Microsoft Breach — What Happened? What Should Azure Admins Do?
#specterops

via SpecterOps Team Medium (author: Andy Robbins)

Microsoft Breach — How Can I See This In BloodHound?
#specterops

via SpecterOps Team Medium (author: Stephen Hinck)

PPID Spoofing & BlockDLLs with NtCreateUserProcess
#rastamouse

This week, Capt. Meelo released a great blog post on how to call the NtCreateUserProcess API as a substitue for the typical Win32 CreateProcess API. This post will build upon Meelo’s, so I highly encourage you to read it first. TL;DR, this code (not counting ntdll.h) is the bare minimum to spawn mmc.exe: #include &LTWindows.h> #include "ntdll.h" #pragma comment(lib, "ntdll") int main() { UNICODE_STRING NtImagePath; RtlInitUnicodeString(&NtImagePath, (PWSTR)L"\\??\\C:\\Windows\\System32\\mmc.exe"); PRTL_USER_PROCESS_PARAMETERS ProcessParameters = NULL; RtlCreateProcessParametersEx(&ProcessParameters, &NtImagePath, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, RTL_USER_PROCESS_PARAMETERS_NORMALIZED); PS_CREATE_INFO CreateInfo = { 0 }; CreateInfo.

via Offensive Defence Blog

Nt Token Theft
#rastamouse

Intro Grzegorz Tworek recently published some C code demonstrating how to steal and impersonate Windows tokens from a process. The standard way to do this is with the OpenProcess, OpenProcessToken, DuplicateTokenEx, and ImpersonateLoggedOnUser APIs. Grzegorz shows how to achieve the same using Nt* APIs, specifically NtOpenProcess, NtOpenProcessToken, NtDuplicateToken, and NtSetInformationThread. Because I’m a C# junky, I ported part of his code. This post will serve as a short walkthough on how to “getsystem” by stealing and impersonating the token of a SYSTEM process.

via Offensive Defence Blog

Spinning Webs — Unveiling Arachne for Web Shell C2
#specterops

via SpecterOps Team Medium (author: Cody Thomas)

What's new with BChecks?
#portswigger

Earlier this year, we released BChecks, a powerful yet simple noscripting language that allows you to quickly build and create custom scan checks for anything you want to secure or test.

via PortSwigger Blog

Content Security Policy: Mitigating Web Vulnerabilities by Controlling the Rules of the Game
#trustedsec

Defining a Content Security Policy (CSP) for your web application can help harden the application against many common attacks. Mitigating XSS attacks is a significant component of CSP hardening, but CSP can protect…

via TrustedSec Blog (author: Drew Kirkpatrick)

Using Veeam metadata for efficient extraction of Backup artefacts (1/3)
#synacktiv

via Synacktiv Blog (author: Webmaster)

Active Directory Enumeration for Red Teams
#mdsec

The Directory Service is the heart and soul of many organisations, and whether its Active Directory, OpenLDAP or something more exotic, as a source of much knowledge it often acts...

via MDSec Blog (author: Admin)

Directory.ReadWrite.All Is Not As Powerful As You Might Think
#specterops

via SpecterOps Team Medium (author: Andy Robbins)

Offensive Lab Environments (Without the Suck)
#trustedsec

WhatHave you ever been in an engagement where you need to test an evasive payload or technique, but you lack the time or resources to spin up a replica lab environment quickly? This blog will help clear that hurdle for…

via TrustedSec Blog (author: Travis Kaun)

ADCS ESC13 Abuse Technique
#specterops

via SpecterOps Team Medium (author: Jonas Bülow Knudsen)

Hello Lucee! Let us hack Apple again?
#projectdiscovery

Last year we conducted an in-depth analysis of multiple vulnerabilities within Adobe ColdFusion, we derived valuable insights, one of which revolved around CFM and CFC handling, parsing and execution. We wondered if there are any other CFML Servers. Does this ring a bell? Allow us to introduce Lucee.

via ProjectDiscovery Blog (author: Harsh Jaiswal)

Hardware Hacking: Plunder With a Bus Pirate
#trustedsec

For this blog, I'm going to assume you have a Bus Pirate, you are able to access its terminal, and you are ready to use it—but what are you going to use it on? Grab a digital multimeter (you can get something for around…

via TrustedSec Blog (author: Brian Berg)

Better Living Through OpenSSH Config Files
#redsiege

SSH is an incredibly valuable tool for penetration testing. It provides us with a secure channel for administering machines, remotely executing tools, transferring…

via RedSiege Blog (author: Justin Connors)

The Most Dangerous Entra Role You’ve (Probably) Never Heard Of
#specterops

via SpecterOps Team Medium (author: Andy Robbins)

Top 10 web hacking techniques of 2023
#portswigger

Welcome to the Top 10 Web Hacking Techniques of 2023, the 17th edition of our annual community-powered effort to identify the most innovative must-read web security research published in the last year

via PortSwigger Research

🛠 HTMLSmuggler
#tool

Added smart bot detection to my HTMLSmuggler. Now it can detect headless bots and crawlers (e.g. secure mail gateways) and skip them.

CMMC NOPE: Why You Don’t Need to be CMMC Compliant
#trustedsec

As a Cybersecurity Maturity Model Certification Registered Practitioner Organization (CMMC-RPO), TrustedSec fields many requests from organizations looking for help getting ready for the upcoming CMMC compliance…

via TrustedSec Blog (author: Chris Camejo)

SCCM Hierarchy Takeover with High Availability
#specterops

via SpecterOps Team Medium (author: Garrett Foster)