PostgreSQL from 9.3 to latest has functionality allowing the database superuser & users in the ‘pg_read_server_files’ to execute OS…

A collaborative, multi-platform, red teaming framework - its-a-feature/Mythic

Interactive Network Scanner. Contribute to marco-lancini/goscan development by creating an account on GitHub.

A tool which creates a spoofed certificate of any online website and signs an Executable for AV Evasion. Works for both Windows and Linux - paranoidninja/CarbonCopy

The Social-Engineer Toolkit (SET) repository from TrustedSec - All new versions of SET will be deployed here. - trustedsec/social-engineer-toolkit

Last month, Microsoft released patches to address two remote code execution (RCE) vulnerabilities in SharePoint. In both Critical-rated cases, an attacker could send a specially crafted request to execute their code in the context of the SharePoint application…

Privilege escalation always comes down to proper enumeration. But to accomplish proper enumeration you need to know what to check and look for. This takes familiarity with systems that normally comes along with experience. At first privilege escalation can…

I wrote about AutoSploit in a post titled AutoSploit = Shodan/Censys/Zoomeye + Metasploit and it’s subsequent update to AutoSploit 2.2. Recently, AutoSploit 3.0 was released. This post tries to describe the changes between the last release and the newest…

Automation for internal Windows Penetrationtest / AD-Security - S3cur3Th1sSh1t/WinPwn

An example of how to write a custom encoder and decoder in plain assembly.

...or in other words, when failing to reverse a CTF binary makes you loose a job

A little tool to play with Windows security. Contribute to gentilkiwi/mimikatz development by creating an account on GitHub.

Hi, this is a compilation of recon workflows found online. Use it as inspiration for creating your own Web pentest / bug bounty recon workflow.
These are all the ones that I could find. So if yours is missing and you want to see it featured above too, please…

This series of blogposts show how you can identify DOM XSS issues using Sboxr on Single Page or JavaScript rich applications. As examples…

PowerShell and Cobalt Strike scripts for lateral movement using Excel 4.0 / XLM macros via DCOM (direct shellcode injection in Excel.exe) - outflanknl/Excel4-DCOM