Linux Security | jankesec

Red TeamNov 9, 20268 min read

Kernel-Level Packet Sniffing with eBPF/XDP: Real-Time Credential Extraction and Exposure Auditing

How eBPF and XDP bypass userspace packet-capture bottlenecks to intercept authentication handshakes, NetNTLMv2 hashes, and cleartext credentials at line rate: architecture, protocol dissectors, and exposure auditing with driftnet2.

#linux-security#red-team#detection#attack-paths#methodology

Cloud SecurityNov 6, 20266 min read

Container Escape: Docker Socket, Privileged Mode, and the Boundary That Moves

A container is a namespace, a cgroup, and a set of capabilities — not a boundary. When one of those is handed to you, the host is a mount away. The Docker socket and --privileged are demonstrated live, and the cgroup v1 trick that modern systems already killed is called out.

#container-security#linux-security#cloud-security#privilege-escalation#pentest

Exploit DevelopmentNov 6, 20266 min read

Stack Buffer Overflow: From Segfault to RIP Control (Ret2win)

The non-AD half of the journey: a 64-byte stack buffer, an unbounded read, and the exact steps that turn a segfault into control of the instruction pointer. Compiled live in a Linux container, with the one gotcha — the return address is not where the naive math says it is.

#exploit-development#linux-security#pentest#vulnerability-research

Patch AnalysisSep 16, 202614 min read

CVE-2026-87772: Root Escalation Through the Pardus About Mount Helper

Root-cause analysis of CVE-2026-87772: Pardus About's passwordless Polkit action started a root helper that mounted attached disks with defaults,ro, so a setuid binary on a disk gave a local user root. Fixed in 1.2.5.

#linux-security#privilege-escalation#access-control#vulnerability-research#exploit-development