Welcome to the RITSEC blog!

Shocker Write Up Shocker is a HackTheBox challenge which revolves around the ShellShock vulnerability. This box was an easy box on HackTheBox, but I chose it because I was working on implementing the same vulnerability in a web-server project. Background Shellshock, also known as the Bash Bug, was a significant security vulnerability that was discovered in 2014. The vulnerability affected the Bash shell, a widely used command-line interface for Unix and Unix-like operating systems, including Linux....

This article discusses the impact DMCA has on cybersecurity researchers

A Look at AFL++ Under The Hood How this post is structured The objective of this post is to allow anyone to gain an understanding of AFL at the level they want. I want to cover AFL at both a usage level and an internals level. At the end of this article, there are In-Depth sections that cover AFL in even more depth. One additional note. In the code snippets, I often use ....

Settings The Stage In 1997 Richard Stallman, free software advocate, wrote The Right to Read, a short story in which he describes the year 2047. It is a dystopian society, where the Software Protection Authority (SPA) in conjunction with Central Licensing controls all knowledge in the world. “Each book had a copyright monitor that reported when and where it was read, and by whom” (Stallman). Violations of the copyright policy led to serious jail time and heavy fines....

I was watching someone play Cookie Clicker and when they reloaded the tab, they still had all their save data. I’d never played Cookie Clicker before so I assumed it must be using cookies to retain that data, but when I loaded a Cookie Clicker tab on my browser, Firefox reported no cookies beyond the consent to store advertising cookies (Thanks for blocking trackers, Firefox). [image lost] So, what does Cookie Clicker use to store data?...

Update The real company itsme contacted me on twitter and they verified that they didn’t create an android app for their product. So they reported the misleading application to the google play store and got it removed successfully. Summary People were receiving text messages saying that their friends invited them to chat. The messages makes them install an application. Opening the app, it shows a quick walkthrough of the app and asks for a verification code....

In my little journey of learning about macOS/Apple security, I will be documenting things I have learned via blogpost. This might not be useful to most researches since they probably know more about this topic but this should be a good resource for other beginners in this field. For the first post, I will document my step in reversing a simple yet interesting malware, TinyShell. It’s important to not, I used Mitten Mac’s post as a reference....

Introduction For my project, I chose the ambitious goal of adding a backdoor to Linux’s iptables firewall. In order to do this, I had to delve deep into the Linux kernel and study the inner workings of the networking stack. Through my efforts, I was able to make iptables accept specially-crafted packets, even if the user-defined rules say otherwise. The Evil Bit In April 2003, the Internet Engineering Task Force published RFC3514, which defines a previously-unused bit of the IPv4 fragment offset field as the “evil bit” or security flag....

This article examines the results collected through analyzing publicly available malware samples, historical threats, and previous publications

WELCOME TO THE RITSEC BLOG!