Collaborate Disseminate
I have been learning and implementing Process Hollowing attacks, and even after I got the thing work, I have some questions.
Why aren’t we building the IAT when we load our injected PE? All we do is copy the headers and the sections, fix … Continue reading Process hollowing and the Import Address Table
Whenever a computer runs slow, hangs, or freezes, the first approach should be to check the Task…
For more visit TheWindowsClub.com. Continue reading What is Adobe_Updater.exe on my Windows 10 PC? Should you remove it?
Whenever a computer slows down or freezes, the first approach should be to check the Task Manager…
For more visit TheWindowsClub.com. Continue reading What is Sedlauncher.exe? Should you remove it?
At times, when using Skype, you may see a message RAVBg64.exe wants to use Skype or RAVBg64.exe is…
For more visit TheWindowsClub.com. Continue reading RAVBg64.exe shows high CPU usage? Why does it want to use Skype?
So i was running this command: sysdig evt.dir=\< and not ( ) , and there were a few results that seemed kind of strange. There are two processes, one named gmain and the other InputThread. They’re threads, so they don’t show up on top…. Continue reading What is gmain and Input thread?
How concerned should I be about this result from unhide?
unhide-linux scan starting at: 17:02:43, 2020-03-23 Used options:
logtofile [*]Searching for Hidden processes through /proc stat
scanning
[*]Searching for Hidden proces… Continue reading Hidden Process Discovered in Tails OS
How concerned should I be about this result from unhide?
unhide-linux scan starting at: 17:02:43, 2020-03-23 Used options:
logtofile [*]Searching for Hidden processes through /proc stat
scanning
[*]Searching for Hidden proces… Continue reading Hidden Process Discovered in Tails OS
To reduce disk space I have planned to use a hard link instead of full copy, Is there any security issue while two different processes using different hard links of the same executable file as base?
I am trying to make a restriction to procfs like only a certain groups of members can perform read and write actions.
kernel document says we can do that by setting hidepid and gid in /etc/fstab. It will restrict the malicious user from m… Continue reading What is the best way to restrict /proc fs from malicious users (linux)?
I’m scanning servers with testssl, but it seems like that some of them have stopped running, or maybe they are paused. I’m using linux screen and there are 15 detached processes running. Half of them are already finished, and as I checked … Continue reading What can be a reason if testssl stops scanning in the process? [closed]