Embrace The Red: Offensive BPF!
A series of posts around the introduction into BPF with a focus to an offensive setting, and also how its misuse can be detected. Posts include discussions on the rootkit capabilities of eBPF, or on which tracing type is needed for different use cases.
- from
- eBPF
- added
- 2026-10-10
- likes
- 0
similar
-
Bad BPF github.com
A collection of malicious eBPF programs that make use of eBPF's ability to read and write user data in between the usermode program and the kernel.
-
BPF Design Q&A kernel.org
Frequently Asked Questions on the decisions behind the BPF infrastructure.
-
-
ebpfkit github.com
A rootkit that leverages multiple eBPF features to implement offensive security techniques.
-
-
Extending extended BPF lwn.net
A blog post from 2014 on the development of BPF and demonstrating what can be done with it, using an example of stateful socket filtering by attaching an eBPF program to a socket.
eBPF: “A series of posts around the introduction into BPF with a focus to an offensive setting, and also how its misuse can be detected. Posts include discussions on the rootkit capabilities of eBPF, or on which tracing type is needed for different use cases.”