Netacoding 🛡️
Dedicated to Low-Level Research and Cybersecurity Tools. Analyze internet protocols, master Assembly language, and use our professional-grade security toolkit for daily operations.
DNS State Exhaustion: From TCP Slot Starvation to NXNS Amplification
TIME_WAIT and Sockstress don’t translate directly to UDP DNS, but DNS has its own state surface. Recursive-client tables, pending-query slots, TCP/853 (DoT) and TCP/443 (DoH) sockets, delegation chains, and DNSSEC validation state are all exhaustible. This post covers water torture, NXNS, TsuNAME, NRDelegation, and the operational defaults that make DNS a softer target than HTTP.
TCP Connection State Exhaustion: TIME_WAIT, Sockstress, and Why 4-Tuple Math Beats Port Counting
The ‘65536 port’ framing is wrong. TCP connection capacity is governed by 4-tuple uniqueness and kernel state tables, not port counts. This post breaks down TIME_WAIT exhaustion, Sockstress (window=0 + Persist Timer abuse), Slowloris-class L7 variants, and the conditions under which each is still effective today.
Boundary Mathematics: Weaponizing PAGE_SHIFT Arithmetic via FUSE — Part 3
MAX_LFS_FILESIZE only gates the superblock. Once the FUSE connection is up, every FUSE_GETATTR reply can mutate i_size to 0xFFFFFFFFFFFFFFFF. The page cache’s (pos + count - 1) » PAGE_SHIFT arithmetic wraps unsigned, inverts loop invariants, and turns vma_merge() into an arbitrary OOB-write primitive on Maple Tree-backed kernels.
Lying to the Kernel: FUSE Trust Boundary & Size Desync as a VFS Attack Surface — Part 1
An unprivileged FUSE daemon controls the semantic authority of an entire filesystem. By lying about i_size in vfs_getattr replies, it desynchronizes kernel allocation from kernel ingestion — turning finit_module(2), the firmware loader, and kexec_file_load(2) into kmalloc-4k slab overflow primitives.
The Async Abort Race: drop_caches × SIGKILL × fuse_abort_conn = Double Put — Part 4 & Conclusion
struct fuse_req borrows inode references without bumping i_count. A SIGKILL’d reader, an unrelated drop_caches sysctl, and a delayed daemon abort conspire to dereference freed-and-reoccupied slab memory. The result: a refcount decrement on whatever struct cred lands in the freed slot — the entire kill chain in three syscalls and one signal.