csandker.io

Popular pages

• Offensive Windows IPC Internals 2: RPC · csandker.io

  Remote Procedure Calls (RPC) is a technology to enable data communication between a client and a server across process and machine boundaries (network communication). Therefore RPC is an Inter Process...

• Offensive Windows IPC Internals 3: ALPC · csandker.io

  After talking about two inter-process communication (IPC) protocols that can be uses remotely as well as locally, namely Named Pipes and RPC, with ALPC we're now looking at a technology that can only ...

• A Beginner's Guide to Windows Shellcode Execution Techniques · csandker.io

  This blog post is aimed to cover basic techniques of how to execute shellcode within the memory space of a process. The background idea for this post is simple: New techniques to achieve stealthy code...

• Debugging and Reversing ALPC · csandker.io

  This post is an addendum to my journey to discover and verify the internals of ALPC, which I've documented in Offensive Windows IPC Internals 3: ALPC. While preparing this blog I figured a second post...

• Offensive Windows IPC Internals 1: Named Pipes · csandker.io

  Although the name might sound a bit odd Pipes are very basic and simple technology to enable communication and share data between two processes, where the term pipe simply describes ...

• A Windows Authorization Guide · csandker.io

  Compared to Linux, the Window's authorization process is quite complex and quite a few actors and objects are involved in this process. As a result, there a lot of terms and acronyms that must be know...