Alessandro Groppo – Hacktive Security Blog

Exploitation

Exploiting a Quarantine UAF Mitigation on a Custom Allocator Challenge

November 12, 2024November 12, 2024

Introduction In the previous blog post (A Reverse Engineering Walkthrough Journey) we have covered a walkthrough guide to solve the Reverse Engineering challenge written for...

Reverse Engineering

A Reverse Engineering Walkthrough Journey

Alessandro Groppo

November 4, 2024November 5, 2024

Introduction This blog post is about a manually Reverse Engineered challenge we have written for this year NoHat24 security conference. The conference was a blast...

Exploitation

CVE-2022-2602: DirtyCred File Exploitation applied on an io_uring UAF

Alessandro Groppo

December 21, 2022January 13, 2024

Introduction In the past few weeks, I worked with @LukeGix (checkout his blog post on the same vulnerability here) to exploit the CVE-2022-2602, a very...

Exploitation

Linux Kernel Exploit Development: 1day case study

Alessandro Groppo

June 13, 2022January 13, 2024

Introduction I was searching for a vulnerability that permitted me to practise what I've learned in the last period on Linux Kernel Exploitation with a...

Exploitation

KRWX: Kernel Read Write Execute

Alessandro Groppo

March 12, 2022January 13, 2024

Introduction Github project: https://github.com/kiks7/KRWX During the last few months/year I was studying and approaching the Kernel Exploitation subject and during this journey I developed few...

Application Security

ownCloud Multiple Vulnerabilities

Alessandro Groppo

July 27, 2020June 27, 2021

During one of our research activities we discovered several flaws in the ownCloud product.ownCloud is a popular open-source cloud service similar to Google Drive and the last...

Mobile

Android IPC: Part 2 – Binder and Service Manager Perspective

Alessandro Groppo

April 26, 2020June 21, 2021

Introduction As mentioned in the previous article, Android uses the Binder for IPC communications. Good to know, the Binder was not created by Google. Its...

Application Security

Multiple SSRF on Vanilla Moodle Installations

Alessandro Groppo

April 14, 2020June 21, 2021

During the time dedicated to research we found 2 Server-Side Request Forgery on Moodle. The first one is a Blind SSRF already discovered in 2018 and tracked...

Mobile

Android IPC: Part 1 – Introduction

Alessandro Groppo

April 5, 2020June 21, 2021

Introduction In the last few months I was studying Android Internals in order to perform some security research in the future. I first tried to...

Application Security

A true story of mobile device geolocation

Alessandro Groppo

December 4, 2019June 21, 2021

TL;DR During the monthly research activity, in accordance with the relative Respnsible Disclosure program, we found and went in depth with an interesting security issue...

Exploiting a Quarantine UAF Mitigation on a Custom Allocator Challenge

A Reverse Engineering Walkthrough Journey

CVE-2022-2602: DirtyCred File Exploitation applied on an io_uring UAF

Linux Kernel Exploit Development: 1day case study

KRWX: Kernel Read Write Execute

ownCloud Multiple Vulnerabilities

Android IPC: Part 2 – Binder and Service Manager Perspective

Multiple SSRF on Vanilla Moodle Installations

Android IPC: Part 1 – Introduction

A true story of mobile device geolocation

Top Category

Application Security

Mobile

Meet The Team

Recent Post

Top Category