ege
@ege.sh
Malware enthusiast. Security Researcher. Reverse Engineer. Exploit developper. Threat Intel @PRODAFT FPV drone pilot 🚁
https://twitter.com/egeblc
https://ege.sh
@ege@infosec.exchange
https://twitter.com/egeblc
https://ege.sh
@ege@infosec.exchange
As a fun little weekend project, I have weaponized OpenReplay for exploiting XSS on "HttpOnly" websites. It allows you to remotely control a victim's browser without the need for stealing any cookies.
github.com/EgeBalci/evi...
github.com/EgeBalci/evi...
GitHub - EgeBalci/evilreplay: Seamless remote browser session control
Seamless remote browser session control. Contribute to EgeBalci/evilreplay development by creating an account on GitHub.
github.com
July 8, 2025 at 4:07 PM
As a fun little weekend project, I have weaponized OpenReplay for exploiting XSS on "HttpOnly" websites. It allows you to remotely control a victim's browser without the need for stealing any cookies.
github.com/EgeBalci/evi...
github.com/EgeBalci/evi...
Heading to London next week for Infosecurity Europe (3-5 June). If you're around and fancy grabbing a coffee or a beer after the exhibit, hit me up.
May 26, 2025 at 12:04 PM
Heading to London next week for Infosecurity Europe (3-5 June). If you're around and fancy grabbing a coffee or a beer after the exhibit, hit me up.
Wrote a linker patch for mangling pclntab and removing build info from Golang binaries 🙃
github.com/EgeBalci/go/...
github.com/EgeBalci/go/...
GitHub - EgeBalci/go at release-branch.go1.24-opsec
The Go programming language. Contribute to EgeBalci/go development by creating an account on GitHub.
github.com
May 23, 2025 at 3:33 PM
Wrote a linker patch for mangling pclntab and removing build info from Golang binaries 🙃
github.com/EgeBalci/go/...
github.com/EgeBalci/go/...
Reposted by ege
An unidentified individual has leaked the internal chats of the BlackBasta ransomware group
x.com/PRODAFT/stat...
x.com/PRODAFT/stat...
February 20, 2025 at 4:11 PM
An unidentified individual has leaked the internal chats of the BlackBasta ransomware group
x.com/PRODAFT/stat...
x.com/PRODAFT/stat...
Finally finished #flareon11 🥲 Lost a lot of time AND SANITY on question 9. Learned a lot and had fun as always.
October 15, 2024 at 4:23 PM
Finally finished #flareon11 🥲 Lost a lot of time AND SANITY on question 9. Learned a lot and had fun as always.
Phrack #71 is ONLINE! 🔥🔥
This is literally a dream come true. My article “Evasion by De-Optimization” got accepted into PHRACK 71! It is such an honor to be considered. I still can’t wrap my head around the fact that my work has been published among the legends.
phrack.org/issues/71/1....
This is literally a dream come true. My article “Evasion by De-Optimization” got accepted into PHRACK 71! It is such an honor to be considered. I still can’t wrap my head around the fact that my work has been published among the legends.
phrack.org/issues/71/1....
.:: Phrack Magazine ::.
Phrack staff website.
phrack.org
August 20, 2024 at 9:13 AM
Phrack #71 is ONLINE! 🔥🔥
This is literally a dream come true. My article “Evasion by De-Optimization” got accepted into PHRACK 71! It is such an honor to be considered. I still can’t wrap my head around the fact that my work has been published among the legends.
phrack.org/issues/71/1....
This is literally a dream come true. My article “Evasion by De-Optimization” got accepted into PHRACK 71! It is such an honor to be considered. I still can’t wrap my head around the fact that my work has been published among the legends.
phrack.org/issues/71/1....
The new version is out 🎉 Version v0.1.2 is capable of simple control flow tracing. Now, it can find possible code paths and automatically skip dead offsets.
github.com/EgeBalci/deo...
github.com/EgeBalci/deo...
GitHub - EgeBalci/deoptimizer: Evasion by machine code de-optimization.
Evasion by machine code de-optimization. Contribute to EgeBalci/deoptimizer development by creating an account on GitHub.
github.com
July 23, 2024 at 12:10 PM
The new version is out 🎉 Version v0.1.2 is capable of simple control flow tracing. Now, it can find possible code paths and automatically skip dead offsets.
github.com/EgeBalci/deo...
github.com/EgeBalci/deo...
I built myself a couple of #Meshtastic nodes 😊 I got up to 22km of range with a 443 MHz Heltec V3. Hit me up if you're near. Node names: FAP1, FAP2 (MQTT enabled).
July 6, 2024 at 2:58 PM
I built myself a couple of #Meshtastic nodes 😊 I got up to 22km of range with a 443 MHz Heltec V3. Hit me up if you're near. Node names: FAP1, FAP2 (MQTT enabled).
New tool drop! 🔥🔥 de-optimizer uses several mathematical approaches for mutating machine code instructions to their functional equivalents. Very good for bypassing rule-based detection without using any RWE memory. github.com/EgeBalci/deo...
GitHub - EgeBalci/deoptimizer: Machine code de-optimizer.
Machine code de-optimizer. . Contribute to EgeBalci/deoptimizer development by creating an account on GitHub.
github.com
July 1, 2024 at 8:51 AM
New tool drop! 🔥🔥 de-optimizer uses several mathematical approaches for mutating machine code instructions to their functional equivalents. Very good for bypassing rule-based detection without using any RWE memory. github.com/EgeBalci/deo...
Attention to all AV evasion enthusiasts! 🚨🚨 I'll be talking about how to bypass security products by de-optimizing x86 binaries at Insomni'hack. See you all at Lausanne 👋 #INSO24 www.insomnihack.ch/talks-2024/?...
Talks 2024 - Insomni'hack
www.insomnihack.ch
March 21, 2024 at 12:35 PM
Attention to all AV evasion enthusiasts! 🚨🚨 I'll be talking about how to bypass security products by de-optimizing x86 binaries at Insomni'hack. See you all at Lausanne 👋 #INSO24 www.insomnihack.ch/talks-2024/?...
SGN v2.0.1 is out! 🔥🎊🎉 Here are the changelogs:
- Register value preserving (-safe option) related bug fixes
- Random register selection bug fixed
- Better argument parsing
- Major code refactoring
github.com/EgeBalci/sgn...
- Register value preserving (-safe option) related bug fixes
- Random register selection bug fixed
- Better argument parsing
- Major code refactoring
github.com/EgeBalci/sgn...
Release v2.0.1 · EgeBalci/sgn
WarningDue to some difficulties of compiling keystone library, only Linux (amd64) binary is statically linked. Other release binaries still require keystone dynamic libraries on the system.
Cha...
github.com
December 19, 2023 at 6:15 PM
SGN v2.0.1 is out! 🔥🎊🎉 Here are the changelogs:
- Register value preserving (-safe option) related bug fixes
- Random register selection bug fixed
- Better argument parsing
- Major code refactoring
github.com/EgeBalci/sgn...
- Register value preserving (-safe option) related bug fixes
- Random register selection bug fixed
- Better argument parsing
- Major code refactoring
github.com/EgeBalci/sgn...
Some TAs are using Github issues to target repo owners with crypto scams. Github notification mails are guaranteed to reach your inbox, bypassing any spam filters and security products. The content of the scam is very basic, but I can give points for creativity for sure :)
November 16, 2023 at 12:02 PM
Some TAs are using Github issues to target repo owners with crypto scams. Github notification mails are guaranteed to reach your inbox, bypassing any spam filters and security products. The content of the scam is very basic, but I can give points for creativity for sure :)
QSocket v0.0.6-beta released 🔥🎊🎉
- New websocket based knock protocol
- QSRN moved behind Cloudflare CDN
- Multi session support
- Better traffic forwarding capabilities
- Terminal QR code generation on deploy
github.com/qsocket/qs-n...
- New websocket based knock protocol
- QSRN moved behind Cloudflare CDN
- Multi session support
- Better traffic forwarding capabilities
- Terminal QR code generation on deploy
github.com/qsocket/qs-n...
GitHub - qsocket/qs-netcat
Contribute to qsocket/qs-netcat development by creating an account on GitHub.
github.com
November 12, 2023 at 6:19 PM
QSocket v0.0.6-beta released 🔥🎊🎉
- New websocket based knock protocol
- QSRN moved behind Cloudflare CDN
- Multi session support
- Better traffic forwarding capabilities
- Terminal QR code generation on deploy
github.com/qsocket/qs-n...
- New websocket based knock protocol
- QSRN moved behind Cloudflare CDN
- Multi session support
- Better traffic forwarding capabilities
- Terminal QR code generation on deploy
github.com/qsocket/qs-n...
Finished #flareon10 in 69th place this year. 🎉🎉 It was definitely the hardest year. I had so much fun and agony at the same time. Next year's goal is to top 30.
October 20, 2023 at 10:00 AM
Finished #flareon10 in 69th place this year. 🎉🎉 It was definitely the hardest year. I had so much fun and agony at the same time. Next year's goal is to top 30.
Dibs on CVE-2023-32560 🔥 I have added the Ivanti Avalanche MDM buffer overflow (DEP bypass) exploit this week. 🎉🎉 I'll take a break from writing N-days until the end of Flareon. www.rapid7.com/blog/post/20...
Metasploit Weekly Wrap-Up | Rapid7 Blog
www.rapid7.com
September 22, 2023 at 6:29 PM
Dibs on CVE-2023-32560 🔥 I have added the Ivanti Avalanche MDM buffer overflow (DEP bypass) exploit this week. 🎉🎉 I'll take a break from writing N-days until the end of Flareon. www.rapid7.com/blog/post/20...
Added two more ZDI exploits this week 🎉🎉 VMware vRealize Log Insight RCE module was very interesting, it chains together tree vulnerabilities for code execution.
www.rapid7.com/blog/post/20...
www.rapid7.com/blog/post/20...
Metasploit Weekly Wrap-Up | Rapid7 Blog
www.rapid7.com
September 15, 2023 at 8:05 PM
Added two more ZDI exploits this week 🎉🎉 VMware vRealize Log Insight RCE module was very interesting, it chains together tree vulnerabilities for code execution.
www.rapid7.com/blog/post/20...
www.rapid7.com/blog/post/20...
I was reading the PoC for the CVE-2023-37903 NodeJS sandbox escape, and I remembered that box-js was also using vm2 for emulation. Escape is looking very easy; I suggest you don't use emulation on analysis until the update. ¯\_(ツ)_/¯ gist.github.com/leesh3288/e4...
Sandbox Escape in vm2@3.9.19 via custom inspect function
Sandbox Escape in vm2@3.9.19 via custom inspect function - vm2_3.9.19_sandbox_escape_2.md
gist.github.com
September 10, 2023 at 11:25 AM
I was reading the PoC for the CVE-2023-37903 NodeJS sandbox escape, and I remembered that box-js was also using vm2 for emulation. Escape is looking very easy; I suggest you don't use emulation on analysis until the update. ¯\_(ツ)_/¯ gist.github.com/leesh3288/e4...
I’ve realized that I’m having much more fun writing N-day exploits than doing vuln research. It takes MUCH LESS time and equally sharpens your skills, maybe even more. Writing N-days with just a brief CVE description is very much like solving a CTF challenge.
September 8, 2023 at 8:16 PM
I’ve realized that I’m having much more fun writing N-day exploits than doing vuln research. It takes MUCH LESS time and equally sharpens your skills, maybe even more. Writing N-days with just a brief CVE description is very much like solving a CTF challenge.
Added another ZDI exploit this week, more on the way 🎉 www.rapid7.com/blog/post/20...
Metasploit Weekly Wrap-Up | Rapid7 Blog
www.rapid7.com
September 1, 2023 at 4:38 PM
Added another ZDI exploit this week, more on the way 🎉 www.rapid7.com/blog/post/20...
+2 this week. Lets goo! 🔥🔥🔥
https://www.rapid7.com/blog/post/2023/08/18/metasploit-weekly-wrap-up-23/
https://www.rapid7.com/blog/post/2023/08/18/metasploit-weekly-wrap-up-23/
Metasploit Weekly Wrap-Up | Rapid7 Blog
www.rapid7.com
August 18, 2023 at 7:46 PM
+2 this week. Lets goo! 🔥🔥🔥
https://www.rapid7.com/blog/post/2023/08/18/metasploit-weekly-wrap-up-23/
https://www.rapid7.com/blog/post/2023/08/18/metasploit-weekly-wrap-up-23/
