OSEC.uz Blog https://osec.uz/blog/ Offensive security research, tradecraft and advisories from OSEC.uz. en MediaTek BROM orqali Android Gatekeeper Pattern Extraction (Redmi 9A Forensics)https://osec.uz/blog/mtk-gatekeeper-pattern-extraction.htmlhttps://osec.uz/blog/mtk-gatekeeper-pattern-extraction.htmlSat, 29 Aug 2026 00:00:00 GMTMediaTek chipsetli Android (Redmi 9A) qurilmalarida MTKClient va BROM rejimi orqali to'liq userdata.img dumpini olish, Gatekeeper credential materiallarini ajratish va offline pattern tahlili. Gov't website has been taken down by hackershttps://osec.uz/blog/gov-t-website-has-been-taken-down-by-hackers.htmlhttps://osec.uz/blog/gov-t-website-has-been-taken-down-by-hackers.htmlThu, 27 Aug 2026 00:00:00 GMTTeam_CC allegedly hacked one of the subdomains of Niger gov't website Bypassing Modern EDR Hooks via Direct Syscalls & Synthetic Stack Frameshttps://osec.uz/blog/bypassing-edr-syscalls.htmlhttps://osec.uz/blog/bypassing-edr-syscalls.htmlThu, 20 Aug 2026 00:00:00 GMTAnalyzing user-mode API unhooking, dynamic SSN resolution via HalosGate, and synthetic stack spoofing to defeat call-stack telemetry in modern Windows endpoints. Lateral Movement in Hybrid Active Directory & Entra ID Environmentshttps://osec.uz/blog/active-directory-attack-paths.htmlhttps://osec.uz/blog/active-directory-attack-paths.htmlTue, 11 Aug 2026 00:00:00 GMTChaining certificate template misconfigurations (AD CS ESC1), msDS-KeyCredentialLink shadow credentials, and seamless SSO synchronization tokens into cross-boundary domain compromise. Broken Object Level Auth & State Desync in Banking API Microserviceshttps://osec.uz/blog/fintech-api-logic-flaws.htmlhttps://osec.uz/blog/fintech-api-logic-flaws.htmlWed, 29 Jul 2026 00:00:00 GMTCase study on discovering distributed race conditions and BOLA vulnerabilities in real-time transaction clearing pipelines under HTTP/2 multiplexing.