In this article, we'll show you how to use Okta to do keylogging for you, without needing to have your own malicious domain hosting your malicious SAML server.

Conference presentation slides. Contribute to onhexgroup/Conferences development by creating an account on GitHub.

In the following blog post, I will introduce you to two techniques similar to NOP-sled or NOP slide, but with the advantage that they are faster. Those techniques are: JMP slide and JCC slide.

ZipLink - Combine Zips and Lnk for fun and profit If you look at typical exploit chains by various threat actors, lnk files still play a huge role. In this post I will share some possible chains I came up to.

BOF for Kerberos abuse (an implementation of some important features of the Rubeus). - RalfHacker/Kerbeus-BOF

Introducing a novel technique for e-mail spoofing

Streamlined Public YARA Rule Collection

Reflective DLL After some time spent on implementing a Reflective DLL and its beloved Loader/Injector I thought that it could have been a very great first topic for what it might become a long-ish series of blog posts about security, but mostly struggles…

Phishing attacks are wreaking havoc across businesses - Using modern phishing techniques, malicious actor(s) can even bypass most MFA methods!

A walkthrough of the assembly code idioms the Rust compiler uses to implement the language’s core features (as they appear in Klabnik’s a...

Video Streaming Portal des Chaos Computer Clubs

This article discusses compromising shared CI/CD runner infrastructure, and how an attacker can escalate their privileges from basic source-repository access to compromising the environments the wider system is deploying.

During our red team operations, we frequently come in contact with organisations using Office 365. The present tooling targeted at this environment is somewhat limited meaning that development is often...

Obfuscated LSASS dumper command A quick walkthrough for a obfuscated PowerShell LSASS dump command via comsvcs.dll. tl;dr Malicious command detection for PowerShell is not easy. Pretty hard to tell, what the following command is going to do, huh? &$env:?…

DLL Side-Loading is a pervasive technique partially because its behavior is difficult to detect. As a sub-technique of DLL Hijacking, it ta

After reading Alex’s latest article, I’m inspired to start a detection serie dedicated to Event Log manipulation techniques, with our first…