A list of useful payloads and bypass for Web Application Security and Pentest/CTF - swisskyrepo/PayloadsAllTheThings

A list of useful payloads and bypass for Web Application Security and Pentest/CTF - swisskyrepo/PayloadsAllTheThings

SMBeagle - Fileshare auditing tool. Contribute to punk-security/smbeagle development by creating an account on GitHub.

ABUSING CVE-2022-26923 THROUGH SOCKS5 ON A MYTHIC C2 AGENT This blog post was written by Amarjit Labhuram CVE-2022-29623 Vulnerability Introduction Vulnerability Type: Elevation of Privilege Vulner...

Active Directory and Internal Pentest Cheatsheets

“Humans are more suited to recognize […]

Mike Felch // With so many Microsoft technologies, services, integrations, applications, and configurations it can create a great deal of difficulty just to manage everything. Now imagine trying to...

Retrieve LAPS password from LDAP. Contribute to swisskyrepo/SharpLAPS development by creating an account on GitHub.

This research report explores how JSOs can be vulnerable to unsafe deserialization vulnerabilities, how Metasploit Framework can help validate, and more.

Windows / Linux Local Privilege Escalation Workshop - sagishahar/lpeworkshop

Azure Active Directory (Azure AD) is Microsoft’s cloud-based identity and access management service.

Providing security research and red team techniques

BloodyAD is an Active Directory Privilege Escalation Framework - CravateRouge/bloodyAD

Spider entire networks for juicy files sitting on SMB shares. Search filenames or file content - regex supported! - blacklanternsecurity/MANSPIDER

Pure C++, weaponized, fully automated implementation of RottenPotatoNG - klezVirus/CandyPotato

HardeningKitty and Windows Hardening Settings. Contribute to 0x6d69636b/windows_hardening development by creating an account on GitHub.

Active Directory and Internal Pentest Cheatsheets

Welcome to a tutorial on building your first LLVM based obfuscator. In this post we will list the advantages of using LLVM tools, briefly…

For less fun but even more profit

A timing attack is usually an overlooked threat. Is it just a fluke or can it really be pulled off on a real web server?

🤖 A CLI application that automatically prepares Android APK files for HTTPS inspection - niklashigi/apk-mitm

Red Team Fails - “Oops my bad I ruined the operation”, a story on how to fail a red team assessment. TLDR: Recently I had the pleasure to give a rump during the “Drink Love Share” meet organized by...

A PoC that packages payloads into output containers to evade Mark-of-the-Web flag & demonstrate risks associated with container file formats. Supports: ZIP, 7zip, PDF, ISO, IMG, CAB, VHD, V...

Red Team notes

Intro to the Office VSTO format, a capability that provides rich capabilities for attackers to phish users and gain code execution

GraphQLmap is a scripting engine to interact with a graphql endpoint for pentesting purposes. - Do not use for illegal testing ;) - swisskyrepo/GraphQLmap

Cover your tracks during Linux Exploitation by leaving zero traces on system logs and filesystem timestamps. - mufeedvh/moonwalk

Red Team Notes 2.0

Active Directory and Internal Pentest Cheatsheets

During an internal penetration test, Cortex EDR was installed in the domain controller. After obtaining Domain Admin privileges on the…

Writing a simple VM for LC3 in less than 125 lines of C

Custom PowerShell module to setup an Active Directory lab environment to practice penetration testing. - xbufu/ADLab

Process injection on Windows 11 bypassing industry leading endpoint protection solutions.

C# Executable with embedded Python that can be used reflectively to run python code on systems without Python installed - checkymander/Zolom

New blog series on how threat actors abuse Cobalt Strike. This first part explains how to analyze, decode and parse Cobalt Strike payloads.

Yet another way to exploit WSUS misconfiguration and MITM.

One place for all the default credentials to assist the Blue/Red teamers activities on finding devices with default password 🛡️ - ihebski/DefaultCreds-cheat-sheet

Evasion techniques

In this writeup, I will explain how I discovered a Two-Factor Authentication bypass in Facebook during Meta bug bounty Researchers…

Acknowledgements My understanding of EDRs would not be possible without the help of many great security researchers. Below are some write-ups and talks that really helped me gain the understanding...

MS-FSRVP coercion abuse PoC. Contribute to ShutdownRepo/ShadowCoerce development by creating an account on GitHub.

Shellcode launcher for AV bypass. Contribute to cepxeo/dll4shell development by creating an account on GitHub.

As Red Teamers, we need an OPSEC safe method to execute shellcode via a range of initial access vectors. Things are getting more and more difficult with Endpoint Detection and Response (EDR) products...

During our red team operations, we frequently come in contact with organisations using Office 365. The present tooling targeted at this environment is somewhat limited meaning that development is...

Estimated Reading Time: 14 minutes Bypassing endpoint protections such as AVs/EDRs is a phase that you need to take care of when you prepare for your red team operation, it could take some time to...

Automatic SSRF fuzzer and exploitation tool. Contribute to swisskyrepo/SSRFmap development by creating an account on GitHub.

Automation for internal Windows Penetrationtest / AD-Security - S3cur3Th1sSh1t/WinPwn

Mantis is a security framework that automates the workflow of discovery, reconnaissance, and vulnerability scanning. - PhonePe/mantis

We have reported more than 60 instances of this bug across a wide range of bug bounty programs including companies like Paypal, Atlassian, Microsoft, GitLab, Yahoo, ...

Providing security research and red team techniques

Slides and Codes used for the workshop Red Team Infrastructure Automation - dazzyddos/HSC24RedTeamInfra

The goal of this article is to demonstrate a working exploit chain step-by-step. The idea is to provide a small guide for multi staged…

Recently I was browsing Twitter and came across a very interesting tweet: A simple string search within the process memory for svchost.exe revealed the plaintext password that was used to connect to...

ManoMano’s employees — Manas & Manos — play a key role in the protection of the organization and constitute our first barrier. At ManoMano…

UPDATED:  5/30/2013 to cover same flaw in EnSc.exe. There is a reason that the RunAs program doesn’t accept credentials on the command line…because people would embed passwords. Microso…

The altSecurityIdentities attribute of Active Directory (AD) computers and users allows you to specify explicit certificate mappings. An…

Even though Microsoft Azure is the second largest cloud solution after Amazon Web Services (AWS) from a market share perspective, it should be noted that approximately 95% of Forbes 500 companies u…

A new ADCS privesc was released: Certifried (CVE-2022-26923) with this blogpost after Microsoft patched it. Here is an example on how to exploit this vulnerability with bloodyAD and PKINIT not...

Ransomware is the most prevalent cyber threat for organizations today. Fransom is an open source ransomware emulator for security teams.

Stop Windows Defender programmatically. Contribute to lab52io/StopDefender development by creating an account on GitHub.

Every object in azure (users, service principals, device, apps) combines to form attack paths that adversaries can find and exploit and take over your whole cloud tenant. It’s very difficult for you...

Cyber security, Red Teaming and CTF Writeup’s

In this post I talk about the approaches I took trying to build a basic C2.

The Directory Service is the heart and soul of many organisations, and whether its Active Directory, OpenLDAP or something more exotic, as a source of much knowledge it often acts...

🚨[Updated for 2024] Check out the latest version of this post here.🚨