runZero Research

Deep technical dives and original findings from the runZero Research Team.


runZero Research
BlackHat gems HP iLO 5 vulnerabilities
August 19, 2021
Each year, August arrives with promises of hot weather and cool security research talks. The DEF CON, Black Hat, and BSidesLV security conferences...
runZero Research
Fingerprinting Windows versions, AV, wireless cards over the network—all without authentication
August 11, 2021
Correctly identifying and categorizing network-connected systems without credentials is a tricky challenge and one of the fun parts of working at...
runZero Research
Recog development with runZero
August 6, 2020
Overview # Recog may be one of the most underrated open source security projects of all time. Recog started off in the early 2000s as the...
runZero Research
SMB2 Session Prediction & Consequences
March 30, 2020
Server Message Block Research # The Rumble scan engine received big updates this month for the HTTP, RDP, and SMB protocols. The SMB work was...
runZero Research
Cisco Webex Username Discovery via mDNS
March 5, 2020
At the most basic level, Rumble is a search engine for your network; it sends out probes, listens for replies, normalizes the results, applies...
runZero Research
DNS Ping Scans via Open Resolvers
April 2, 2019
Our last post covered some of the ways that Rumble gathers information from DNS services. While working on the tracer implementation, we identified...
runZero Research
DNS Parlor Tricks for Network Discovery
March 31, 2019
DNS is an amazing protocol. After starting life as a simple mechanism for name resolution, it is now used to enforce TLS rules, prevent email...