Posts on red-team
53 posts on red-team. Notes from public sources and my own test lab.
Driver as a Weapon: How BYOVD Reaches Into the Kernel
BYOVD isn't new — but it's still punching holes through EDRs. Here's what attackers do, and what defenders actually need to fix.
Saatli Bombayı Duymak: Zero-Day Gerçeği ve Savunmanın Görünmez Cephesi
Yazılım dünyasının en büyük kabusu: Sıfırıncı gün. Peki, daha kimsenin bilmediği bir açığa karşı nasıl savunma yapılır? Gelin, bilinmeyenin peşine düşelim.
Seeing Behind the Mask: A Late-Night Shift in the Analysis Lab
Signature-based detection is no longer enough. Let's dive into the 'kitchen' of malware analysis to see how we unmask modern, fileless threats using static and dynamic techniques.
Don't Underestimate __proto__: You Might Lose the Whole Kingdom
How a 'sneaky' JSON key turned a 3 AM incident response into a deep dive into Prototype Pollution and its path to Remote Code Execution.
Jumping to Address 0x41414141: What Do You Do When the Patch Isn't Out Yet?
Seeing 0x41414141 in the EIP register means you're already past the 'get well soon' phase. Let's dive into the anatomy of zero-days and how to survive the gap before a patch is released.
Drowning in the Sandbox: Seeing the Unseen in Malware Analysis
Modern malware doesn't just dodge signatures anymore—it hides from the analysis environment itself. Let’s dive into how these "smart" samples detect your VM and what we can do to stay ahead.
Beyond IDOR: Logic Flaws and Invisible Doors in the API World
A deep dive into BOLA (Broken Object Level Authorization) and why modern security is no longer just about firewalls, but about the logic within our endpoints.
Drowning in the Sandbox: The 'Automated Analysis' Myth vs. Reality in Malware Analysis
If you're blindly trusting VirusTotal or automated sandboxes for critical systems, you're not just being lazy—you're potentially tipping off the attackers. Let's dive into why we need to get our hands dirty with manual analysis and proper OPSEC.
The Ticking Bomb You Can’t Hear: A Survival Guide for Zero-Day Chaos
In the world of cybersecurity, some threats are invisible until they strike. Let's talk about the 'dark matter' of our industry: Zero-Day vulnerabilities, and how to survive when the clock hits zero.
What Really Happens When You Open That File? A Peek Into the Malware Analysis Kitchen
A deep dive into the world of malware analysis, from static inspection to dynamic behavioral tracking, shared through the lens of real-world experience and a few 'oops' moments.
Not a Time Bomb, but a Ghostly Shadow: The Reality of Zero-Days and the Night We Wait for the Patch
A deep dive into the reality of Zero-Day vulnerabilities from a Red Teamer's perspective—why waiting for a patch is no longer a luxury and how we handle those hidden tunnels in our systems.
The Labyrinth Inside the Code: Pulling an All-Nighter for Binary Analysis
It's 3 AM, your screen is glowing blue, and a suspicious notepad.exe is trying to exfiltrate data. Let's dive into the anatomy of a fileless malware attack and see how we can harden our defenses.