Security Ninja

Articles from Security Ninja

Remote DLL Injection, Plus...

August 31, 2016

In this article, we will take a look at the code injection techniques. We will take a look at remote DLL injection, remote code injection, Reflective DLL inj

Learn More

Enumeration of Heaps, Environment Variables

August 22, 2016

Continuing with the series, in this article, we will learn about enumeration of important structures like heaps, environment variables, DLLs pointed by main

Learn More

Page tables, VAD and PEB

August 12, 2016

In this part of the series, we will understand how the process can be enumerated within memory. Just as a refresher in part 1 of this series we had a look at

Learn More

Memory and volatility

August 3, 2016

In this article series, we will learn about how processes reside in memory and various ways to find and enumerate them. I will be using Volatility plugins to

Learn More

Riffle Anonymity Network

July 19, 2016

Everyone wants to maintain privacy while surfing the internet and most of them rely on TOR network to achieve anonymity while online. As we all know TOR has

Learn More

DLL hijacking attacks revisited

July 14, 2016

This article is all about different DLL hijacking attacks techniques used by malware to achieve persistence. We will be discussing DLL search order hijacking

Learn More

Process Hallowing

July 1, 2016

In this article, we will learn what process hallowing is, how is it done, and how we can detect it while performing memory analysis. Process Hallowing It is

Learn More

Understanding Critical Windows Artifacts and Their Relevance During An Investigation: Artifacts

June 22, 2016

We discussed NTFS timestamps in Part 1 of this series. In this article, we will look at some of the artifacts which can point out a program execution on a W

Learn More

Understanding Critical Windows Artifacts and Their Relevance During Investigation: NTFS Timestamps

June 20, 2016

In this article, we will learn about critical Windows artifacts, what they mean, where they are located in the system, what can be inferred from them and how

Learn More

Common malware persistence mechanisms

June 13, 2016

As we know, malware becomes stealthier by somehow achieving persistence on the exploited machine. This helps malware authors to inject/exploit once, and the

Learn More

Relevance of Windows EventIDs in investigation

May 31, 2016

In this article, we will take a look at important Windows Event IDs, what we normally see in logs and how different EventID can be used to construct the late

Learn More

Memory analysis using redline

May 17, 2016

Memory Analysis has become very useful for malware hunting and investigation purposes. Redline is a tool which is used to analyze the memory samples collecte

Learn More