В области информационной безопасности постоянно что-то происходит — она развивается, появляются новые средства защиты, которые, если верить их описанию, умеют в...

Often times while performing penetration tests it may be helpful to connect to a system via the Remote Desktop Protocol (RDP). I typically use rdesktop or xfreerdp to connect to host once I have obtained credentials to do all sorts of things such as use Active…

During a penetration testing engagement, it’s quite common to have antivirus software applications installed in a client’s computer. This makes it quite challenging for the penetration tester to run common tools while giving the clients a perception that…

Web Application Penetration Testing Checklist with step by step instructions. Know what is Web App Pen Testing and how it strengthen the app security.

Burp Plugin to decrypt AES encrypted traffic on the fly - Ebryx/AES-Killer

Pivoting guide for penetrations testers or red team members

I have been performing “red team” breach assessments for many years. Often the goal is penetrating an external network, and gaining access…

Learn how CrowdStrike Services used the Office 365 Activities API to investigate Business Email Compromises (BECs) involving cyber fraud and theft.

Reverse Shell For Windows and Linux in Lua. GitHub Gist: instantly share code, notes, and snippets.

Application Security Wiki is an initiative to provide all Application security related resources to Security Researchers and developers at one place.

(CVE-2018-8495) Chaining small bugs together to achieve RCE

It's been almost 1.5 years since the Medium post by Shay Ber was published that explained how to execute a DLL as SYSTEM on a Domain Controller provided the account is a member of DNSAdmins. I finally got around to posting here since many I speak with aren't…