PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

postMessage targetOrigin bypass via IP normalization

lab.ctbb.show | research | #red-team | #defense | #security | #edr | #detection-bypass
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

# postMessage targetOrigin bypass via IP normalization ~/authors/avlidienbrunn - profile avlidienbrunn * * * ­Mathias Karlsson Jul 06, 2026 The second argument to `postMessage` controls which...
Published
Collected

Related coverage

research · github.com
RPISEC: Malware Analysis Course Materials, Labs, and Projects (CSCI 4976)
Regarded as one of the best structured open-source university curriculums for practical reverse engineering and malware analysis, bridging the gap from fundamentals to kernel rootkits.
tool · github.com
Brotli Client Checker: Test Server for Brotli Decoder Vulnerability (CVE-2026-111497)
Provides security teams and developers with a simple, zero-dependency mechanism to test whether backend microservices, crawlers, and HTTP clients are susceptible to the widespread Node2Shell/HTTP2Shell Brotli decoder flaw.
tool · github.com
node2shell-scanner: High-Fidelity Remote Detection Tool for Node.js Brotli OOB Write (CVE-2026-111497)
Provides defenders and security teams with a safe, non-destructive, and high-fidelity method to scan large attack surfaces and confirm Node.js exposure to the critical Brotli decoder flaw.
tool · github.com
Assetnote Releases php2shell-scanner: High-Fidelity Scanner for CVE-2026-109618 & CVE-2026-109619
As php2shell affects widespread PHP installations globally, this production-grade scanning logic enables enterprise security teams and defenders to reliably audit attack surfaces without relying on destructive exploit payloads.
tool · github.com
KillerLand: Weaponized BYOVD Process Killer Collection Bypassing PPL & EDR Protections
Demonstrates how untrusted kernel IOCTL interfaces in signed OEM and vendor drivers continue to undermine Windows PPL security boundaries, enabling red teams to blind modern endpoint detection.
research · blog.trailofbits.com
ETW internals for security research and forensics
Trail of Bits explains ETW internals — providers, consumers, and secure channels feeding EDR telemetry — and why attackers target ETW to bypass Windows detection and forensics.
Back