Apache APISIX Remote Code Execution (CVE-2022-24112) proof of concept exploit - GitHub - M4xSec/Apache-APISIX-CVE-2022-24112: Apache APISIX Remote Code Execution (CVE-2022-24112) proof of concept ...

In a similar vein to Project 2, in this third and final project, we were tasked with performing the duties of a Red Team pen tester and a Blue Team SOC analyst, with the added wrinkle of inspecting...

Providing security research and red team techniques

Using a still unpatched vulnerability in the PHP library dompdf (used for rendering PDFs from HTML), we achieved RCE on a web server with merely a reflected XSS vulnerability as entry point.

Aretha Red Teaming conceptual mockup. Contribute to OxfordHCC/arethart development by creating an account on GitHub.

Red Team Field broken down into subject in markdown format - infosecwatchman/rtfm-1

With this series, we present the results of our research on the security of popular developer tools with the goal of making this ecosystem safer: today’s article revisits Git integrations.

We would like to thank researcher Abdelhamid Naceri for his great work in developing these exploit techniques, as well as for the vulnerabilities he has been reporting to our program. We look forward to seeing more from him in the future. Until then, follow…

TOP All bugbounty pentesting CVE-2023- POC Exp RCE example payload Things - GhostTroops/TOP

Overview In this two-part series we discuss two Windows local privilege escalation vulnerabilities that we commonly identify during red team operations. These issues are of particular interest due to their prevalence within organizations with mature security…

A CSRF issue on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administration panel. The cronjob will consequently execute the entry on the threat actor's defined interval, leading to remote code execution…

Our objective is to generate a malicious office document that contains a macro that will provide us with a reverse shell on the target system when executed.

The all-in-one browser extension for offensive security professionals 🛠 - LasCC/HackTools

Red Team Server (RTS). Contribute to jallphin/spitfire development by creating an account on GitHub.

Microsoft to support scenarios where users authenticate via Kerberos to one system and information needs to be updated on another system implemented unconstrained delegation. This was implemented i…

Cyber security, Red Teaming and CTF Writeup's. Contribute to 0xStarlight/0xStarlight.github.io development by creating an account on GitHub.

A quick look at how Jenkins can be used to automatically build payloads and tooling, based on the OffSecOps talk by Harmj0y.

Escalate from a low-integrity Administrator account to NT AUTHORITY\SYSTEM without an LPE exploit by combining a COM UAC bypass and Token Impersonation - FULLSHADE/Auto-Elevate

A collection of C# utilities intended to be used with Cobalt Strike's execute-assembly - GitHub - breakid/SharpUtils: A collection of C# utilities intended to be used with Cobalt Strike&amp...