Posts on cybersecurity
43 posts on cybersecurity. Notes from public sources and my own test lab.
The Trojan in Your Pocket: Dismantling Mobile App Security from Within
A look into the world of mobile security through the eyes of a Red Teamer, covering common mistakes like hardcoded secrets and the power of dynamic analysis with Frida.
Opening the Black Box: Anatomy of Malware and Those Critical Decisions in the Analysis Lab
It's 3:15 AM, a high-severity alert pops up, and you're staring at a file named invoice_9928.pdf.exe. Join me as I walk through a digital autopsy of a 'Fully Undetectable' threat in a controlled sandbox environment.
Leaving the API Doors Unlocked: Did You Really Think a JWT Was Enough?
Have you ever felt that cold sweat down your neck when you realize your API is serving your entire database to the internet? Let's talk about the most common 'invisible' vulnerability: BOLA.
Zero-Day: The Art of Living with an Unpatchable Nightmare
Facing a vulnerability with no signature, no patch, and no known pattern is a wake-up call for any security pro. Here is a look into the reality of zero-days from the perspective of the Red Team kitchen.
When the Foundations Crumble: Software Supply Chain and 'Dependency Hell'
Think you're safe behind your firewall? Think again. The real threat might be that 'npm install' you just ran. Let's dive into the messy world of Software Supply Chain attacks and how they turn your trust against you.
Ghost in the Terminal: Unconventional Penetration Testing Scenarios and Real-World Defense
A deep dive into the Red Teamer mindset: why your security is only as strong as your forgotten legacy server, moving beyond automated tools to explore RCE via misconfigurations, and the art of lateral movement.
JSON’s Backdoor: The Forgotten 'Logic' and Invisible Threats in API Security
Modern security isn't just about blocking scripts; it's about understanding the logic of your APIs. Let's dive into why WAFs aren't enough when your business logic is broken.
An Invisible Bullet: Zero-Days and That Fatal Gap in Memory
Zero-Days aren't just Hollywood magic; they are the result of unnoticed logic flaws or memory management slips. Let's dive into the 'Window of Exposure' and how these vulnerabilities actually work under the hood.
The Only Bug Even the Most Expensive Firewall Can’t Patch: The Human Factor
Ever seen a massive security budget get wiped out by a single 'free coffee' link? Let's dive into why the 'human interface' remains our most critical vulnerability and how we, as Red Teamers, look at psychological triggers.
A Night in the Lab: Why That File Isn’t Behaving Like You’d Expect
Signature-based detection is a thing of the past. Join me in the lab as we dissect how modern malware hides in memory and how we can unmask these 'ghost' scripts using both static and dynamic analysis.
You Can't Patch the Human Factor: The Dirty Lab of Social Engineering
Why most phishing simulations are a waste of time and how real-world social engineering actually works—from the art of OSINT to the psychology of pretexting.
Smart Devices or Trojan Horses in Your Home? IoT Security Needs More Than Just Shodan Tourism
Scanning for open IPs on Shodan isn't real IoT security. Join Payten's Red Team Lead, Sedat Özdemir, as he dives into firmware analysis, hardcoded backdoors, and why your smart toaster might be a bigger risk than you think.