Introduction In this blog I present two vulnerabilities I found in the Azure Functions and another very interesting case of a padding oracle, available as an undocumented HTTP endpoint on every Function instance. Initially I was ecstatic about this finding as theoretically it would have allowed me to achieve remote code…

For more than 2 years, Blockfolio was vulnerable to any attacker stealing their source code and perhaps even injecting his own code into their repositories. This is a quick write-up about how I was able to find a Github token to Blockfolio. Blockfolio is the most popular Cryptocurrency price tracking…

Welcome to a tutorial on building your first LLVM based obfuscator! In this post we will briefly present LLVM, discuss popular obfuscation approaches and their shortcomings and build our own epic LLVM-based string obfuscator. All the code I present in this article is also available in Github. LLVM LLVM is…