Overview
Connections
News
Salaries
Products
People
Growth
Offices
Financials
News
Hijacking a Python upload server: writeup from Insomni'hack CTF 2025
This blog post is a write up of an "Upload Server" challenge where we had to hack a simple server written in Python and steal a secret file (flag) from it. The task is from the Insomni'hack CTF 2025 competition that I played with my team, justCatTheFish i
Read more
Report
When NULL isn't null: mapping memory at 0x0 on Linux
When we think of a null pointer, NULL in C or nullptr in C++, we typically assume it is "invalid" or "not pointing to a valid memory location". But what if I tell you that a null pointer can actually point to valid memory under certain conditions? In this
Read more
Report
Debugging running Python scripts with PDB via GDB
A friend of mine had an interesting case recently where they wanted to debug an already running Python script on Linux and after some testing it turned out this is possible, so let's see how it can be done in CPython :).
Read more
Report
Python specialized bytecode and pycjail returns challenge solution
I gave a talk on "Python specialized bytecode" on Pykonik #70 where I also made a walkthrough over the "pycjail returns" challenge from ångstrom CTF 2024. The video can be found here and its slides here.
Read more
Report
Understanding AddressSanitizer blog post
Some time ago during an audit I found an out-of-bounds bug that was not detected by AddressSanitizer. This spawned a whole research at Trail of Bits which I talked and wrote about in details!
Read more
Report
Pwndbg coding sprints report
This blog post is a report of the two coding sprints for the Pwndbg project that I organized first on the EuroPython 2022 conference and then, taking inspiration from the previous one, in the Hackerspace Kraków, located in Cracow, Poland.
Read more
Report
Report
Terrible inet_aton in glibc
TLDR: The man inet_aton states that "inet_aton() returns nonzero if the address is valid, zero if not" …and so it is sometimes used to check if a string is a valid IP address. Which should be fine, but isn't, because some implementations are weird.
Read more
Report
How to check if a mutex is locked in Go
TL;DR: Can we check if a mutex is locked in Go? Yes, but not with a mutex API. Here's a solution for use in debug builds. Although you can Lock() or Unlock() a mutex, you can't check whether it's locked. While it is a reasonable omission (e.g., due to pos
Read more
Report
Checking if a mutex is locked in Go
I have written a blog post about checking if a mutex is locked in Go. It can be found at https://blog.trailofbits.com/2020/06/09/how-to-check-if-a-mutex-is-locked-in-go/.
Read more
Report
Show more news
