Archives: Session

TESTING PAGE: ALPChecker – Detecting Spoofing and Blinding Attacks

In recent years, there has been a significant increase in the number of attacks on the Windows operating system carried out using kernel drivers. To date, there is a trend for attacks targeting AV\EDR systems. One of the vectors of such attacks targets the Asynchronous Local Procedure Call (ALPC) technology. Windows client-server interaction ALPC mechanism […]

What’s Old Is New Again: Leveraging Request Smuggling For Authentication Bypass and Remote Code Execution

Offensive cybersecurity practitioners are familiar with the abbreviations XSS, CSRF, and SQLi, but how many people really recognize HRS (HTTP Request Smuggling)? Even though the original HRS paper came out nearly 20 years ago, we think request smuggling remains underappreciated in today’s security world. In this presentation, we discuss three HTTP request smuggling vulnerabilities we […]