Susan Ghosh
@SubZero0x9
Followers
614
Following
784
Media
8
Statuses
206
Security Analyst and Researcher. Trying very hard to figure out C, Assembly and Windows Internals. Eternal N00b.🐶
Instruction Pointer
Joined March 2018
RT @TrainSec: 🎁 We’re giving away 1 FREE seat to our premium live workshop: “EDR Internals – Research & Development”!. 🔥 40+ hours of hands….
0
48
0
RT @elma_ios: I was messing around with symbol resolution in ELF and came up with an obfuscation technique on abusing symbol resolution in….
blog.elmo.sg
This research shows how we can trick disassemblers and debuggers into identifying the wrong import names by messing up metadata used in the lazy binding process
0
41
0
RT @orange_8361: This will be one of the few OSEE trainings held in Asia. Welcome to Taiwan :).
blog.orange.tw
✅：『課程結束後一年內要考到 OSEE 證照喔』🍊：「安啦，有一整年能準備哪不行」 （⏳⋯⋯） ✅：『公司下個月開始宣傳課程，到時候要有心得文唷』🍊：「好（默默打開 OffSec 網站排了死線前一天考試）」 （⏳⋯⋯） 🍊：「下禮拜就要考試了，怎麼會這樣 ヽ(ﾟДﾟ≡ﾟДﾟ)ﾉ 」✅：『你到底在幹嘛？？？』 這篇文算是自己準備 OSEE 考試的一點小心得，關於課程內容大家可以參考上一
0
32
0
RT @__mez0__: Under-the-hood, Ember uses LightGBM to score a sample from 0 to 1. I added this functionality into Citadel so any binaries ad….
mez0.cc
Citadel 2.0: Predicting Maliciousness
0
14
0
RT @ShitSecure: Including nice tool release 🔥.
github.com
tool for requesting Entra ID's P2P certificate and authenticating to a remote Entra joinned devices with it - temp43487580/EntraPassTheCert
0
73
0
RT @trickster012: This is my research project in creating read, write and allocate primitives that can be turned into an injection in order….
trickster0.github.io
It has been a while, this is my research on trying to change the IOCs of a common remote process injection flow and the end result. I presented this in RedTreat in 2024 and I thought it was about...
0
95
0
RT @TKYNSEC: Windows 11 24H2 broke a popular malware evasion technique! The Lloyd Labs self-deletion method now fails because of NTFS chang….
0
107
0
RT @JonnyJohnson_: Have you ever wondered if there was a way to deploy a "Remote EDR"? Today I'm excited to share research I've been workin….
0
126
0
RT @AndrewOliveau: RemoteMonologue - A Windows credential harvesting attack that leverages the Interactive User RunAs key and coerces NTLM….
ibm.com
The IBM X-Force Red team covers the fundamentals of COM and DCOM, dives into the RunAs setting and why authentication coercions are impactful and introduces a new credential harvesting tool -...
0
178
0
RT @eversinc33: (1/x) For some reason people keep asking me how to get into reverse engineering. The obvious answer would be do CTFs or rev….
0
22
0
RT @hasherezade: A small demo/tutorial on unpacking executables with #PEsieve and #TinyTracer: - automatic OEP find….
hshrzd.wordpress.com
Covers: automatic OEP finding, reconstructing IAT, avoiding antidebugs and fixing imports broken by shims In this short blog I would like to demonstrate you how to unpack an executable with PE-siev…
0
124
0
RT @ale_sp_brazil: The fifth article (57 pages) of the Exploiting Reversing Series (ERS) is available on:. I would….
0
102
0
RT @TrustedSec: In our new blog, Research Practice Lead @freefirex2 walks us through how to modify the system routing table when connecting….
trustedsec.com
0
46
0
RT @Six2dez1: reconftw v3 is out! Major updates: @faradaysec Faraday & @arcanuminfosec msftrecon, pipx & venv installer, ton of macOS/*nix….
github.com
What's Changed Faraday integration for WebUI and reporting Update install.sh - Mantra Install Fix by @tux3d0 in #918 Add --check-tools option and GitHub workflow by @pgrenaud in #920 Fix macos...
0
29
0
RT @taviso: You can now jailbreak your AMD CPU! 🔥We've just released a full microcode toolchain, with source code and tutorials. https://t….
bughunters.google.com
This blog post covers the full details of EntrySign, the AMD Zen microcode signature validation vulnerability recently discovered by the Google Security team.
0
522
0
RT @T3nb3w: 🚀 New Blog & PoC: Abusing IDispatch for COM Object Access & PPL Injection. Leveraging STDFONT via IDispatch to inject into PPL….
github.com
A C++ proof of concept demonstrating the exploitation of Windows Protected Process Light (PPL) by leveraging COM-to-.NET redirection and reflection techniques for code injection. This PoC showcases...
0
166
0
🚨 Hiring Alert 🚨.There is an open position for "Security Researcher - Windows Red Teaming" role in my team. Location: Delhi. Work Format: 5 days a week, WFO.Experience: 0-5 years. Refer the Image for the role overview and Skillset requirements. If you are eligible DM me.
1
2
2
RT @Print3M_: 🚨 Hacking announcement 🚨 . Today I’m releasing SecTube 📺. Free collection of 500+ categorized videos from 20 IT security even….
sectube.tv
The ultimate collection of IT security event recordings from around the world.
0
53
0