October 11, 2025| rushter.com
My Helix editor config and how I'm using it| Artem Golubin
Why code analysis can be hard when it comes to malicious code.| Artem Golubin
An introduction to Threat Hunting and Cobalt Strike| Artem Golubin
Residential proxies are the most demanded type of proxies on the proxy market. Their price increases each year. In this article, I want to write down my understanding of the economics of proxy services. In particular, I describe types of proxy offerings, their typical clients, and why the majority of the market is supplied by malware. Proxy types There are two distinctive types of proxies on the market: Data center (server) proxies Residential proxies (broadband and mobile) Data center proxie...| Artem Golubin
Masscan is a fast port scanner capable of scanning the entire IPv4 internet in under five minutes. To achieve maximum speed, it requires a stable 10 Gigabit link and a custom network driver for Linux. In comparison, it can take weeks or even months for the naive implementation of port scanners. This article describes key features behind the internal design of masscan. What is port scanning? Port scanning is a method to determine which ports on a specified list of IPs are open and accept conne...| Artem Golubin
I started learning Python in 2009, and I had a pretty challenging task and somewhat unusual use of Python. I was working on a desktop application that used PyQT for GUI and Python as the main language. To hide the code, I embedded Python interpreter into a standalone Windows executable. There are a lot of solutions to do so (e.g. pyinstaller, pyexe), and they all work similarly. They compile your Python scripts to bytecode files and bundle them with an interpreter into an executable. Compilin...| Artem Golubin
I use clipboard a lot when I work with images or screenshots. It allows me to upload or transfer images that are not on my disk. For example, I can copy an image from a graphics editor to browsers, messengers, and other applications. This approach keeps my Downloads folder clean and sane. I always thought that when you paste an image to a browser, it's content stays the same. It's not. As it turned out, when you copy a JPG image to Chrome, it converts it to PNG. This is super bad for the web ...| Artem Golubin
This article demonstrates how specially crafted but ordinary gzip archives can be used as a database like storage. It also introduces a Python package and explains how it works. gzip is a popular file compression format to store large amounts of raw data. It has a good data compression ratio, but relatively slow compression/decompression speed. Many companies use it in Big data applications when they need to store compressed CSV or JSON lines files. Such file formats are row-oriented and usua...| Artem Golubin
As part of recent design changes, GitHub has introduced READMEs for profiles. By creating a repo with your name and adding README.md file with markdown to it, you can now add a rich description of yourself. Here is an example of how it looks like: This feature may not be available to your profile yet. GitHub uses selectively rolling. [....]| Artem Golubin
This article describes a minor security flaw in the SSH authentication protocol that can lead to unexpected private infrastructure disclosure. It also provides a PoC written in Python. Asymmetric cryptography, or public-key cryptography, is the most common way to identify and authorize a user on an SSH server. It is also used to encrypt and manage access to different protocols or tools, such as Git, SFTP, SCP, and rsync. Asymmetric cryptography uses a pair of keys: a public key and a private ...| Artem Golubin