Introduction Applocker is becoming one of the most implemented security features in big organizations. Implementing AppLocker reduces your risk dramatically especially for workstations. Unfortunately for the blue-team, there are a lot of custom configurations…

While the techniques presented here no longer work on current software versions, it does go to show that by looking beyond the scan results, a determined attacker can quickly turn a relatively “clean” vulnerability scan into complete domain compromise.

In this Post, we are shedding light on User Account Control shortly known as UAC. We will also look at how it can potentially protect

A while back I was messing around with Tomcat and it got me thinking when I come across Tomcat during assessments it is normally running as system or some kind of admin account. Sometimes I don’t...

Welcome to my first post! I am a career blue teamer turned red teamer a few years back. My blue team background includes incident response…

Your new best friend: Introducing BloodHound Community Edition!

If you’re a penetration tester, then you probably already know that escalating from a local administrator to a Domain Admin only requires a few steps.  Those steps typically involve stealing Domain Admin passwords, password hashes, or authentication tokens…

With the emergence of more C# and .NET tooling, I occasionally see people tripping up over this. It’s not a huge issue, just something to be aware of.

L1TF (Foreshadow) VM guest to host memory read PoC - gregvish/l1tf-poc

SharpBox is a C# tool for compressing, encrypting, and exfiltrating data to DropBox using the DropBox API. - GitHub - P1CKLES/SharpBox: SharpBox is a C# tool for compressing, encrypting, and exfil...

Kekeo, the other big project from Benjamin Delpy after Mimikatz, is an awesome code base with a set of great features. As Benjamin states, it’s external to the Mimikatz codebase because, “I hate to…

New Tokenvator release! Now with more token privilege manipulation, new named pipe token attacks, and File System Minifilter manipulation. Details in the latest blog post: https://blog.netspi.com/tokenvator-release-2

proof-of-concept Windows Driver for injecting DLL into user-mode processes using APC - wbenny/injdrv

Hey all, In the previous post we discussed using Responder with Snarf, this post will be doing the same but through a pivot.  To pivot in we’ll be using Simpletun and a layer 2 pivoting clien…

Systeminfo gives you a perfect overview of your system. But what about the other systems in your domain? Sure, you can use 3rd Party Tools or SCCM. But the number of those who can´t use enterprise …

“Backup Operators” group is an historical Windows built in group. It was designed to allow its members to perform backup and restore operations by granting the SeBackupPrivilege and the…