Ricardo J. Ruiz Fernández

C# PoC of Guard Pages hooking. It is a type of API hooking which can be achieved from userland and does not require patching functions.

C# program to read, write and delete Extended Attributes (EAs) to “hide” malicious payloads within NTFS filesystems.

C# program to write, read, delete or list Alternate Data Streams (ADS) within NTFS.

Python script to count exact total number of stars for any Github user

GetModuleHandle implementation in C# using only the NtQueryInformationProcess API call.

GetProcAddress implementation in C# using only the ReadProcessMemory API call.

jeringuilla is a tool for easy process injection. It implements several types of process injection and uses dynamic function loading using delegates and AES to encrypt payloads and strings, so the function names are not easiliy retrievable.

I solved and created writeups for each Apprentice and Practitioner-level Portswigger lab. In this post you can find the payloads and information about the vulnerability type for each step of the exam.