Today we´re going to talk a little about possible ways to circumvent some of the security measures one might face during an engagement in an Active Directory environment.

We as pentesters are heavily relying on our tools like Bloodhound, Rubeus, mimikatz…

Automatic Device Vulnerability Scanner in PHP with the ExploitDB CSV on GitHub - WokeWorld/Vulnerable

 In this past few days I stumble to some new and old variant of ICEID malware that uses .png steganography to hide and execute its encrypted...

A complete reference about SQL injection. Introduction, tutorial, advanced attack techniques, how to avoid it, resources and much more!

Windows Defender has improved significantly the security posture of Windows environments since it has better detection capabilities compare to other security products. When a process is created Win…

TL;DR Link to heading This blog post describes a generic technique I called internally on our red team assessment “Divide and Conquer”, which can be used to bypass behavioral based NextGen AV detection. It works by splitting malicious actions and API calls…

Obfuscated DNS Queries, Author: Guy Bruneau

HackTools is an add-on that facilitates online penetration testing, includes cheat sheets and all the tools used during a penetration testing, such as XSS payloads, Reverse shells and more. With this extension you no longer need to look for payloads on different…

Co-authored by Ghanashyam Satpathy and Dagmawi Mulugeta Summary Emotet has become one of the world’s most advanced botnets. Like many malware campaigns,

Research by: Aviran Hazum, Alex Shamshur, Raman Ladutska, Ohad Mana, Israel Wernik Introduction Now more than ever, we rely on our smartphones to keep in touch with our work, our families and the world around us. There are over 3.5 billion smartphone users…

Laravel less then v8.4.2 debug mode: Remote code execution
Technical details : https://www.ambionics.io/blog/laravel-debug-rce


Vulnmachines - Place for Pentesters
Vulnmachines is pratice place for people who are willing to learn about pentesting. In this…

A list of useful payloads and bypass for Web Application Security and Pentest/CTF - swisskyrepo/PayloadsAllTheThings

Proof of concept of hiding conections with ShadowMove technique

DNS Misconfiguration : S0x4 - Same Site Scripting Scanner - GitHub - c0brabaghdad1/S0x4: DNS Misconfiguration : S0x4 - Same Site Scripting Scanner