Justin Bui

Research & Tradecraft

Hands in the Cookie Jar: Dumping Cookies with Chromium’s Remote Debugger Port

Introduction EDIT 7/16/23: Chromium added protections against this technique. Additional details can be found here: https://slyd0g.medium.com/debugging-cookie-dumping-failures-with-chromiums-remote-debugger-8a4c4d19429f This blogpost will describe the…

Research & Tradecraft

Automating DLL Hijack Discovery

Introduction This blogpost will describe the concept of dynamic-link library (DLL) search order hijacking and how it can be used…

Research & Tradecraft

Understanding and Defending Against Access Token Theft: Finding Alternatives to winlogon.exe

Introduction This blogpost will describe the concept of access token manipulation and how this technique can be utilized against winlogon.exe to impersonate…

Research & Tradecraft

Revisiting TTPs: TimeStomper

In this post, I will cover how to manipulate file times on the Windows OS. Manipulating timestamps is a common…