The Curious Engineer

All blogs / Security

Didier Stevens

blog.didierstevens.com

(blog 'DidierStevens)

SecurityReverse engineering

’10’15’20’25
Posts
1,496 from 13 Jun 2006 to 31 Oct 2026
Posting
weekly (46 in the last year)
Kind
personal blog
Feed
https://blog.didierstevens.com/feed/

2026 34

  1. Quickpost: WT20 Welding Electrodes & Radiation
  2. Quickpost: Ghost USB-C
  3. “A Ring Tone That I Cannot Hear” – Twenty Years Later
  4. Quickpost: Uranium Glass
  5. Update: onedump.py Version 0.0.3
  6. Overview of Content Published in September
  7. Update: search-for-compression.py Version 0.0.8
  8. Overview of Content Published in August
  9. Update: base64dump.py Version 0.0.31
  10. Overview of Content Published in July
  11. Overview of Content Published in June
  12. Update: base64dump.py Version 0.0.30
  13. Overview of Content Published in May
  14. Update: search-for-compression.py Version 0.0.7
  15. Overview of Content Published in April
  16. Update: cut-bytes.py Version 0.0.18
  17. Overview of Content Published in March
  18. Update: oledump.py Version 0.0.85
  19. Update: oledump.py Version 0.0.84
  20. Update: pdf-parser.py Version 0.7.14
  21. Update: zipdump.py Version 0.0.34
  22. Update: zipdump.py Version 0.0.34
  23. Update: pecheck.py Version 0.7.20
  24. Update: search-for-compression.py 0.0.6
  25. Update: emldump.py Version 0.0.16
  26. Update: base64dump.py Version 0.0.29
  27. Overview of Content Published in February
  28. Update: rtfdump.py Version 0.0.15
  29. Update: rtfdump.py Version 0.0.14
  30. Overview of Content Published in January
  31. Update: zipdump.py Version 0.0.33
  32. Update: hash.py Version 0.0.14
  33. Overview of Content Published in 2025
  34. Overview of Content Published in December

2025 74

  1. Using a USB-C Trigger Cable To Power An FM Radio
  2. Update: pecheck.py Version 0.7.19
  3. USB Trigger Boards
  4. Quickpost: USB-C Rechargeable Batteries
  5. Quickpost: USB Electric Razor
  6. Overview of Content Published in November
  7. Copy/Paste Delays In Excel Because Of Default Printer
  8. Quickpost: CR1225 vs CR1220
  9. Quickpost: Power Requirements Of A Keylogger
  10. Update: numbers-to-hex.py Version 0.0.4
  11. Update: cs-parse-traffic.py Version 0.0.6
  12. Overview of Content Published in October
  13. Bytes over DNS Tools
  14. Update: dnsresolver.py Version 0.0.4
  15. Quickpost: PEP 515 – Underscores in Numeric Literals
  16. Overview of Content Published in September
  17. Overview of Content Published in August
  18. Update: pdf-parser.py Version 0.7.13
  19. Overview of Content Published in July
  20. Quickpost: 12V Portable Power Station
  21. Quickpost: Doorbell & Condensation
  22. Overview of Content Published in June
  23. Update: teeplus.py Version 0.0.2
  24. New Tool: myipaddress.py
  25. Update: virustotal-search.py Version 0.1.9
  26. Update: myjson-filter.py Version 0.0.9
  27. Update: search-for-compression.py 0.0.5
  28. Update: pecheck.py Version 0.7.18
  29. My Fridge & My Portable Power Station
  30. Update: pngdump.py Version 0.0.7
  31. Quickpost: USB-C Couplers
  32. Python Requirements for Didier Stevens Suite
  33. DSS_DEFAULT_HASH_ALGORITHMS
  34. Quickpost: emldump Bulk Extraction
  35. Quickpost: Firefox Profiles and Multiple Instances
  36. Update: search-for-compression.py Version 0.0.4
  37. Update: myjson-transform.py Version 0.0.2
  38. Overview of Content Published in May
  39. Update: myjson-filter.py Version 0.0.8
  40. Update: oledump.py Version 0.0.82
  41. Quickpost: Airplanes & Radiation
  42. Update: process-binary-file.py Version 0.0.11
  43. Update: oledump.py Version 0.0.81
  44. Update: myjson-filter.py Version 0.0.7
  45. Update: xorsearch.py Version 0.0.5
  46. Overview of Content Published in April
  47. Update: re-search.py Version 0.0.23
  48. Update: pdf-parser.py Version 0.7.2
  49. Update: oledump.py Version 0.0.80
  50. Update: zipdump.py Version 0.0.32
  51. Update: rtfdump.py Version 0.0.13
  52. Update: pecheck.py Version 0.7.17
  53. Update: emldump.py Version 0.0.15
  54. Update: basedump64.py Version 0.0.28
  55. Update: xorsearch.py Version 0.0.4
  56. Quickpost: Testing The Capacity Of My New Power Bank
  57. Update: xorsearch.py Version 0.0.3
  58. Update: xorsearch.py Version 0.0.2
  59. Overview of Content Published in March
  60. Quickpost: Electrical Power & Mining: Dissipated Heat
  61. Update: zipdump.py Version 0.0.31
  62. Update: xmldump.py Version 0.0.10
  63. Update: pdf-parser.py Version 0.7.11
  64. Update: pdfid.py Version 0.2.10
  65. Update: 1768.py Version 0.0.23
  66. Update: oledump.py Version 0.0.79
  67. Update: zoneidentifier.exe Version 0.0.2
  68. Overview of Content Published in February
  69. Update: cs-decrypt-metadata.py Version 0.0.5
  70. Update: Python Templates Version 0.0.12
  71. Quickpost: Electrical Power & Mining
  72. Update: strings.py Version 0.0.11
  73. Overview of Content Published in January
  74. Overview of Content Published in December

2024 46

  1. Update: oledump.py Version 0.0.78
  2. Update: 1768.py Version 0.0.22
  3. Overview of Content Published in November
  4. Update: base64dump.py Version 0.0.27
  5. Interfacing With A Cheap Geiger Counter
  6. Quickpost: The Electric Energy Consumption Of A Soundbar
  7. Update: base64dump.py Version 0.0.26
  8. Quickpost: The Electric Energy Consumption Of A Wired Doorbell
  9. Update: strings.py Version 0.0.10
  10. Update: xmldump.py Version 0.0.9
  11. Update: pdf-parser.py Version 0.7.10
  12. Update: pdfid.py Version 0.2.9
  13. Overview of Content Published in October
  14. Quickpost: The Electric Energy Consumption Of LLMs – No GPU
  15. Quickpost: The Electric Energy Consumption Of LLMs
  16. Overview of Content Published in September
  17. Overview of Content Published in August
  18. Overview of Content Published in July
  19. Update: cut-bytes.py Version 0.0.17
  20. Update: oledump.py Version 0.0.77
  21. Update: hash.py Version 0.0.13
  22. Overview of Content Published in June
  23. Update: emldump.py Version 0.0.14
  24. Update: python-per-line.py Version 0.0.12
  25. MyJSON Tools
  26. Update: InteractiveSieve Version 0.9.3.0
  27. Update: base64dump.py version 0.0.25
  28. Update: pdf-parser.py Version 0.7.9
  29. Update: FileScanner Version 0.0.0.9
  30. Update: what-is-new.py Version 0.0.4
  31. Update: simple_listener.py Version 0.1.5
  32. Update: count.py Version 0.3.2
  33. Update: zipdump.py Version 0.0.30
  34. Update: strings.py Version 0.0.9
  35. Update: myjson-filter.py version 0.0.6
  36. Update: hash.py Version 0.0.12
  37. Update: file-magic.py Version 0.0.8
  38. Overview of Content Published in May
  39. Update: byte-stats.py Version 0.0.10
  40. Reversing A Network Protocol
  41. Update: 1768.py Version 0.0.21
  42. Update: oledump.py Version 0.0.76
  43. Wireshark Lua Fixed Field Length Dissector: fl-dissector
  44. Overview of Content Published in March
  45. Update: metatool.py Version 0.0.4
  46. Overview of Content Published in February

2023 54

  1. Overview of Content Published in November
  2. Update: 1768.py Version 0.0.20
  3. Overview of Content Published in October
  4. Update: format-bytes.py Version 0.0.15
  5. Update: 1768.py Version 0.0.19
  6. Update: simple_listener.py Version 0.1.4
  7. Update: python-per-line.py Version 0.0.11
  8. Update: myjson-filter.py Version 0.0.5
  9. Update: pecheck.py Version 0.7.16
  10. Update: xor-kpa.py Version 0.0.8
  11. Update: simple_listener.py Version 0.1.3
  12. Overview of Content Published in September
  13. Update: hash.py Version 0.0.10
  14. Update: zipdump.py Version 0.0.28
  15. Update: file-magic.py Version 0.0.7
  16. Update: emldump.py Version 0.0.13
  17. Update: zipdump.py Version 0.0.28
  18. Overview of Content Published in August
  19. Quickpost: PDF/ActiveMime Maldocs YARA Rule
  20. Quickpost: Analysis of PDF/ActiveMime Polyglot Maldocs
  21. Update: emldump.py Version 0.0.12
  22. Update: sortcanon.py Version 0.0.3
  23. Overview of Content Published in July
  24. Update: zipdump.py Version 0.0.27
  25. Overview of Content Published in June
  26. Update: zipdump.py Version 0.0.26
  27. Overview of Content Published in May
  28. Update: oledump.py Version 0.0.75
  29. Overview of Content Published in April
  30. Update: zipdump.py Version 0.0.25
  31. New Tool: myjson-transform.py
  32. Update: dnsresolver.py Version 0.0.3
  33. Update: 1768.py Version 0.0.18
  34. Update: re-search.py Version 0.0.22
  35. Update: oledump.py Version 0.0.74
  36. Overview of Content Published in March
  37. Update: myjson-filter.py Version 0.0.4
  38. Update: python-per-line.py version 0.0.10
  39. Update: oledump.py Version 0.0.73
  40. Overview of Content Published in February
  41. Update: oledump.py Version 0.0.72
  42. Quickpost: Fixing A Duplicate Key
  43. How-to: Make Your Own Cert With Web OpenSSL
  44. Update: process-binary-file Version 0.0.9
  45. Update: cut-bytes.py Version 0.0.16
  46. Update: xor-kpa.py Version 0.0.7
  47. Update: file-magic.py Version 0.0.6
  48. Update: pdf-parser.py Version 0.7.8
  49. Overview of Content Published in January
  50. Analyzing Malicious OneNote Documents
  51. Update: process-binary-file Version 0.0.8
  52. New Tool: onedump.py
  53. Overview of Content Published in 2022
  54. Overview of Content Published in December

2022 109

  1. Combining zipdump, file-magic And myjson-filter
  2. Update: zipdump.py Version 0.0.24
  3. Powerstrip With Neon Lamp Switch
  4. Combining dns-pydivert And dnsresolver
  5. New Tool: dns-pydivert.py
  6. Update: dnsresolver.py Version 0.0.2
  7. Update: myjson-filter.py Version 0.0.3
  8. Update: file-magic.py Version 0.0.5
  9. Update: nsrl.py Version 0.0.4
  10. Update: InteractiveSieve Version 0.9.2.0
  11. Update: filescanner Version 0.0.0.8
  12. New tool: teeplus.py
  13. Update: zipdump.py Version 0.0.23
  14. Update: virustotal-search.py Version 0.1.8
  15. Update: hash.py Version 0.0.9
  16. Update: count.py Version 0.3.1
  17. Extracting Certificates For Defender
  18. Update: python-per-line.py Version 0.0.9
  19. Overview of Content Published in November
  20. Update: what-is-new.py Version 0.0.2
  21. Quickpost: Testing A USB Fridge (Update)
  22. Update: oledump.py Version 0.0.71
  23. Update: pdf-parser.py Version 0.7.7
  24. Quickpost: Testing A USB Fridge
  25. Overview of Content Published in October
  26. Quickpost: BruCON Travel Charger
  27. The Making Of: qa-squeaky-toys.docm
  28. Update: byte-stats.py Version 0.0.9
  29. Quickpost: Testing A Lemon Battery
  30. Update: rtfdump.py Version 0.0.12
  31. Update: base64dump.py Version 0.0.24
  32. Quickpost: Standby Power Consumption Of An Old Linear Power Supply
  33. Overview of Content Published in September
  34. Update: rtfdump.py Version 0.0.11
  35. Taking A Look At PNG Files with pngdump.py Beta Version 0.0.3
  36. Quickpost: Tuning The Electric Energy Consumption Of My TV
  37. Update: My Python Templates Version 0.0.8
  38. Update: strings.py Version 0.0.8
  39. New Tool: split-overlap.py
  40. Update: virustotal-search.py Version 0.1.7
  41. Quickpost: An Inefficient Powerbank
  42. Quickpost: “Exploding Multimeter”
  43. Maldoc Analysis Video – Rehearsed & Unrehearsed
  44. Quickpost: Dolmen du roc de l’Arca
  45. Quickpost: Sun Drying Biodegradable Waste
  46. Update: hex-to-bin.py Version 0.0.6
  47. Update: xor-kpa.py Version 0.0.6
  48. Update: translate.py Version 2.5.12
  49. Update: oledump.py Version 0.0.70
  50. Update: jpegdump.py Version 0.0.10
  51. Quickpost: Standby Power Consumption Of My Bosch 18V Chargers
  52. Overview of Content Published in August
  53. Update: 1768.py Version 0.0.16
  54. Update: 1768.py Version 0.0.15
  55. Overview of Content Published in July
  56. Quickpost: iPad Pro Charging – Power Consumption
  57. Quickpost: Standby Power Consumption Of My USB Chargers (120V vs 230V)
  58. Update: re-search.py Version 0.0.21
  59. Update: oledump.py Version 0.0.69
  60. Update: sortcanon Version 0.0.2
  61. Update: base64dump.py Version 0.0.23
  62. Quickpost: Standby Power Consumption Of My USB Chargers
  63. simple_listener.py
  64. Overview of Content Published in June
  65. Update: format-bytes.py Version 0.0.14
  66. Update: cut-bytes.py Version 0.0.15
  67. Quickpost: Cracking PDF Owner Passwords
  68. Examples Of Encoding Reversing
  69. Another Exercise In Encoding Reversing
  70. New Tool: sortcanon.py
  71. Update: base64dump.py Version 0.0.22
  72. Discovering A Forensic Artifact
  73. New Tool: dns-query-async.py
  74. Update: python-per-line.py Version 0.0.8
  75. Update: oledump.py Version 0.0.68
  76. Overview of Content Published in May
  77. PoC: Cobalt Strike mitm Attack
  78. Update: Python Templates Version 0.0.7
  79. Update: 1768.py Version 0.0.14
  80. Update: pdf-parser.py Version 0.7.6
  81. Update: re-search.py Version 0.0.20
  82. Update: pecheck.py Version 0.7.15
  83. Update: base64dump.py Version 0.0.21
  84. Update: oledump.py Version 0.0.67
  85. Update: zipdump.py Version 0.0.22
  86. Update: cs-parse-traffic.py Version 0.0.5
  87. Update: oledump.py Version 0.0.66
  88. Overview of Content Published in April
  89. Quickpost: Machine Code Infinite Loop
  90. Update: oledump.py Version 0.0.65
  91. Update: re-search.py Version 0.0.19
  92. New Tool: pngdump.py (Beta)
  93. Update: 1768.py Version 0.0.13
  94. Update: cut-bytes.py Version 0.0.14
  95. New Tool: myjson-filter.py
  96. .ISO Files With Office Maldocs & Protected View in Office 2019 and 2021
  97. Power Consumption Of A Philips Hue lamp In Off State
  98. Overview of Content Published in March
  99. spring4shell Capture File
  100. New Tool: xlsbdump.py
  101. Update: oledump.py Version 0.0.64
  102. Overview of Content Published in February
  103. Update: 1768.py Version 0.0.12
  104. Update: oledump.py Version 0.0.63
  105. Beta: smtp-honeypot.py
  106. Windows Explorer: Improper Exif Data Removal
  107. Update: jpegdump.py Version 0.0.9
  108. Overview of Content Published in January
  109. Overview of Content Published in December

2021 86

  1. Update: base64dump.py Version 0.0.20
  2. Update: pecheck Version 0.7.14
  3. VBA: __SRP_ Streams
  4. Update: cs-analyze-processdump.py Version 0.0.3
  5. Update: cs-extract-key.py Version 0.0.4
  6. Update: 1768.py Version 0.0.11
  7. Update: cs-parse-traffic.py Version 0.0.4
  8. Update: cs-decrypt-metadata.py Version 0.0.4
  9. Update: base64dump.py Version 0.0.19
  10. MiTM Cobalt Strike Network Traffic
  11. Overview of Content Published in November
  12. Update: cs-extract-key.py Version 0.0.3
  13. New Tool: cs-parse-traffic.py
  14. New tool: cs-analyze-processdump.py
  15. Update: cs-decrypt-metadata.py Version 0.0.3
  16. Update: base64dump.py Version 0.0.18
  17. Update: 1768.py Version 0.0.10
  18. Update: cs-decrypt-metadata.py Version 0.0.2
  19. Update: 1768.py Version 0.0.9
  20. New Tool: cs-extract-key.py
  21. Overview of Content Published in October
  22. New Tool: cs-decrypt-metadata.py
  23. “Public” Private Cobalt Strike Keys
  24. Update: 1768.py Version 0.0.8
  25. New Tool: onion-connect-service-detection.py
  26. Overview of Content Published in September
  27. Update: base64dump.py Version 0.0.17
  28. Patching A Java .class File
  29. Update: re-search.py Version 0.0.18
  30. Overview of Content Published in August
  31. Update: AnalyzePESig Version 0.0.0.8
  32. Update: pdfid.py Version 0.2.8
  33. Update: pdf-parser.py Version 0.7.5
  34. My YouTube Playlists
  35. Update: oledump.py Version 0.0.62
  36. dnsresolver.py: Videos For Each Command
  37. Overview of Content Published in July
  38. Using SeBackupPrivilege With Python
  39. Update: base64dump.py Version 0.0.16
  40. sysmon’s DNS QueryStatus Field
  41. New Tool: dnsresolver.py
  42. Update: FileScanner Version 0.0.0.7
  43. New Tool: texteditor.py
  44. Update: xmldump.py Version 0.0.7
  45. Overview of Content Published in June
  46. Update: oledump.py Version 0.0.61
  47. Update: 1768.py Version 0.0.7
  48. New Tool: ssdeep.py
  49. Update: Python Templates Version 0.0.5
  50. How-to: Make Your Own Cert With OpenSSL on Windows (Reloaded)
  51. Overview of Content Published in May
  52. New Tool: cs-dns-stager.py
  53. Update: base64dump.py Version 0.0.14
  54. Update: re-search.py Version 0.0.17
  55. Update: 1768.py Version 0.0.6
  56. Overview of Content Published in April
  57. Quickpost: Decrypting Cobalt Strike Traffic
  58. isodump.py
  59. Lua CSV Wireshark Dissector
  60. metatool.py
  61. Overview of Content Published in March
  62. FileZilla Uses PuTTY’s Registry Fingerprint Cache
  63. Quickpost: “ProxyLogon PoC” Capture File
  64. Update: 1768.py Version 0.0.5
  65. Update pecheck.py Version 0.7.13
  66. Update: nsrl.py Version 0.0.3
  67. Overview of Content Published in February
  68. Update: oledump.py Version 0.0.60
  69. re-search.py And Custom Validations
  70. Update: re-search.py Version 0.0.16
  71. Quickpost: oledump.py plugin_biff.py: Remove Sheet Protection From Spreadsheets
  72. Update: oledump.py Version 0.0.59
  73. Overview of Content Published in January
  74. New Tool: pdftool.py
  75. Update: XORSelection.1sc Version 6.0
  76. Update: strings.py Version 0.0.7
  77. Update: re-search.py Version 0.0.15
  78. Update: re-search.py Version 0.0.14
  79. Video: Maldoc Analysis With CyberChef
  80. Update: Python Templates Version 0.0.4
  81. Update: count.py Version 0.3.0
  82. Decrypting TLS Streams With Wireshark: Part 3
  83. Update: oledump.py Version 0.0.58
  84. Update: Python Templates Version 0.0.3
  85. Overview of Content Published in 2020
  86. Overview of Content Published in December

2020 114

  1. Update: rtfdump.py Version 0.0.10
  2. Decrypting TLS Streams With Wireshark: Part 2
  3. Update: 1768.py Version 0.0.4
  4. Update: base64dump.py Version 0.0.13
  5. Update: zipdump.py Version 0.0.21
  6. Video: Using numbers-to-string.py To Analyze FireEye Maldocs
  7. Update: byte-stats.py Version 0.0.8
  8. Update: cut-bytes.py Version 0.0.13
  9. Update: translate.py Version 2.5.11
  10. Update: strings.py Version 0.0.6
  11. Decrypting TLS Streams With Wireshark: Part 1
  12. Update: numbers-to-string.py Version 0.0.11
  13. Update: oledump.py version 0.0.57
  14. Quickpost: finger.exe
  15. Update: pecheck.py Version 0.7.12
  16. Update: oledump.py Version 0.0.56
  17. Overview of Content Published in November
  18. Update: emldump.py Version 0.0.11
  19. Update: disitool.py Version 0.4
  20. Decrypting With translate.py
  21. oledump Indicators
  22. Update: oledump.py Version 0.0.55
  23. Update: translate.py Version 2.5.10
  24. The Qwerty Effect And Passwords
  25. 1768 K
  26. Quickpost: Portable Power
  27. Overview of Content Published in October
  28. Quickpost: VMware OS Version Snapshots
  29. Update: strings.py Version 0.0.5 Pascal Strings
  30. Update: translate.py version 2.5.9
  31. Quickpost: 4 Bytes To Crash Excel
  32. Update: oledump.py Version 0.0.54
  33. Overview of Content Published in September
  34. “Epic Manchego” And My Tools
  35. Quickpost: USB Passive Load
  36. Quickpost: Ext2explore
  37. Quickpost: dig On Windows
  38. Quickpost: Downloading Files With Windows Defender & User Agent String
  39. Overview of Content Published in August
  40. Update: oledump.py 0.0.53
  41. New Tool: XORSearch.py
  42. Update: numbers-to-string.py Version 0.0.10
  43. Videos: Defective USB Cable
  44. Overview of Content Published in July
  45. Update: pecheck.py Version 0.7.11
  46. Update: InteractiveSieve 0.9.1
  47. Update: zipdump.py Version 0.0.20
  48. Update: oledump.py 0.0.52
  49. ndisasm 2.15 stdin Bug Fix
  50. Cracking VBA Project Passwords
  51. Update: oledump.py Version 0.0.51
  52. Update XORSearch Version 1.11.4
  53. Quickpost: curl
  54. Tampering With Digitally Signed VBA Projects
  55. Update: base64dump.py Version 0.0.12
  56. Overview of Content Published in June
  57. VBA Purging
  58. FalsePositive GitHub Repository
  59. Update: translate.py Version 2.5.8
  60. add-admin: Tiny EXE To Add Administrative Account
  61. Overview of Content Published in May
  62. New Tool: simple_ip_stats.py
  63. AdHoc GitHub Repository
  64. Update: oledump.py Version 0.0.50
  65. Quickpost: curl And SSPI Proxy Authentication
  66. Update: XORSelection.1sc Version 5.0
  67. Quickpost: Go: Building For Multiple Operating Systems
  68. Quickpost: Empty ZIP File
  69. Overview of Content Published in April
  70. Update: zipdump.py Version 0.0.19
  71. NVISO Innovation Coin
  72. Quickpost: My SpiderMonkey’s Cheat Sheet
  73. Handling Diacritics
  74. Update: python-per-line.py Version 0.0.7
  75. Update: hex-to-bin.py Version 0.0.5
  76. Update: xmldump.py Version 0.0.6
  77. Analyzing Malformed ZIP Files
  78. Update: zipdump.py Version 0.0.18
  79. Update: zipdump.py Version 0.0.17
  80. Update XORSearch Version 1.11.3
  81. Video: GNU Radio Companion: Acoustic Beats
  82. Overview of Content Published in March
  83. April 1st 2020: FlashPix File With VBA Code
  84. Update: msoffcrypto-crack.py Version 0.0.5
  85. mimikatz Is My New EICAR
  86. Update: oledump.py Version 0.0.49
  87. Quickpost: Windows Domain Controllers Have No Local Accounts
  88. Carving PE Files With pecheck.py
  89. Quickpost: User-Agent: Microsoft Office Excel 2014
  90. Windows Assembly Program To Create New User
  91. pecheck.py Version 0.7.10
  92. Update: cmd.dll Version 0.0.5
  93. CLSIDs in OLE Files
  94. Update: oledump.py Version 0.0.48
  95. Update: oledump.py Version 0.0.47
  96. Contextual Grepping: Proxmark3 Key Scan Example
  97. Overview of Content Published in February
  98. Update: Python Templates Version 0.0.2
  99. Update: translate.py Version 0.2.7
  100. Update: format-bytes.py Version 0.0.13
  101. Update: hex-to-bin.py Version 0.0.4
  102. Update: xmldump.py Version 0.0.4
  103. Update: oledump.py Version 0.0.45
  104. Update: pecheck.py Version 0.7.9
  105. Overview of Content Published in January
  106. etl2pcapng: Support For Process IDs
  107. Update: hash.py Version 0.0.8
  108. Update: format-bytes.py Version 0.0.11
  109. Update: cut-bytes.py Version 0.0.11
  110. Using CveEventWrite From VBA (CVE-2020-0601)
  111. Analysis Of Unusual ZIP Files
  112. Overview of Content Published in the 2010s
  113. Overview of Content Published in 2019
  114. Overview of Content Published in December

2019 72

  1. YARA “Ad Hoc Rules”
  2. Update: pdf-parser.py Version 0.7.4 and pdfid.py Version 0.2.7
  3. Update: zipdump.py Version 0.0.16
  4. zoneidentifier.exe
  5. Update: oledump.py Version 0.0.44
  6. Analyzing .DWG Files With Embedded VBA Macros
  7. Update: oledump.py Version 0.0.43
  8. Update: numbers-to-string.py Version 0.0.9
  9. Overview of Content Published in November
  10. Update: tcp-honeypot.py Version 0.0.7
  11. Steganography and Malware
  12. Update: format-bytes.py Version 0.0.10
  13. Update: numbers-to-string.py Version 0.0.10
  14. Update: cut-bytes.py Version 0.0.10
  15. Overview of Content Published in October
  16. Quickpost: Running a Service DLL
  17. Quickpost: Compiling Service DLLs with MinGW on Kali
  18. Update: pecheck.py Version 0.7.8
  19. Quickpost: ExifTool, OLE Files and FlashPix Files
  20. New Tool: simple_tcp_stats.py
  21. PowerShell, Add-Type & csc.exe
  22. Shark Jack Capture File
  23. Overview of Content Published in September
  24. Update Of My PDF Tools
  25. Update: strings.py Version 0.0.4
  26. Update: hex-to-bin.py Version 0.0.3
  27. Update: pecheck.py Version 0.7.7
  28. Update: hash.py Version 0.0.7
  29. Update: msoffcrypto-crack.py Version 0.0.4
  30. Overview of Content Published in August
  31. Downloading Executables Over DNS: Capture Files
  32. Update: pdf-parser.py Version 0.7.2
  33. Overview of Content Published in July
  34. Quickpost: tcp-honeypot.py & Browser Tests
  35. Update: format-bytes.py Version 0.0.9
  36. Quickpost: nslookup Types
  37. Overview of Content Published in June
  38. New Tool: amsiscan.py
  39. Update: virustotal-search.py Version 0.1.5
  40. Quickpost: C Random Functions in Other Languages
  41. Update: sets.py Version 0.0.3
  42. Overview of Content Published in May
  43. Update: hex-to-bin.py Version 0.0.2
  44. Update: zipdump Version 0.0.15
  45. DSSuite: A Docker Container With My Tools
  46. WebDAV, NTLM & Responder
  47. Quickpost: Retrieving an SSL Certificate with nmap
  48. Overview of Content Published in April
  49. Update: jpegdump.py Version 0.0.7
  50. Update: format-bytes.py Version 0.0.8
  51. Update: python-per-line.py Version 0.0.6
  52. Update: translate.py Version 2.5.6
  53. Extracting “Stack Strings” from Shellcode
  54. Quickpost: Browsers & Content-Disposition
  55. list-interfaces.xlsm
  56. Overview of Content Published in March
  57. Update: pecheck.py Version 0.7.6
  58. Quickpost: PDF Tools Download Feature
  59. Maldoc: Excel 4.0 Macro
  60. Update: oledump.py Version 0.0.42
  61. Update: re-search.py Version 0.0.13
  62. Analyzing a Phishing PDF with /ObjStm
  63. Update: pdf-parser.py Version 0.7.1
  64. Overview of Content Published in February
  65. Update: pdf-parser.py Version 0.7.0
  66. Update: translate.py Version 2.5.5
  67. Update: oledump.py Version 0.0.41
  68. Update: cut-bytes.py Version 0.0.9
  69. Overview of Content Published in January
  70. Update: msoffcrypto-crack.py Version 0.0.3
  71. Update: msoffcrypto-crack.py Version 0.0.2
  72. Overview of Content Published in December

2018 112

  1. New Tool: msoffcrypto-crack.py
  2. Update: format-bytes.py Version 0.0.7
  3. New Tool: SimpleEncoder
  4. Update: numbers-to-string.py Version 0.0.7
  5. Update: XORSearch Version 1.11.2
  6. Update:oledump.py Version 0.0.40
  7. Update: numbers-to-string.py Version 0.0.6
  8. Update: rtfdump.py Version 0.0.9
  9. Release: strings.py
  10. Update: oledump.py Version 0.0.39
  11. Quickpost: Developing for ESP32 with the Arduino IDE
  12. Overview of Content Published in November
  13. Quickpost: Compiling with Build Tools for Visual Studio 2017
  14. Quickpost: Compiling 32-bit Static ELF Files on Kali
  15. Video: Analyzing PowerPoint Maldocs with oledump Plugin plugin_ppt
  16. Update: cut-bytes.py Version 0.0.8
  17. Update: hash.py Version 0.0.6
  18. Quickpost: Using pcapy with Npcap on Windows
  19. Overview of Content Published in October
  20. Update: format-bytes.py Version 0.0.6
  21. Update: file-magic.py Version 0.0.4
  22. Update: file-magic.py Version 0.0.3
  23. Analyzing PowerPoint Maldocs with oledump Plugin plugin_ppt
  24. Update: oledump.py Version 0.0.38
  25. Update: pdf-parser.py Version 0.6.9
  26. New tool: decompress_rtf.py
  27. Release: Python Tool Templates
  28. KEIHash: Fingerprinting SSH
  29. Title: Overview of Content Published in September
  30. Quickpost: Signing Windows Executables on Kali
  31. Update: pecheck.py Version 0.7.4
  32. Quickpost: Compiling EXEs and Resources with MinGW on Kali
  33. WiFi Pineapple NANO: Persistent Recon DB
  34. Firmware Upgrade: WiFi Pineapple NANO
  35. Overview of Content Published in August
  36. Quickpost: Compiling DLLs with MinGW on Windows
  37. Update: numbers-to-string.py Version 0.0.5
  38. Obtaining Malware Samples for Analysis
  39. Quickpost: Revisiting JA3
  40. Update: format-bytes Version 0.0.5
  41. Update: oledump.py Version 0.0.37
  42. Update: PDFiD.py Version 0.2.5
  43. Overview of Content Published in July
  44. Update: python-per-line.py Version 0.0.5
  45. Update: numbers-to-string.py Version 0.0.4
  46. Update: re-search.py Version 0.0.12
  47. Extracting DotNetToJScript’s PE Files
  48. Update: base64dump.py Version 0.0.11
  49. Update: sets.py Version 0.0.2
  50. !exploitable Crash Analyzer – Statically Linked CRT
  51. New Tool: file-magic.py
  52. Quickpost: Compiling DLLs with MinGW on Kali
  53. –jsonoutput
  54. Update: oledump.py Version 0.0.36
  55. Update: zipdump.py Version 0.0.14
  56. Update: zipdump.py Version 0.0.13
  57. Update: oledump.py Version 0.0.35
  58. Overview of Content Published in June
  59. Update: re-search.py Version 0.0.11
  60. Update: re-search.py Version 0.0.10
  61. Quickpost: Decoding Certutil Encoded Files
  62. Update: zipdump.py Version 0.0.12
  63. Update: jpegdump.py Version 0.0.6
  64. Validating Your Downloads
  65. Update: hash.py version 0.0.5
  66. Update: cut-bytes.py Version 0.0.7
  67. Update: translate.py Version 2.5.4
  68. Update: jpegdump.py Version 0.0.5
  69. “Here Files” and my Tools
  70. Update: pecheck.py Version 0.7.3
  71. Encrypted OOXML Documents
  72. Quickpost: John & Dummy Hashes
  73. Overview of Content Published In May
  74. PDFiD: GoToE and GoToR Detection (“NTLM Credential Theft”)
  75. Quickpost: Windows Debugger as Post Mortem Debugger – 32-bit & 64-bit
  76. Update: base64dump.py Version 0.0.10
  77. Video: SpiderMonkey Output Options
  78. Update: base64dump.py Version 0.0.9
  79. Update: oledump.py Version 0.0.34
  80. Overview of Content Published In April
  81. SpiderMonkey and STDIN
  82. Update: python-per-line.py Version 0.0.4
  83. Update: Patched SpiderMonkey
  84. Update: hash.py Version 0.0.3
  85. Update: XORSelection.1sc Version 4.0
  86. Quickpost: Email Server Simulator
  87. Update: xmldump.py Version 0.0.3
  88. Overview of Content Published In March
  89. CTRL-Z is EOF
  90. Quickpost: Using Suricata on Windows
  91. Title: Overview of Content Published In February
  92. Wireshark Comments
  93. Quickpost: Using nmap With Tallow (Tor proxy)
  94. Update: pecheck.py Version 0.7.2
  95. Update: oledump.py Version 0.0.33
  96. Update: translate.py Version 2.5.3
  97. Update: pdfid.py Version 0.2.4
  98. Update: jpegdump.py Version 0.0.4
  99. Update: hash.py Version 0.0.2
  100. Update: python-per-line version 0.0.3
  101. Quickpost: Remote Shell On Windows Via Tor Onion Service
  102. Quickpost: Code To Connect To Tor Onion Service
  103. Overview of Content Published In January
  104. Update: rtfdump.py Version 0.0.7
  105. Update: translate.py Version 2.5.2
  106. New Tool: jpegdump.py
  107. Quickpost: Retrieving Malware Via Tor On Windows
  108. Quickpost: Data Exfiltration With Tor Browser And Domain Fronting
  109. Update: format-bytes.py Version 0.0.4
  110. Update: xmldump.py Version 0.0.2
  111. Overview of Content Published In December
  112. New Tool: What Is New?

2017 120

  1. Cracking Encrypted PDFs – Conclusion
  2. Cracking Encrypted PDFs – Part 3
  3. Cracking Encrypted PDFs – Part 2
  4. Cracking Encrypted PDFs – Part 1
  5. New Tool: format-bytes.py
  6. New Tool: xmldump.py
  7. New oledump Plugin: plugin_msg.py / oledump.py Version 0.0.32
  8. Update: plugin_biff.py Version 0.0.2 / oledump.py Version 0.0.31
  9. New Tool: hash.py
  10. Update: rtfdump.py Version 0.0.6
  11. Overview of Content Published In November
  12. Update: pdfid.py Version 0.2.3
  13. Update: pcap-rename.py Version 0.0.2
  14. WebDAV Traffic To Malicious Sites
  15. Update: numbers-to-string.py Version 0.0.3
  16. Update: oledump.py Version 0.0.30
  17. Update: pecheck.py Version 0.7.1
  18. Update: cut-bytes.py Version 0.0.6
  19. Update: byte-stats.py Version 0.0.7
  20. Analyzing Metasploit’s Office Maldoc
  21. Overview of Content Published In October
  22. Analyzing A Malicious Document Cleaned By Anti-Virus
  23. Update: pdfid.py Version 0.2.2
  24. Update: pdf-parser.py Version 0.6.8
  25. Update: base64dump.py Version 0.0.8
  26. Update: oledump.py Version 0.0.29
  27. Overview of Content Published In September
  28. Quickpost: Mimikatz DCSync Detection
  29. Quickpost: Creating A Simple Flow Graph With GNU Radio Companion
  30. Quickpost: GNU Radio On Windows
  31. Quickpost: Update: Infinite Control For Bash Bunny
  32. PyBoard LCD160CR Text Scrolling Window 8
  33. Quickpost: Keyboard Setting For pfSense
  34. Quickpost: DllDemo
  35. Running Windows Services on Linux with Mono
  36. Update: re-search.py Version 0.0.9
  37. Overview of Content Published In August
  38. Compiling a Windows Service With Mono on Kali
  39. Abusing A Writable Windows Service
  40. Quickpost: PowerShell Options Order
  41. Quickpost: Metasploit PowerShell BASE64 Commands
  42. Quickpost: Using ClamAV On Windows
  43. Wireshark: Follow Streams
  44. Generating PowerShell Scripts With MSFVenom On Windows
  45. Using Metasploit On Windows
  46. Reading Memory Of 64-bit Processes
  47. Update: byte-stats.py Version 0.0.6
  48. Overview of Content Published In July
  49. Update: translate.py Version 2.5.0
  50. Quickpost: Trying Out JA3
  51. .ISO Files & autorun.inf
  52. Analyzing Password Dumps With My Tools – Part 1
  53. Update: count.py Version 0.2.0
  54. The Paste Command
  55. The Clip Command
  56. New Tool: headtail.py
  57. Update: python-per-line.py Version 0.0.2
  58. oledump.py *.vir
  59. Update: emldump.py Version 0.0.10
  60. Update: oledump.py Version 0.0.28
  61. Update:zipdump.py Version 0.0.11
  62. .ISO Files With Zone.Identifier
  63. Quickpost: Analyzing .ISO Files Containing Malware
  64. Beta: format-bytes.py
  65. Mimikatz Videos
  66. ClamAV sigtool –decode-sigs
  67. Analyzing ClamAV Signatures – Correction
  68. Analyzing ClamAV Signatures
  69. Update: zipdump.py Version 0.0.10
  70. Select Parent Process from VBA
  71. Video: mimikatz & minesweeper
  72. Video: mimikatz & !bsod
  73. Quickpost: mimikatz !bsod
  74. I Will Follow (no, not talking about social media)
  75. Update: re-search.py Version 0.0.8
  76. Update: pecheck.py Version 0.7.0
  77. Update: zipdump.py Version 0.0.9
  78. Update; base64dump.py Version 0.0.7
  79. Overview of Content Published In June
  80. Overview of Content Published In May
  81. Update: xor-kpa.py Version 0.0.5
  82. WannaCry Simple File Analysis
  83. Update: zipdump.py Version 0.0.8
  84. Update: zipdump.py Version 0.0.7
  85. Update: re_search.py Version 0.0.7
  86. Quickpost: WannaCry’s Mutex Is MsWinZonesCacheCounterMutexA0 (Digit Zero At The End)
  87. Quickpost: WannaCry Killswitch Check Is Not Proxy Aware
  88. Update: re_search.py Version 0.0.5
  89. Quickpost: ZIP Password Cracking With John The Ripper
  90. Crack A ZIP Password, And Fly To Dubai …
  91. Quickpost: Internet Zone IDs
  92. Gzip Decompression Via Pipes
  93. Overview of Content Published In April
  94. Bash Bunny PDF Dropper
  95. New Tool: python-per-line
  96. Malicious Documents: The Matryoshka Edition
  97. CVE-2017-0199
  98. Update: re-search.py Version 0.0.4
  99. Quickpost: Bash Bunny & Keyboard Layouts
  100. Quickpost: Infinite Control For Bash Bunny
  101. Quickpost: Using My Bash Bunny To “Snag Creds From A Locked Machine”
  102. Overview of Content Published In March
  103. That Is Not My Child Process!
  104. Update: oledump.py Version 0.0.27
  105. Update: cut-bytes.py Version 0.0.5
  106. New Tool: sets.py
  107. Update: re-search.py Version 0.0.3
  108. Overview of Content Published In February
  109. Practice ntds.dit File Part 9: Extracting Password History Hashes
  110. Password History Analysis
  111. Update: translate.py Version 2.4.0
  112. Update: rtfdump.py Version 0.0.5
  113. Update: base64dump.py Version 0.0.6
  114. Quickpost: ClamAV and ZIP File Decryption
  115. Overview of Content Published In January
  116. Update: zipdump.py Version 0.0.5
  117. Quickpost: Dropbox & Alternate Data Streams
  118. Update: FileScanner Version 0.0.0.4
  119. Update: byte-stats.py Version 0.0.5
  120. Overview of Content Published In December

2016 83

  1. Update: pdf-parser Version 0.6.7
  2. Hancitor Maldoc Videos
  3. Update: pecheck.py Version 0.6.0 – Overview Of Resources
  4. Update: oledump.py Version 0.0.26
  5. Update: pecheck.py Version 0.5.2
  6. Overview of Content Published In November
  7. Update: pdf-parser Version 0.6.6
  8. Update: xor-kpa.py Version 0.0.4
  9. Simple Ciphers: cipher-tool.py
  10. Update: base64dump.py Version 0.0.5
  11. Update: zipdump.py Version 0.0.4
  12. Update: byte_stats.py Version 0.0.4
  13. Update: shellcode2vba.py Version 0.5
  14. Quickpost: Zone.Identifier
  15. Overview of Content Published In October
  16. Maldoc With Process Hollowing Shellcode
  17. Update: virustotal-search.py Version 0.1.4
  18. Update: cut-bytes.py Version 0.0.4
  19. Update: oledump.py Version 0.0.25
  20. Analyzing Office Maldocs With Decoder.xls
  21. rtfdump Videos
  22. Overview of Content Published In September
  23. Quickpost: Enhancing Radare2 Disassembly Listing
  24. decoder-search.py Beta
  25. Update: translate.py Version 2.3.1
  26. Overview of Content Published In August
  27. Update: rtfdump Version 0.0.4
  28. Update: xor-kpa.py Version 0.0.3 With Man Page
  29. Video: mimikatz: Golden Ticket + DCSync
  30. mimikatz: Golden Ticket + DCSync
  31. Howto CreateCertGUI: Create Your Own Certificate On Windows (OpenSSL Library)
  32. rtfdump: Update And Videos
  33. Overview of Content Published In July
  34. Update: re-search Version 0.0.2
  35. Video: ntds.dit: Extract Hashes With secretsdump.py
  36. Bugfix: pdf-parser Version 0.6.5
  37. Releasing rtfdump.py
  38. Practice ntds.dit File Overview
  39. Practice ntds.dit File Part 8: Password Cracking With John the Ripper – LM NTLM
  40. Practice ntds.dit File Part 7: Password Cracking With John the Ripper – Brute-force
  41. Practice ntds.dit File Part 6: Password Cracking With John the Ripper – Wordlist
  42. Practice ntds.dit File Part 5: Password Cracking With hashcat – LM NTLM
  43. Overview of Content Published In June
  44. Tool To Generate Hashcat Toggle Rules
  45. Practice ntds.dit File Part 4: Password Cracking With hashcat – Brute-force
  46. Practice ntds.dit File Part 3: Password Cracking With hashcat – Wordlist
  47. Practice ntds.dit File Part 2: Extracting Hashes
  48. Practice ntds.dit File Part 1
  49. hashcat 3.00 “fatal error: ‘inc_vendor.cl’ file not found”
  50. YouTube Video Promo
  51. Update:oledump.py Version 0.0.24
  52. Overview of Content Published In May
  53. Recovering A Ransomed PDF
  54. Major Update For zipdump.py
  55. Update: pecheck.py Version 0.5.1
  56. Update: pecheck.py Version 0.5.0
  57. New YARA Rule: PE_File_pyinstaller
  58. Update: emldump.py Version 0.0.9
  59. MovingXORSelection.1sc
  60. Overview of Content Published In April
  61. Update: numbers-to-hex.py Version 0.0.3
  62. Update translate.py Version 2.3.0
  63. Update: decode-vbe.py Version 0.0.2
  64. Overview of Content Published In March
  65. Decoding VBE
  66. Overview of Content Published In February
  67. YARA Rule To Detect VBE Scripts
  68. Update: oledump.py Version 0.0.23
  69. Even More Obfuscated MIME Type Files
  70. More Obfuscated MIME Type Files
  71. Update: translate.py Version 2.2.0 for Locky JavaScript Deobfuscation
  72. Create Your Own CMD.XLS
  73. Overview of Content Published In January
  74. Update: numbers-to-hex.py Version 0.0.2
  75. Update: cut-bytes.py Version 0.0.3
  76. Update: xor-kpa.py Version 0.0.2
  77. Update: emldump.py Version 0.0.6
  78. Update: base64dump.py Version 0.0.4
  79. BlackEnergy .XLS Dropper Puzzle
  80. Overview of Content Published In December
  81. BlackEnergy .XLS Dropper
  82. Update: shellcode2vba.py Version 0.4
  83. XOR Known-Plaintext Attack

2015 76

  1. SHA256 Code Signing and Microsoft
  2. Maldoc GET Range
  3. MIME File With “Header”
  4. Update: oledump.py Version 0.0.22
  5. BruCON Spring Training 2016: Analysing Malicious Documents
  6. Windows Backup Privilege: CMD.EXE
  7. Overview of Content Published In November
  8. Update: Authenticode Tools
  9. Update: oledump.py Version 0.0.21
  10. Update: virustotal-search.py Version 0.1.3
  11. Authenticode And Timestamping And sha256
  12. Update: emldump.py Version 0.0.5
  13. Update: nsrl.py Version 0.0.2
  14. Maldoc Social Engineering Trick
  15. Update: find-file-in-file.py Version 0.0.5
  16. Update: cut-bytes.py Version 0.0.2
  17. Update: emldump.py Version 0.0.4
  18. Update: oledump V0.0.20
  19. byte-stats.py
  20. Update: translate.py V2.1.0
  21. Analysis Of An Office Maldoc With Encrypted Payload: oledump plugin
  22. Analysis Of An Office Maldoc With Encrypted Payload (Slow And Clean)
  23. Analysis Of An Office Maldoc With Encrypted Payload (Quick And Dirty)
  24. Overview of Content Published In October
  25. New workshop videos: Malicious Office Documents Part 1
  26. cut-bytes.py
  27. Release: emldump.py Version 0.0.3
  28. Update: base64dump.py Version 0.0.3
  29. Dump Tools: Cut Cut Cut …
  30. PDF + DOC + VBAs Videos
  31. Wireshark Wifi and Lua Training – Brucon 2015
  32. nsrl.py: Using the Reference Data Set of the National Software Reference Library
  33. Test File: PDF With Embedded DOC Dropping EICAR
  34. Update: base64dump.py Version 0.0.2
  35. Update: pdf-parser Version 0.6.4
  36. Jump List Forensics
  37. “Analysing Malicious Documents” Training At 44CON London
  38. If You Have A Problem Running My Tools
  39. Extracting Dyre Configuration From A Process Dump
  40. base64dump.py Version 0.0.1
  41. Update: oledump.py Version 0.0.17 – ExitCode
  42. Metasploit Meterpreter Reverse HTTPS Snort Rule
  43. pcap-rename.py
  44. Regular Expressions With Comments
  45. Howto: Install Wireshark Dissectors
  46. Detecting Network Traffic from Metasploit’s Meterpreter Reverse HTTP Module
  47. Update: NAFT Version 0.0.9
  48. pdf-parser: A Method To Manipulate PDFs Part 2
  49. Update: virustotal-search Version 0.1.2 Daily Quota Handling and CVEs
  50. MS15-034: PoC Excel Video
  51. MS15-034 Detection: Some Observations
  52. pdf-parser: A Method To Manipulate PDFs Part 1
  53. PDF Password Cracking With John The Ripper
  54. Update: oledump.py Version 0.0.14
  55. Quickpost: Maldocs: VBA And Pastebin
  56. pdf-parser And YARA
  57. Howto: Make Your Own Cert With OpenSSL on Windows
  58. oledump And XML With Embedded OLE Object
  59. split.py
  60. Update: peid-userdb-to-yara-rules.py
  61. Update oledump.py Version 0.0.12
  62. Quickpost: Metasploit User Agent Strings
  63. VBA Maldoc: We Don’t Want No Stinkin Sandbox/Virtual PC
  64. A New Type Of Malicious Document: XML
  65. Update oledump.py Version 0.0.10
  66. Update: oledump.py Version 0.0.9
  67. Analyzing A Fraudulent Document With Error Level Analysis
  68. Update: oledump.py Version 0.0.8
  69. Update EICARgen Version 2.1
  70. Update: YARA Rule JPEG_EXIF_Contains_eval
  71. Update: oledump.py Version 0.0.7
  72. AirPcap Channel Hopping With Python
  73. Converting PEiD Signatures To YARA Rules
  74. YARA Rule: Detecting JPEG Exif With eval()
  75. Update: oledump.py Version 0.0.6
  76. Didier Stevens Suite

2014 48

  1. YouTube Video Promo
  2. Update: oledump.py Version 0.0.5
  3. oledump: Extracting Embedded EXE From DOC
  4. Introducing oledump.py
  5. YARA Rules
  6. router-forensics.net
  7. XORSelection.1sc
  8. Update: find-file-in-file.py Version 0.0.4
  9. Update: pecheck.py Version 0.4.0
  10. XORSearch: Hexdump Support
  11. Update: PDFiD With Plugins Part 2
  12. Update: PDFiD With Plugins Part 1
  13. Announcement: PDFiD Plugins
  14. Update: XORSearch With Shellcode Detector
  15. Video: PDF Creation – Public Tools
  16. FileScanner.exe Part 4
  17. FileScanner.exe Part 3
  18. FileScanner.exe Part 2
  19. Update: SpiderMonkey
  20. Introducing Filescanner.exe
  21. Update: Calculating a SSH Fingerprint From a (Cisco) Public Key
  22. A Return: The Puzzle
  23. EICARgen: An Arms Race
  24. Videos
  25. Stoned Bitcoin: My Analysis Tools
  26. Update: translate.py
  27. Update: Stoned Bitcoin
  28. Stoned Bitcoin
  29. Wireshark-export
  30. Packet Class: Wireshark – Import Hex Dump
  31. WhoAmI: status-4-evar
  32. Video: “Packet Class: Wireshark – Lua Protocol Dissectors”
  33. TCP Flags for Wireshark
  34. ssl-hearbleed.nse mod
  35. Heartbleed: Testing From a Cisco IOS Router – ssltest.tcl
  36. nmap Grepable Script Output – Heartbleed
  37. Heartbleed: Packet Capture – Full TLS
  38. Heartbleed: Packet Capture
  39. PDF Rainbow Tables
  40. Announcement: Wireshark Lua Dissectors
  41. Recorded “Network Device Forensics” Talk
  42. “Network Device Forensics” Talk
  43. XORSearch: Finding Embedded Executables
  44. Handling McAfee Quarantine Files
  45. Forensic Use of CAT Files
  46. My Software
  47. The Credentials Listener
  48. Video: Checking the Digital Signature of Windows Executables

2013 48

  1. UltraEdit Scripts
  2. Update: Prefetch File 010 Template
  3. Update: virustotal-submit.py V0.0.3
  4. MS13-098: Fixing Authenticode
  5. 4 Times Faster virustotal-search.py
  6. Quickpost: nmap & xml
  7. Update: find-file-in-file.py Version 0.0.3
  8. Update: naft-gfe.py
  9. NAFT: The Movie
  10. Update: Suspender V0.0.0.4
  11. Update: XORSearch Version 1.9.2
  12. Finding Contained Files
  13. Bugfix virustotal-submit.py Version 0.0.2
  14. Update: pdf-parser V0.4.3
  15. Brucon Hacking PDF Training
  16. Quickpost: Proxy Cookies
  17. A Bit More Than A Signature
  18. Quickpost: Rovnix PCAP
  19. OHM2013
  20. MSI: The Case Of The Invalid Signature
  21. Update: Lookup Tools
  22. Update: js-unicode-unescape.1sc
  23. The Art Of Defuzzing
  24. Update: virustotal-search.py
  25. shellcode2vba
  26. PDFiD: False Positives
  27. pdf-parser: Searching Inside Streams
  28. Quickpost: Signed PDF Stego
  29. Adobe Reader and CRLs
  30. Howto: Make Your Own Cert And Revocation List With OpenSSL
  31. VirusTotal: Searching And Submitting
  32. Howto: Add a Digital Signature to a PDF File – Free Software
  33. js-unicode-unescape.1sc
  34. js-unicode-escape.1sc
  35. pecheck.py
  36. search-and-replace-with-wildcards.1sc
  37. fuzzer.1sc
  38. shift.1sc
  39. New Tool: XORStrings
  40. Cisco IOS Patching: Defense and Offense
  41. Update: PDFiD Version 0.1.2
  42. Update: pdf-parser Version 0.4.1
  43. Update: PDFiD Version 0.1.0
  44. Looking Up Hosts and IP Addresses: Yet Another Tool
  45. Update XORSearch V1.8.0: Shifting
  46. Quickpost: TeamViewer and Proxies
  47. ISSA Journal Article ; HITB PDF Training
  48. MVP – Promo – Datapipe.xls

2012 49

  1. Crossbreeding Spiders: Baiduspider And Googlebot
  2. ListModules V0.0.0.1
  3. PaulDotCom Security Weekly And The (ISC)² Audit
  4. Authenticode Tools Page
  5. Nmap 6.25 With McAfee ePO Agent Script
  6. Update: AnalyzePESig Version 0.0.0.2
  7. Quickpost: Spiders and CCTV
  8. XORSearch for OSX
  9. “Please Buy Our Competitor’s Products”
  10. Workshops and Promo
  11. XORSearch Video
  12. Hack.lu 2012
  13. Searching For That Adobe Cert
  14. Didier Stevens Labs – Brucon 2012
  15. New Authenticode Tools
  16. Update & Split: TaskManager.xls Version 0.1.4
  17. Update: InteractiveSieve 0.7.6
  18. Update: USBVirusScan 1.7.5
  19. Update: InstalledPrograms.xls V0.0.2
  20. Video: Hardening Windows processes
  21. Prefetch File 010 Template
  22. My BlueHat Prize Entry: CounterHeapSpray
  23. UserAssist Windows 2000 Thru Windows 8
  24. InstalledPrograms.xls
  25. Nmap McAfee ePO Agent Script
  26. Entropy.1sc
  27. _nomap, _nomap, _nomap, …
  28. Update: vs.py Version 0.5
  29. Flame Authenticode Dumps (KB2718704)
  30. Flame: Before and After KB2718704
  31. Update: virustotal-search
  32. Searching With VirusTotal
  33. ExitProcess Shellcode
  34. Why Isn’t my PoC Launching calc.exe?
  35. Update: TaskManager.xls V0.1.3 Killer Shellcode
  36. InteractiveSieve
  37. Update: SE_ASLR Version 0.0.0.2
  38. Update: PDFid And pdf-parser
  39. NAFT Release
  40. Update: TaskManager.xls V0.1.2
  41. Teensy PDF Dropper Part 2
  42. Peeking at NAFT
  43. Article: White Hat Shellcode
  44. Quickpost: Disassociating the Key From a TrueCrypt System Disk
  45. x64 Windows Shellcode
  46. IOS: Let Me Truncate That Password For You…
  47. Analyzing IOS Core Dumps (SOPA-style)
  48. Identifying IOS
  49. Calculating a SSH Fingerprint From a (Cisco) Public Key

2011 50

  1. Happy New Router
  2. FORCE_INTEGRITY With DLLs
  3. LoadDLLViaAppInit with FORCE_INTEGRITY
  4. Signed TaskManager
  5. Hotfix For SRP/AppLocker Bypass
  6. White Hat Shellcode Workshop: Enforcing Permanent DEP
  7. Ariad 64-bit
  8. Using DLLCHARACTERISTICS’ FORCE_INTEGRITY Flag
  9. HeapLocker 64-bit
  10. RunInsideLimitedJob 64-bit
  11. LoadDLLViaAppInit 64-bit
  12. HeapLocker: Preventing Heapsprays
  13. Quickpost: Some Windows 8 Observations
  14. TaskManager Runs on 64-bit Excel
  15. Update: USBVirusScan 1.7.4
  16. The Matryoshka Router
  17. Add Bottom Up Randomization To (Your Own) Source Code
  18. simple-shellcode-generator.py
  19. Quickpost: create-remote-thread.py
  20. DEP Enforcing Shellcode
  21. Bottom Up Randomization Saves Mandatory ASLR
  22. Quickpost: CCTV Over UTP
  23. So How Good is Pseudo-ASLR?
  24. Force “ASLR” on Shell Extensions
  25. My Home Surveillance System: Some Details
  26. My Home Surveillance System
  27. Quickpost: Blocking and Detecting a Teensy Dropper
  28. Teensy PDF Dropper Part 1
  29. Integrating My CCTV DVR And Alarm System
  30. Quickpost: Need a PoC to Test Your Security Setup? Not Necessarily…
  31. EMET Article
  32. Update: vs.py
  33. Malicious PDF Analysis Workshop Screencasts
  34. Another PDF Puzzle
  35. BackTrack 5 Includes PDFiD and pdf-parser
  36. Suspender.dll
  37. Signed Spreadsheet with cmd.dll & regedit.dll
  38. LockIfNotHot
  39. Windows Security Center: Under the Hood
  40. HeapLocker: Null Page Allocation
  41. DumpStrings.1sc
  42. Update: TaskManager.xls Version 0.0.3
  43. HeapLocker: String Detection
  44. Update: WhoAmI? Version 0.1.5
  45. TaskManager.xls
  46. Circumventing SRP and AppLocker to Create a New Process, By Design
  47. Circumventing SRP and AppLocker, By Design
  48. Quickpost: Checking ASLR
  49. Quickpost: “It Does No Harm…” or Does It?
  50. HeapLocker: NOP Sled Detection

2010 48

  1. HeapLocker: Private Memory Usage Monitoring
  2. HeapLocker
  3. Runasil
  4. Quickpost: Adobe Reader X
  5. Password Auditing With a Password Filter
  6. EnforcePermanentDEP
  7. Quickpost: Adding Certificates to the Certificate Store
  8. Update: LoadDLLViaAppInit
  9. setdllcharacteristics
  10. PDF, DEP, ASLR and Integrity Levels
  11. LowerMyRights
  12. Free Malicious PDF Analysis E-book
  13. RunInsideLimitedJob
  14. Integrity Levels and DLL Injection
  15. PDFTemplate
  16. Quickpost: Ariad & DLL Preloading
  17. Quickpost: .LNK Template Update
  18. Quickpost: 2 .LNK Tools
  19. Mitigating .LNK Exploitation With SRP
  20. Mitigating .LNK Exploitation With Ariad
  21. The Hex Factor RE Challenge
  22. Quickpost: Preventing the /Launch Action “cmd.exe” Bypass
  23. Quickpost: No Escape From PDF
  24. Solving the Win7 Puzzle
  25. A Win7 Puzzle…
  26. Quickpost: More Malformed PDFs
  27. Writing WIN32 Shellcode With a C-compiler
  28. Update: PDFiD Version 0.0.11 to Detect /Launch
  29. .NET Shellcode
  30. Update: Escape From PDF
  31. “Escape From Foxit Reader”
  32. Escape From PDF
  33. Tweet Shellcode
  34. Frisky Solitaire – Another Info Stealer
  35. PDF Info Stealer PoC
  36. Quickpost: NetworkMashup.xls
  37. Ping Shellcode
  38. MemoryLoadLibrary: From C Program to Shellcode
  39. Excel with cmd.dll & regedit.dll
  40. cmd.dll
  41. Quickpost: Quasi-Tautologies & SQL-Injection
  42. Quickpost: Shellcode to Load a DLL From Memory
  43. Quickpost: PDF Header %!PS-Adobe-N.n PDF-M.m
  44. Update: XORSearch Version 1.6.0
  45. Quickpost: New Versions of PDFiD and pdf-parser
  46. Adobe Reader JavaScript Blacklist Framework
  47. New Format for UserAssist Registry Keys
  48. The Undeletable SafeBoot Key

2009 65

  1. Detecting EICAR With a .NET Micro-controller
  2. LoadDLLViaAppInit
  3. Quickpost: Read-Only USB Stick
  4. Quickpost: New EICARgen Version
  5. Quickpost: SelectMyParent or Playing With the Windows Process Tree
  6. Update: bpmtk with hook-createprocess.dll
  7. Quickpost: “Hiding” a PDF Document
  8. CVE-2009-2979 Or The XML-Bombed PDF
  9. A Windows 7 Launch Party Trick!
  10. Update: WhoAmI? Version 0.1.3
  11. Update: PDFiD Version 0.0.9 to Detect Another Adobe 0Day
  12. Preventing Applications From Starting (Malicious) Applications
  13. Quickpost: SAFER and Malicious Documents
  14. Preventing Malicious Documents from Compromising Windows Machines
  15. QuickPost: Arduino + Alcohol Gas Sensor + WiShield + LCD
  16. Link: case of the tweep abduction
  17. The Brucon WiFi Puzzle Solution
  18. Yubikey, Trojans and Twitter
  19. Quickpost: Ardubot Programming
  20. Update: Time Lapse Photography with a Nokia Mobile
  21. Update: UserAssist Tool Version 2.4.3
  22. Update: pdf-parser Version 0.3.5
  23. Update: PDFiD Version 0.0.8
  24. The Ultimate Disaster Recovery Plan
  25. Quickpost: More Picture-Taking with Python
  26. Quickpost: TrueCrypt’s Boot Loader Screen Options
  27. Patching PDF Readers to Support Hidden Embedded Files
  28. Embedding and Hiding Files in PDF Documents
  29. MessageBox Shellcode
  30. Quickpost: Time Lapse Photography With a Nokia Mobile
  31. bpmtk: Injecting VBScript
  32. Quickpost: Arduino XBee Shield Series 2 Configuration
  33. Quickpost: Make Your Own Corrupted PDFs For Free
  34. Update: Disitool V0.3
  35. Quickpost: PDF Security Tidbits
  36. Quickpost: Sending WiFi Beacon Frames with an AirPcap Adapter
  37. Download My Hakin9 Article “Anatomy of Malicious PDF Documents”
  38. Another Lowcost RFID Detector
  39. Malformed PDF Documents
  40. PDF Filter Abbreviations
  41. Quickpost: Disinformational Tweets
  42. A Very Brief History of Foxit Reader and JavaScript
  43. Shellcode 2 VBScript
  44. Quickpost: Using Your Poken as a Lowcost LF RFID Detector
  45. Quickpost: Disarming a PDF File
  46. Quickpost: Black Hat Europe 2009
  47. PDFiD On VirusTotal
  48. Update: XORSearch V1.4.0
  49. Pdfid
  50. Poken Peek
  51. 35 Year Old Puzzle
  52. Quickpost: /JBIG2Decode “Look Mommy, No Hands!”
  53. Quickpost: /JBIG2Decode Trigger Trio
  54. Quickpost: /JBIG2Decode Essentials
  55. Quickpost: /JBIG2Decode Signatures
  56. Shellcode On a MIFARE RFID Tag
  57. CommNet at TechEd Barcedlona 2008
  58. Quickpost: Vigenère Is Beta-Only
  59. Quickpost: Windows 7 Beta: ROT13 Replaced With Vigenère? Great Joke!
  60. Playing With Authenticode and MD5 Collisions
  61. A Hardware Tip for Fuzzing Embedded Devices
  62. Quickpost: Running BackTrack 3 on a Eee PC
  63. Howto: Add a Digital Signature to an Office Document
  64. Howto: Add a Digital Signature to a PDF File
  65. Howto: Add a Digital Signature to a Firefox Add-on

2008 89

  1. Howto: Add a Digital Signature to Executables
  2. Howto: Make Your Own Cert With OpenSSL
  3. Identifying Garbage Men
  4. Updates: bpmtk and Hakin9; PDF and Metasploit
  5. @TweetXmasTree
  6. Quickpost: Citibank Phishing E-mails
  7. Update: Restoring Safe Mode with a .REG file, and a Live CD
  8. Quickpost: WiFi Availability
  9. My ISSA / OWASP Talk “Risky PDF”
  10. Shoulder Surfing a Malicious PDF Author
  11. Creating PDF Test-Files
  12. Picture Puzzle
  13. Quickpost: Remember FireOx?
  14. Quickpost: “An Old IE Trick” Revisited
  15. Quickpost: Fingerprinting PDF Files
  16. pdf-parser.py
  17. Excel Exercises in Style
  18. The Case of the Corrupted Stream Object
  19. Analyzing a Malicious PDF File
  20. Quickpost: Another E-card Malware Spam Campaign
  21. Forensic Time Dilatation
  22. Secret Question, Public Answer
  23. Quickpost: SQL Server 2005 Management Studio and Password Management
  24. Quickpost: Stored User Names and Passwords
  25. Dismantling an XML-Bomb
  26. CALL -151
  27. Quickpost: WiFi Antenna With 360° Servo
  28. Authenticode Challenge – Solution Part 1
  29. Second YAISC cartoon
  30. Yaisc
  31. Mister P and Q’s Excellent Solution
  32. Pocket Virus Lab
  33. Quickpost: PyroMenagerie
  34. wsrradial
  35. One More Little Puzzle
  36. Removing Malware With a Live CD
  37. A Third SpiderMonkey Trick
  38. Fake MSNBC Breaking News or Fake CNN Custom Alert? Make Up Your Mind!
  39. Gmail Warns Against Fake CNN Alerts
  40. Sampling a Malicious Site
  41. Fake CNN Custom Alert
  42. Update: USBVirusScan 1.7.2
  43. How Is My Hacking? (.com)
  44. Update: wsrtool
  45. wsrtool
  46. F-Secure Reverse Engineering Challenge 2008
  47. Authenticode Challenge
  48. A New Version of WhoAmI? and Another Little Puzzle
  49. Infectee or Infector?
  50. A Second Little Poll
  51. More Fireworks
  52. A Little Poll
  53. 4th of July, Business as Usual
  54. bpmtk: A New Version With bpmtk.dll Included
  55. bpmtk: Bypassing SRP with DLL Restrictions
  56. Quickpost: WiFi Probe Request Logging with an AirPcap Adapter
  57. Quickpost: WiFi Channel Hopping with an AirPcap Adapter
  58. Quickpost: Embedding an Executable in a VBscript
  59. bpmtk: How About SRP Whitelists?
  60. Quickpost: Installing Aircrack-ng on a N800
  61. Quickpost: bpmtk Config File Embedding
  62. I Still Use Foxit Reader
  63. Quickpost: Restricted Tokens and UAC
  64. Quickpost: eicar.pdf
  65. PDF Stream Objects
  66. Solving a Little PDF Puzzle
  67. A Little PDF Puzzle
  68. PDF, Let Me Count the Ways…
  69. “Only X Out of 32 Antivirus Products Detect This!”
  70. Taking the GSSP-C Exam
  71. Quickpost: Linux Kernel Joke
  72. Update: Disitool V0.2
  73. Quickpost: About the Physical and Logical Structure of PDF Files
  74. Quickpost: Back from Black Hat Europe 2008
  75. Carnival of the Security Catalyst Community 2008/04/08
  76. <!– Hiding Inside Wikipedia –>
  77. bpmtk: Spying on IE
  78. bpmtk: DisableAMD
  79. bpmtk: Replacing Gpdisable
  80. Introducing the Basic Process Manipulation Tool Kit
  81. CASToggle and The Polymorphic Podcast
  82. Fine-Grained Control over Code Access Security
  83. Hiding Inside a Rainbow, Part 3
  84. Update: A Windows Live CD plugin for my UserAssist utility
  85. Quickpost: The Digital Signature of a Cryptographic Service Provider
  86. XORSearch V1.3.0
  87. Quickpost: GUI vs. CUI
  88. The Case of the Missing Digital Signatures Tab
  89. Quickpost: Windows Server 2008 UserAssist Keys

2007 70

  1. How Can I Trust the BeID Runtime?
  2. Building the Pocket EICAR Test File Server
  3. Quickpost: Retrieving an SSL Certificate
  4. Pocket EICAR Test File Server
  5. Quickpost: Restoring Safe Mode with a .REG File for Windows 2000 SP4 Professional
  6. Looking for N800 Beta Testers, No Voyeurs Please ;-)
  7. Quickpost: DisableAMD & DisableRegistryFools
  8. Update: UserAssist V2.4.2
  9. Quickpost: Another Funny Vista Trick with ASLR
  10. The Sony Rootkit V2.0
  11. Quickpost: Checking Gmail on N800 Securely
  12. Update: USBVirusScan 1.6.1
  13. Quickpost: Scanning Scripts
  14. Quickpost: Installing Kismet on a N800
  15. Announcing Quickposts
  16. Warclimbing
  17. A000n0000 0000O000l00d00 0I000E000 00T0r0000i0000c000k
  18. Pwned @ hack.lu?
  19. UserAssist V2.4.1
  20. WhoAmI? Firefox Extension
  21. AutoIt Malware Revisited
  22. Update: Disabling UserAssist Logging for Windows Vista
  23. Reversing ROL-1 Malware
  24. Disabling UserAssist Logging for Windows Vista
  25. The New Windows Vista, Now With Less Spying! ;-)
  26. Analyzing a Suspect WMF File
  27. Twiddling Bits
  28. XORSearch V1.2.0: XOR & ROL
  29. A Second SpiderMonkey Trick
  30. F-Secure Reverse Engineering Challenge 2007
  31. YACoSTO, One Year Ago
  32. Yes, It Will Be Late In Brussels Again…
  33. Rsr
  34. CyberSpeak interview
  35. UserAssist V2.3.0
  36. Will it be late in Brussels again?
  37. ExtractScripts Update
  38. The BlockSite Firefox Add-on
  39. ExtractScripts
  40. UserAssist Q&A
  41. Some e-voting observations
  42. OMG, My N800 is Infected!
  43. Find Madeleine
  44. Hiding Inside a Rainbow, Part 2
  45. Click Fraud
  46. Game Over!
  47. 1C0D49A102278EBA2CB2D1A4497810A6
  48. “Is your PC virus-free? Get it infected here!”
  49. Hiding Inside a Rainbow
  50. USBVirusScan V1.5.0
  51. How did you get your start?
  52. About the strategy I followed during my CISSP exam
  53. And This Time, The Vector Is… The Animated Cursor, Again
  54. Digital Self Defence
  55. Good Bye Security Monkey!
  56. Playing with Safe Mode
  57. Update: P0wned by a QT movie
  58. P0wned by a QT movie
  59. No Microsoft Security Bulletins for March 2007
  60. USBVirusScan v1.4.0
  61. How I prepared my CISSP exam
  62. Restoring Safe Mode with a .REG file
  63. UserAssist article published in (IN)SECURE Magazine
  64. Reverse Engineering Mentoring
  65. ZIPEncryptFTP
  66. A running light with a PIN
  67. XORSearch V1.1.0
  68. Listening to security podcasts earns (ISC)² CPE credits
  69. FileGen
  70. USBVirusScan v1.3.0

2006 49

  1. Another postcard…
  2. Brute Forcing Enigma
  3. Teaching a SpiderMonkey a new trick
  4. My Virus lab part 1: downloading a malicious file
  5. USBVirusScan v1.2.0
  6. Customized Anti-Virus alert messages
  7. Sinterklaas kapoentje, leg wat in mijn schoentje…
  8. Mitigating Risk
  9. USBVirusScan v1.1.0
  10. EICARgen
  11. OllyStepNSearch v0.6.1
  12. Update 3: Google and the Drive-by Download
  13. Fireox
  14. Challenger
  15. OllyStepNSearch v0.6.0
  16. Wardriving on the Eurostar
  17. Spamdexing “R” Us
  18. USBVirusScan
  19. Update 2: Google and the Drive-by Download
  20. Update: Google and the Drive-by Download
  21. Google and the Drive-by Download
  22. Reversing an anonymous proxy
  23. PiXiE Dust Bug fix
  24. PiXiE dust
  25. A Windows Live CD plugin for my UserAssist utility
  26. UserAssist on Windows Vista
  27. Malicious Cryptography
  28. Playing with utilman.exe, The Motion Picture
  29. My second playdate with utilman.exe
  30. Metasploit MS06-040 Demo
  31. Hiding the password
  32. Playing with utilman.exe
  33. Binary Tools
  34. Cleaning up after an infection, and then?
  35. Khallenge: hints for solving level 2
  36. Khallenge: solution for level 3 posted
  37. Khallenge results
  38. It’s late in Brussels…
  39. Update: UserAssist utility
  40. YACoSTO
  41. ROT13 is used in Windows? You’re joking!
  42. Do you have Mailslots on your Windows PC?
  43. Update: Restoring Safeboot
  44. Update: Viewing strings in executables
  45. Viewing strings in executables
  46. Restoring Safeboot
  47. Save Safeboot?
  48. A Ring Tone That I Cannot Hear
  49. Boot