntiLogger Driver
Recently, a threat actor (TA) known as SpyBot posted a tool, on a Russian hacking forum, that can terminate any antivirus/Endpoint Detection & Response (EDR/XDR) software. IMHO, all the hype behind this announcement was utterly unjustified as it is just another instance of the well-known Bring Your Own Vulnerable Driver (BYOVD) attack technique: where a […] The post Reverse Engineering Terminator…
SANS SEC760: Advanced Exploit Development for Penetration Testers – Review
In July 2022, I took the SANS SEC 760 class in Berlin. I always promised myself and some close friends to write a review, but I didn’t have the time until the Christmas break. This blog post aims to be a day-by-day review of the SANS SEC760 course content and its CTF, NetWars tournament and […] The post SANS SEC760: Advanced Exploit Development for Penetration Testers – Review appeared first on…
Naughty List Challenge Write-Up – X-MAS CTF
As the last post of the year, I decided to do something chill and a bit “off-topic” from my usual content. As the festivities are approaching, I have a bit more free time to dedicate to different stuff, like helping some friends with CTFs and such. I’ve decided to post about this specific challenge because […] The post Naughty List Challenge Write-Up – X-MAS CTF appeared first on VoidSec .
Windows Exploitation Challenge – Blue Frost Security 2022 (Ekoparty)
Last month, during Ekoparty, Blue Frost Security published a Windows challenge. Since having a Windows exploitation challenge, is one of a kind in CTFs, and since I’ve found the challenge interesting and very clever, I’ve decided to post about my reverse engineering and exploitation methodology. Challenge Requests Only Python solutions without external libraries will be […] The post Windows…
Browser Exploitation: Firefox Integer Overflow – CVE-2011-2371
In case you’re wondering why I’m not posting as regularly as before, with the new year, I’ve finally transitioned into a fully offensive vulnerability research and exploit development role at Exodus Intelligence that fulfilled my career dream (BTW, we’re currently hiring). In the last couple of months, I’ve worked on some exciting and challenging bugs. […] The post Browser Exploitation: Firefox…
Windows Drivers Reverse Engineering Methodology
With this blog post I’d like to sum up my year-long Windows Drivers research; share and detail my own methodology for reverse engineering (WDM) Windows drivers, finding some possible vulnerable code paths as well as understanding their exploitability. I’ve tried to make it as “noob-friendly” as possible, documenting all the steps I usually perform during […] The post Windows Drivers Reverse…