The following blog post introduces a new lateral movement technique that combines the power of DCOM and HTA. The research on this t...

What exactly is it that separates arbitrary code from code that originates from Microsoft? I would wager that the reaction of most people…

Enumerate executables with auto-elevation enabled. GitHub Gist: instantly share code, notes, and snippets.

Have you ever been on a internal network assessment and discovered an unauthenticated writable Windows-based file share? Well, in addition to finding potentially sensitive information, you can abus…

Last September, Chris Bisnett and I presented research at DerbyCon which highlighted a handful of techniques and bugs we discovered that…

Background

Exploiting weaknesses in name resolution protocols is a common technique for performing man-in-the-middle (MITM) attacks. This blog dives into two particularly vulnerable name resolution protocols: Link-Local Multicast Name Resolution (LLMNR) and NetBIOS…

PowerShell MachineAccountQuota and DNS exploit tools - Powermad/README.md at master · Kevin-Robertson/Powermad

With this post and my last post, I guess I'm on a path of finding interesting ways to "break" AD. The last post related to AD denial of service and this Write access to the Domain object could allow domain admin access.

Using the Mimikatz DCSync command to compromise credentials by replicating information with Directory Replication Service Remote Protocol MS-DRSR.

Bypass Technique Denoscription

In order to effectively use cyber security tools we need to know, in detail, how they work. Only then we are able to leverage them to the best of their capabilities. In this post we will dive into Veil-Evasion and learn its payload naming scheme, different…

Clear all your logs in [linux/windows] servers 🛡️. Contribute to Rizer0/Log-killer development by creating an account on GitHub.

PowerShell module to check if a Windows binary (EXE/DLL) has been compiled with ASLR, DEP, SafeSEH, StrongNaming, and Authenticode. - NetSPI/PESecurity

Much like publicly exposed S3 buckets, Microsoft's Azure platform can suffer from similar data exposure issues via its Blob file storage service.

Please no pull requests for this repository. Thanks! - DidierStevens/DidierStevensSuite

TL;DR – Found a technique to execute any binary file after another application is closed without being detected by Autoruns.exe. – Requires administrator rights and does not belong in userland. – C…