In today’s digital world, online voting systems are pivotal in various domains. Businesses rely on them for award shows where the public’s vote determines winners. Music charts use online voting to in...

Hi, my name is Alex, I’ve been an IT security professional since 2007 and I’ve recently entered the start-up world with my project bughuntr.io. In putting together this project, security has been a primary concern for me. This is both due to my background…

Atlassian ran a project on Bugcrowd looking for bugs in their proposed implementation of Kata Containers within the BitBucket Pipelines CI/CD environment. Whilst participating in this project, I identified a vulnerability in Kata Containers which could allow…

Update Audi Maps and Speedcams for free; files and steps are included for Maps 2022/2023/2024. All without the need for OBDeleven or VCDS. This process will work for other VAG cars too not just Audi.

Deploy your hacklab using Ansible and Vagrant for fast, repeatable results. Building on the work by @myexploit2600, we're going to use Ansible and Vagrant to automate the manual steps of constructing a domain and vulnerable users.

This post will walk through various services within the Azure catalogue and look at potential attack paths.

A deep dive into specifics around cobalt strike malleable c2 profiles and key information that is new in cobalt strike 4.6

Introduction When performing penetration tests, we sometimes find that the systems or data we are targeting are not directly accessible from the network our attacking system is connected to. This is often the case when searching for things such a PCI data.…

Recently for Christmas my 4 year old daughter got an Amazon Kids tablet. So far the tablet has been great and Kids+ seems like a pretty decent value for what you get. I'm very wary of the types of content available on the internet, and as a parent it's my…

I'll state this upfront, so as not to confuse: This is a POST exploitation technique. This is mostly for when you have already gained admin on the system via other means and want to be able to RDP without needing MFA. Okta MFA Credential Provider for Windows…

Here are the slides and video from my 2023 talk at CactusCon. The YouTube video currently is cut-off at the beginning, but if it gets fixed I'll update with a new link.

Metasploit recently released version 6.3.  With it came a whole lot of new features related to LDAP operations and using Kerberos authentication. In this blog I want to demonstrate how to perform a GenericWrite -> RBCD attack, which I find are very common.…