« Back to home
.Net

The .NET Export Portal
Debugging into .NET
Hiding your .NET - ETW
Building, Modifying, and Packing with Azure DevOps
RunDLL32 your .NET (AKA DLL exports from .NET)
Active Directory

Inter-Realm Key Roasting (well... within the first 30 days)
Azure AD Connect for Red Teamers
Kerberos AD Attacks - More Roasting with AS-REP
Setting Service Principal Names To Roast Accounts
Using machine account credentials during an engagement
Kerberos AD Attacks - Kerberoasting
Adfs

ADFS - Living in the Legacy of DRS
Ai

Prompt Engineering for Security Agents - A Measurable Approach with GEPA
Amsi

Exploring PowerShell AMSI and Logging Evasion
Apt28

Analysis of APT28 hospitality malware (Part 2)
Apt32

Reviewing the APT32 phishing malware
Aws

Designing The Adversary Simulation Lab
AWS Lambda Redirector
Azure

WAM BAM - Recovering Web Tokens From Office
Azure Application Proxy C2
Azuread

Identity Providers for RedTeamers
Azure AD Connect for Red Teamers
Bettercap

Bettercap - Capturing NTLM Hashes
Blog

New Blog and the Technology that powers it
C2

The Accidental C2 - Exploring Dev Tunnels for Remote Access
Azure Application Proxy C2
ActiveBreach, powered by Ethereum Blockchain
Claude

An Evening with Claude (Code)
Cobalt Strike

AWS Lambda Redirector
Protecting Your Malware with blockdlls and ACG
How to Argue like Cobalt Strike
Cobaltstrike

Tailoring Cobalt Strike on Target
Exploring Cobalt Strike's ExternalC2 framework
Csv

From CSV to Meterpreter
Ctf

Defcon 25 in Review
Exploiting with pwndbg - Solving PlaidCTF 2016 SmartStove
Revisiting PlaidCTF - bigpicture
PlaidCTF - no_mo_flo writeup
BSidesSF CTF - DNSCap Walkthrough
BSidesSF CTF - Steel Mountain: Sensors Walkthrough
BSidesSF CTF: b-64-b-tuff Walkthrough
ROP Primer - Walkthrough of Level 2
ROP Primer - Walkthrough of Level 1
ROP Primer - Walkthrough of Level 0
Cve

An Evening with Claude (Code)
Moving jobs and exploiting flash (CVE-2018-4878)
Linux USBIP overflow (CVE-2016-3955)
Foomatic-RIP (CVE-2015-8560)
Defcon

Defcon 25 in Review
Devops

Designing The Adversary Simulation Lab
Testing your RedTeam Infrastructure
New Blog and the Technology that powers it
Docker

Windows Server 2016 / Docker Privilege Escalation
Dotnet

Weird Ways to Run Unmanaged Code in .NET
Drivers

g_CiOptions in a Virtualized World
Dyld

Restoring Dyld Memory Loading
Entraid

Identity Providers for RedTeamers
Etw

Hiding your .NET - COMPlus_ETWEnabled
Evading Sysmon DNS Monitoring
Exploit

MacOS "DirtyNIB" Vulnerability
Disabling MacOS SIP via a VirtualBox kext Vulnerability
Escaping the Sandbox – Microsoft Office on MacOS
Exploiting CVE-2018-1038 - Total Meltdown
Moving jobs and exploiting flash (CVE-2018-4878)
Universal XSS via Evernote WebClipper
Exploiting Windows 10 Kernel Drivers - NULL Pointer Dereference
Exploiting Windows 10 Kernel Drivers - Stack Overflow
Kernel Exploit Demo - Windows 10 privesc via WARBIRD
ExplodingCan - A vulnerability review
ROP Primer - Walkthrough of Level 2
ROP Primer - Walkthrough of Level 1
ROP Primer - Walkthrough of Level 0
Windows Server 2016 / Docker Privilege Escalation
Kentico CMS (< 9.0.42) SQLi
Github Desktop - DOM XSS
Linux USBIP overflow (CVE-2016-3955)
GitHub Desktop - RCE
Foomatic-RIP (CVE-2015-8560)
MS15-099 - Sharepoint XSS
Externalc2

Exploring Cobalt Strike's ExternalC2 framework
Flash

Moving jobs and exploiting flash (CVE-2018-4878)
Foomatic-Rip

Foomatic-RIP (CVE-2015-8560)
Forensics

Offensive Forensics - Recovering Files
Extracting SQL Server Hashes From master.mdf
Github

Github Desktop - DOM XSS
GitHub Desktop - RCE
Hevd

Exploiting Windows 10 Kernel Drivers - NULL Pointer Dereference
Exploiting Windows 10 Kernel Drivers - Stack Overflow
Hopper

Using Hopper scripting to analyse MacRansom
Idp

Identity Providers for RedTeamers
Iot

Defcon 25 in Review
Javascript

How GitHub login detection banner works
Kentico

Kentico CMS (< 9.0.42) SQLi
Kerberos

Inter-Realm Key Roasting (well... within the first 30 days)
Kerberos AD Attacks - More Roasting with AS-REP
Setting Service Principal Names To Roast Accounts
Kerberos AD Attacks - Kerberoasting
Kernel

Disabling MacOS SIP via a VirtualBox kext Vulnerability
Exploiting CVE-2018-1038 - Total Meltdown
Exploiting Windows 10 Kernel Drivers - NULL Pointer Dereference
Exploiting Windows 10 Kernel Drivers - Stack Overflow
Laps

LAPS 2.0 Internals
Linux

Linux ptrace introduction AKA injecting into sshd for fun
Llm

Prompt Engineering for Security Agents - A Measurable Approach with GEPA
The Accidental C2 - Exploring Dev Tunnels for Remote Access
An Evening with Claude (Code)
Tokenization Confusion
Loader

PNG Steganography from First Principles
Building a Custom Mach-O Memory Loader for macOS - Part 1
Low-Level

PNG Steganography from First Principles
WAM BAM - Recovering Web Tokens From Office
g_CiOptions in a Virtualized World
Object Overloading
Weird Ways to Run Unmanaged Code in .NET
The .NET Export Portal
We Need To Talk About MACL
MacOS Injection via Third Party Frameworks
MacOS Filename Homoglyphs Revisited
Analysing RPC With Ghidra and Neo4j
Evading Sysmon DNS Monitoring
Exploring Mimikatz - Part 2 - SSP
Exploring Mimikatz - Part 1 - WDigest
Silencing Cylance: A Case Study in Modern EDRs
Building, Modifying, and Packing with Azure DevOps
How to Argue like Cobalt Strike
Machine-Learning

Tokenization Confusion
Macos

MacOS "DirtyNIB" Vulnerability
Building a Custom Mach-O Memory Loader for macOS - Part 1
Restoring Dyld Memory Loading
Bring Your Own VM - Mac Edition
We Need To Talk About MACL
MacOS Injection via Third Party Frameworks
MacOS Filename Homoglyphs Revisited
Bypassing MacOS Privacy Controls
macOS Research Outtakes - File Extensions
Disabling MacOS SIP via a VirtualBox kext Vulnerability
Endpoint Security Self-Protection on MacOS
Escaping the Sandbox – Microsoft Office on MacOS
Malware

Analysis of APT28 hospitality malware (Part 2)
Analysis of APT28 hospitality malware
Industroyer C2 Communication
Using Hopper scripting to analyse MacRansom
Reviewing the APT32 phishing malware
Mcp

An Evening with Claude (Code)
Mdf

Extracting SQL Server Hashes From master.mdf
Metasploit

SQL Server Authentication With Metasploit and MITM
Meterpreter

Alternative methods of becoming SYSTEM
Mimikatz

Exploring Mimikatz - Part 2 - SSP
Exploring Mimikatz - Part 1 - WDigest
Mitm

Bettercap - Capturing NTLM Hashes
SQL Server Authentication With Metasploit and MITM
Non-Security

How GitHub login detection banner works
Oauth2

ADFS - Living in the Legacy of DRS
Office

Escaping the Sandbox – Microsoft Office on MacOS
Okta

Identity Providers for RedTeamers
Okta for Red Teamers
Onelogin

Identity Providers for RedTeamers
Payload

LAPS 2.0 Internals
Phishing

Reviewing the APT32 phishing malware
Ping

Identity Providers for RedTeamers
Plaidctf

Exploiting with pwndbg - Solving PlaidCTF 2016 SmartStove
Revisiting PlaidCTF - bigpicture
PlaidCTF - no_mo_flo writeup
Powershell

AppLocker CLM Bypass via COM
Privacy

Bypassing MacOS Privacy Controls
Ptrace

Linux ptrace introduction AKA injecting into sshd for fun
Radare2

Radare2 - Using Emulation To Unpack Metasploit Encoders
Redteam

The Accidental C2 - Exploring Dev Tunnels for Remote Access
Administrator Protection Review
The SQL Server Crypto Detour
ADFS - Living in the Legacy of DRS
Identity Providers for RedTeamers
Okta for Red Teamers
Azure Application Proxy C2
Tailoring Cobalt Strike on Target
Bring Your Own VM - Mac Edition
MacOS Injection via Third Party Frameworks
Hiding your .NET - COMPlus_ETWEnabled
Hiding your .NET - ETW
AWS Lambda Redirector
Testing your RedTeam Infrastructure
Protecting Your Malware with blockdlls and ACG
Silencing Cylance: A Case Study in Modern EDRs
Azure AD Connect for Red Teamers
ActiveBreach, powered by Ethereum Blockchain
RunDLL32 your .NET (AKA DLL exports from .NET)
macOS Research Outtakes - File Extensions
Exploring PowerShell AMSI and Logging Evasion
Understanding and Evading Get-InjectedThread
Exploring Cobalt Strike's ExternalC2 framework
Alternative methods of becoming SYSTEM
Kerberos AD Attacks - More Roasting with AS-REP
Setting Service Principal Names To Roast Accounts
Using machine account credentials during an engagement
Kerberos AD Attacks - Kerberoasting
Reversing

Administrator Protection Review
The .NET Export Portal
Hiding your .NET - COMPlus_ETWEnabled
Hiding your .NET - ETW
MacOS Filename Homoglyphs Revisited
Analysing RPC With Ghidra and Neo4j
Cisco AMP - Bypassing Self-Protection
Endpoint Security Self-Protection on MacOS
Windows Anti-Debug techniques - OpenProcess filtering
Kernel Exploit Demo - Windows 10 privesc via WARBIRD
ExplodingCan - A vulnerability review
Analysis of APT28 hospitality malware (Part 2)
Analysis of APT28 hospitality malware
Industroyer C2 Communication
Exploiting with pwndbg - Solving PlaidCTF 2016 SmartStove
Radare2 - Using Emulation To Unpack Metasploit Encoders
Rop

ROP Primer - Walkthrough of Level 2
ROP Primer - Walkthrough of Level 1
ROP Primer - Walkthrough of Level 0
Sccm

Exploring SCCM by Unobfuscating Network Access Accounts
Secarma

Setting Service Principal Names To Roast Accounts
Using machine account credentials during an engagement
ExplodingCan - A vulnerability review
Industroyer C2 Communication
Security

Linux ptrace introduction AKA injecting into sshd for fun
Foomatic-RIP (CVE-2015-8560)
MS15-099 - Sharepoint XSS
From CSV to Meterpreter
Sharepoint

MS15-099 - Sharepoint XSS
Smb

NTLMquic
Sql

SQL Server Authentication With Metasploit and MITM
Sqlserver

The SQL Server Crypto Detour
Sysmon

Evading Sysmon DNS Monitoring
Tools

Exploring SCCM by Unobfuscating Network Access Accounts
NTLMquic
Usb

Xbox One Controller Hacking
Vba

Protecting Your Malware with blockdlls and ACG
Vscode

The Accidental C2 - Exploring Dev Tunnels for Remote Access
Vulnerability

An Evening with Claude (Code)
Web

Universal XSS via Evernote WebClipper
MS15-099 - Sharepoint XSS
Windows

Administrator Protection Review
LAPS 2.0 Internals
WAM BAM - Recovering Web Tokens From Office
Exploring SCCM by Unobfuscating Network Access Accounts
g_CiOptions in a Virtualized World
NTLMquic
Object Overloading
Debugging into .NET
Hiding your .NET - ETW
Protecting Your Malware with blockdlls and ACG
Inter-Realm Key Roasting (well... within the first 30 days)
RunDLL32 your .NET (AKA DLL exports from .NET)
Cisco AMP - Bypassing Self-Protection
AppLocker CLM Bypass via COM
Exploring PowerShell AMSI and Logging Evasion
Exploiting CVE-2018-1038 - Total Meltdown
Understanding and Evading Get-InjectedThread
Exploiting Windows 10 Kernel Drivers - NULL Pointer Dereference
Exploiting Windows 10 Kernel Drivers - Stack Overflow
Kernel Exploit Demo - Windows 10 privesc via WARBIRD
Alternative methods of becoming SYSTEM
Kerberos AD Attacks - Kerberoasting
Xbox

Xbox One Controller Hacking
Xss

Universal XSS via Evernote WebClipper