logo
|
Blog
  • Vulnerability Research
  • AI for Security
  • Security for AI
  • Web2
  • 🌐

Theori BLOG

Empowering Innovation with Security
Explore expert insights into offensive security and threat intelligence.
See AllAI for SecuritySecurity for AIVulnerability ResearchWeb2 SecurityAIxCC
How to Identify Phishing Scams

How to Identify Phishing Scams

Learn how to spot phishing scams with expert tips recognizing suspicious emails, SMS, and fraudulent request for personal information.
Frontier Squad's avatar
Apr 28, 2025
Vulnerability Research
Reviving the modprobe_path Technique: Overcoming search_binary_handler() Patch

Reviving the modprobe_path Technique: Overcoming search_binary_handler() Patch

A new approach to the Overwriting modprobe_path technique is introduced, addressing changes in the Upstream kernel that prevent triggering via dummy files.
Frontier Squad's avatar
Mar 15, 2025
Vulnerability Research
Finding Vulnerabilities in Firmware with Static Analysis Platform QueryX

Finding Vulnerabilities in Firmware with Static Analysis Platform QueryX

QueryX, Theori’s program analysis platform, automates variant analysis for vulnerability detection. Learn how its taint analysis module uncovered CVE-2023-39471.
Frontier Squad's avatar
Nov 06, 2024
Vulnerability Research
Deep Dive into RCU Race Condition: Analysis of TCP-AO UAF (CVE-2024–27394)

Deep Dive into RCU Race Condition: Analysis of TCP-AO UAF (CVE-2024–27394)

CVE-2024-27394 is a TCP-AO Use-After-Free vulnerability caused by improper RCU API usage. Read the in-depth analysis and reliable triggering technique.
Frontier Squad's avatar
Sep 03, 2024
Vulnerability Research
Chaining N-days to Compromise All: Part 6 — Windows Kernel LPE: Get SYSTEM

Chaining N-days to Compromise All: Part 6 — Windows Kernel LPE: Get SYSTEM

The final part of the N-day exploit series analyzes CVE-2023-36802, a privilege escalation vulnerability in mskssrv.sys, used to gain SYSTEM access on a VMware host.
Frontier Squad's avatar
May 21, 2024
Vulnerability Research
How to Identify Phishing Scams

How to Identify Phishing Scams

Learn how to spot phishing scams with expert tips recognizing suspicious emails, SMS, and fraudulent request for personal information.
Frontier Squad's avatar
Apr 28, 2025
Vulnerability Research
Reviving the modprobe_path Technique: Overcoming search_binary_handler() Patch

Reviving the modprobe_path Technique: Overcoming search_binary_handler() Patch

A new approach to the Overwriting modprobe_path technique is introduced, addressing changes in the Upstream kernel that prevent triggering via dummy files.
Frontier Squad's avatar
Mar 15, 2025
Vulnerability Research
Finding Vulnerabilities in Firmware with Static Analysis Platform QueryX

Finding Vulnerabilities in Firmware with Static Analysis Platform QueryX

QueryX, Theori’s program analysis platform, automates variant analysis for vulnerability detection. Learn how its taint analysis module uncovered CVE-2023-39471.
Frontier Squad's avatar
Nov 06, 2024
Vulnerability Research
Deep Dive into RCU Race Condition: Analysis of TCP-AO UAF (CVE-2024–27394)

Deep Dive into RCU Race Condition: Analysis of TCP-AO UAF (CVE-2024–27394)

CVE-2024-27394 is a TCP-AO Use-After-Free vulnerability caused by improper RCU API usage. Read the in-depth analysis and reliable triggering technique.
Frontier Squad's avatar
Sep 03, 2024
Vulnerability Research
Chaining N-days to Compromise All: Part 6 — Windows Kernel LPE: Get SYSTEM

Chaining N-days to Compromise All: Part 6 — Windows Kernel LPE: Get SYSTEM

The final part of the N-day exploit series analyzes CVE-2023-36802, a privilege escalation vulnerability in mskssrv.sys, used to gain SYSTEM access on a VMware host.
Frontier Squad's avatar
May 21, 2024
Vulnerability Research
Chaining N-days to Compromise All: Part 5 — VMware Workstation Guest-to-Host Escape

Chaining N-days to Compromise All: Part 5 — VMware Workstation Guest-to-Host Escape

CVE-2023-20869 was exploited to achieve arbitrary code execution on a VMware host from a guest system. Read the full technical analysis.
Frontier Squad's avatar
May 02, 2024
Vulnerability Research
Chaining N-days to Compromise All: Part 4 — VMware Workstation Information leakage

Chaining N-days to Compromise All: Part 4 — VMware Workstation Information leakage

CVE-2023-34044, a variant of CVE-2023-20870, was exploited to extract critical information from a VMware host process. Read the in-depth analysis.
Frontier Squad's avatar
Apr 17, 2024
Vulnerability Research
Chaining N-days to Compromise All: Part 3 — Windows Driver LPE: Medium to System

Chaining N-days to Compromise All: Part 3 — Windows Driver LPE: Medium to System

CVE-2023-29360, a logic bug in the mskssrv.sys driver, was exploited to escalate privileges to SYSTEM in a 1-day full chain attack. Read the detailed breakdown.
Frontier Squad's avatar
Apr 08, 2024
Vulnerability Research
Chaining N-days to Compromise All: Part 2 — Windows Kernel LPE (a.k.a Chrome Sandbox Escape)

Chaining N-days to Compromise All: Part 2 — Windows Kernel LPE (a.k.a Chrome Sandbox Escape)

CVE-2023-21674, a Windows kernel UAF vulnerability, was used to escape the Chrome sandbox in a 1-day full chain exploit. Read the detailed analysis.
Frontier Squad's avatar
Mar 31, 2024
Vulnerability Research
Chaining N-days to Compromise All: Part 1 — Chrome Renderer RCE

Chaining N-days to Compromise All: Part 1 — Chrome Renderer RCE

This post begins our series on the 1-day exploit chain demoed on X, focusing on a Chrome renderer exploit, CVE-2023-3079, a type confusion bug in V8.
Frontier Squad's avatar
Mar 17, 2024
Vulnerability Research
Fermium-252 : The Cyber Threat Intelligence Database

Fermium-252 : The Cyber Threat Intelligence Database

Fermium-252 is a premier vulnerability intelligence platform providing real-time tracking of 1-day exploits, PoCs, and in-depth reports. Stay ahead of cyber threats with our expert analysis.
Frontier Squad's avatar
Mar 03, 2024
Vulnerability Research
A Deep Dive into V8 Sandbox Escape Technique Used in In-The-Wild Exploit

A Deep Dive into V8 Sandbox Escape Technique Used in In-The-Wild Exploit

We bypassed the V8 sandbox using a raw pointer in WasmIndirectFunctionTable, enabling arbitrary write and code execution. Read our deep dive into the exploit.
Frontier Squad's avatar
Jan 25, 2024
Vulnerability Research
Exploiting Windows Kernel Wild Copy With User Fault Handling (CVE-2023–28218)

Exploiting Windows Kernel Wild Copy With User Fault Handling (CVE-2023–28218)

At Hexacon 2023, we presented our Windows kernel security research, uncovering CVE-2023-28218, a heap overflow in afd.sys. Read our exploit analysis and methodology.
Frontier Squad's avatar
Nov 09, 2023
Vulnerability Research
NEAT and NES Algorithms

NEAT and NES Algorithms

We reverse-engineered NEAT and NES, two unpublished symmetric encryption algorithms from South Korea’s GPKI cryptography library. Read our analysis and implementations.
Frontier Squad's avatar
Apr 20, 2023
Vulnerability Research
Linux Kernel Exploit (CVE-2022–32250) with mqueue

Linux Kernel Exploit (CVE-2022–32250) with mqueue

We exploited CVE-2022-32250, a use-after-free vulnerability in Linux Netfilter, to achieve root on Ubuntu 22.04. Learn how we bypassed KASLR and modified modprobe_path.
Frontier Squad's avatar
Aug 23, 2022
Vulnerability Research
Binary-searching into CVMServer

Binary-searching into CVMServer

While analyzing the patch for CVE-2021-30724, we discovered a new uninitialized memory vulnerability (CVE-2022-26721) in macOS's CVMServer. Read our exploitation insights.
Frontier Squad's avatar
Jun 16, 2022
Vulnerability Research
Exploiting Safari’s ANGLE Component

Exploiting Safari’s ANGLE Component

We discovered CVE-2022-26717, an exploitable bug in WebKit's WebGL component affecting Safari on macOS and iOS. Read our analysis and exploitation methodology.
Frontier Squad's avatar
May 17, 2022
Vulnerability Research
Patch Gapping a Safari Type Confusion

Patch Gapping a Safari Type Confusion

Safari 14.1 introduced AudioWorklets, but a newly patched type confusion bug left iOS versions vulnerable for weeks. We share our root cause analysis and exploit details.
Frontier Squad's avatar
May 24, 2021
Vulnerability Research
Compromising virtualization without attacking the hypervisor

Compromising virtualization without attacking the hypervisor

Discover CVE-2020-27675 (XSA-331), a denial-of-service and potential out-of-bounds write vulnerability in the Xen paravirtualization driver, and learn how it can impact virtualization security.
Frontier Squad's avatar
Oct 20, 2020
Vulnerability Research
Cleanly Escaping the Chrome Sandbox

Cleanly Escaping the Chrome Sandbox

Learn how we discovered and exploited Issue 1062091, a use-after-free (UAF) vulnerability in Chrome and Chromium-based Edge, leading to a sandbox escape.
Frontier Squad's avatar
Apr 19, 2020
Vulnerability Research
Receiving NRSC-5

Receiving NRSC-5

We have implemented an NRSC-5-C digital radio receiver and released it as open source on GitHub. Explore IBOC-based hybrid broadcasting and security research opportunities.
Frontier Squad's avatar
Jun 08, 2017
Vulnerability Research
Chakra JIT CFG Bypass

Chakra JIT CFG Bypass

Learn how attackers bypassed Microsoft's Control Flow Guard (CFG) in Internet Explorer and Edge. We break down our PoC exploit, mitigation bypass, and the MS16-119 patch details.
Frontier Squad's avatar
Dec 13, 2016
Vulnerability Research
Patch Analysis of MS16–063 (jscript9.dll)

Patch Analysis of MS16–063 (jscript9.dll)

Microsoft's MS16-063 patch fixed a critical memory corruption vulnerability in jscript9.dll (TypedArray & DataView) affecting Internet Explorer. Read our analysis, vulnerability breakdown, and PoC exploit.
Frontier Squad's avatar
Jun 26, 2016
Vulnerability Research
Patch Analysis of CVE-2016–0189

Patch Analysis of CVE-2016–0189

Microsoft's MS16-051 patch addressed a critical Internet Explorer vulnerability (CVE-2016-0189) exploited in South Korea. Explore our in-depth analysis, patch breakdown, and proof-of-concept exploit.
Frontier Squad's avatar
Jun 21, 2016
Vulnerability Research

Theori © 2025 All rights reserved.

RSS·Powered by Inblog