waf-fu, or Some Log Replay Nonsense
#trustedsec
<p>1 waf-fu Your Way to Better Credential&nbsp;AccessSo, a gig or two ago I was reviewing CloudWatch logs to search for any credentials that I may be able to use, in order to gain additional access to the environment.…</p>
via TrustedSec Blog (author: Lilly Mayo)
#trustedsec
<p>1 waf-fu Your Way to Better Credential&nbsp;AccessSo, a gig or two ago I was reviewing CloudWatch logs to search for any credentials that I may be able to use, in order to gain additional access to the environment.…</p>
via TrustedSec Blog (author: Lilly Mayo)
Red Team AI Skills
#outflank
Today, SpecterOps released a new open-source skills marketplace for offensive security research and red team operations. We are proud to have collaborated on this project over the last few weeks and hope more teams will join now that it’s public. The initial release includes plugins for Fortra’s Cobalt Strike and Outflank C2. Get started here: https://github.com/SpecterOps/skills
Background
I recently reached out to a few red teams we’ve worked with before to discuss developing a public AI marketplace focused on offensive security. I was inspired by the Trail of Bits marketplace and wanted to see a similar project for offensive security. This task was too large to take on alone, so I contacted a few other researchers to discuss a joint effort. Imagine my surprise when SpecterOps told me they were nearly done implementing a similar project!
via Outflank Blog (author: Kyle Avery)
#outflank
Today, SpecterOps released a new open-source skills marketplace for offensive security research and red team operations. We are proud to have collaborated on this project over the last few weeks and hope more teams will join now that it’s public. The initial release includes plugins for Fortra’s Cobalt Strike and Outflank C2. Get started here: https://github.com/SpecterOps/skills
Background
I recently reached out to a few red teams we’ve worked with before to discuss developing a public AI marketplace focused on offensive security. I was inspired by the Trail of Bits marketplace and wanted to see a similar project for offensive security. This task was too large to take on alone, so I contacted a few other researchers to discuss a joint effort. Imagine my surprise when SpecterOps told me they were nearly done implementing a similar project!
via Outflank Blog (author: Kyle Avery)
Improving Your Simple Windows Domain for Offensive Testing: Installing MS SQL Server Express on Windows Server 2022 Server Core Edition
#redsiege
by Justin Palk A couple of years ago, I put together a series on standing up a simple Windows AD domain in a lab environment. This article is part of […]
via RedSiege Blog (author: Taryn Downey)
#redsiege
by Justin Palk A couple of years ago, I put together a series on standing up a simple Windows AD domain in a lab environment. This article is part of […]
via RedSiege Blog (author: Taryn Downey)
LLMHaxor Update
#trustedsec
<p>Today I am sharing some updates on a tool I created from an earlier time — before Burp Suite included native AI testing enhancements and before an almost explosive growth of open-source AI tooling and testing frameworks…</p>
via TrustedSec Blog (author: Geoff Walton)
#trustedsec
<p>Today I am sharing some updates on a tool I created from an earlier time — before Burp Suite included native AI testing enhancements and before an almost explosive growth of open-source AI tooling and testing frameworks…</p>
via TrustedSec Blog (author: Geoff Walton)
Signature Optional - Analysis of CVE-2026-28323
#bishopfox
SolarWinds Web Help Desk treated SAML signature verification as optional and skipped every other validation the spec requires. Bishop Fox confirmed the full exploit end to end: one forged POST request, no credentials, full session takeover. Here is the root cause, the fix, and how to detect it.
via BishopFox Blog
#bishopfox
SolarWinds Web Help Desk treated SAML signature verification as optional and skipped every other validation the spec requires. Bishop Fox confirmed the full exploit end to end: one forged POST request, no credentials, full session takeover. Here is the root cause, the fix, and how to detect it.
via BishopFox Blog
NetNTLMv1 Is Dead. Long Live NetNTLMv1.
#outflank
Fitting lossless rainbow tables on a 4 TB disk and cracking NetNTLMv1 with WebGPU and
Google’s release of the NetNTLMv1 rainbow tables made it much more practical to recover an NT hash from a NetNTLMv1 response captured with the fixed challenge
NetNTLMv1 cracking is a problem I’ve kept returning to over the past several years. The recent table release prompted me to explore whether the process could be made cheaper, faster and easier to run. This post describes the result: a compact indexed table format, a WebGPU browser client and a native command-line tool.
Highlights
This post explains a new
via Outflank Blog (author: Cedric Van Bockhaven)
#outflank
Fitting lossless rainbow tables on a 4 TB disk and cracking NetNTLMv1 with WebGPU and
ntlmrain.Google’s release of the NetNTLMv1 rainbow tables made it much more practical to recover an NT hash from a NetNTLMv1 response captured with the fixed challenge
1122334455667788, further reducing the needed compute power.NetNTLMv1 cracking is a problem I’ve kept returning to over the past several years. The recent table release prompted me to explore whether the process could be made cheaper, faster and easier to run. This post describes the result: a compact indexed table format, a WebGPU browser client and a native command-line tool.
Highlights
This post explains a new
ntlmrain rainbow table layout. We are publicly releasing a browser tool and command-line client together with the optimized tables.via Outflank Blog (author: Cedric Van Bockhaven)
Token Analysis and Tracking System (TATS)
#specterops
TL;DR: Tracking OAuth tokens is hard, but Token Analysis and Tracking System (TATS) can help. TATS will collect, store, decode, analyze and provide visual tracking for OAuth token exchanges. It was built to account for known OAuth deviations in the Microsoft ecosystem and will work with any OAuth implementation. This blog explores functionality along with […]
via SpecterOps Blog (author: Hope Walker)
#specterops
TL;DR: Tracking OAuth tokens is hard, but Token Analysis and Tracking System (TATS) can help. TATS will collect, store, decode, analyze and provide visual tracking for OAuth token exchanges. It was built to account for known OAuth deviations in the Microsoft ecosystem and will work with any OAuth implementation. This blog explores functionality along with […]
via SpecterOps Blog (author: Hope Walker)
So… You Found AWS Access Keys (Part 1)
#trustedsec
<p>Finding plaintext access keys to an AWS account during an engagement is always great thrill. What can be done with them? What do they have access to? Are they even for any of the accounts in scope? It can be super…</p>
via TrustedSec Blog (author: Lilly Mayo)
#trustedsec
<p>Finding plaintext access keys to an AWS account during an engagement is always great thrill. What can be done with them? What do they have access to? Are they even for any of the accounts in scope? It can be super…</p>
via TrustedSec Blog (author: Lilly Mayo)
Unmasking SCCM Application Execution
#specterops
TL;DR: Executing applications instead of scripts via SCCM’s deploy application feature will generate different artifacts due to the fundamental differences in the execution flow. While existing detection tools can catch script-based execution, they often miss stealthier methods. This post covers how to detect the more evasive SCCM application execution. Introduction: During BlackHat 2025’s offering of […]
The post Unmasking SCCM Application Execution appeared first on SpecterOps.
via SpecterOps Blog (author: Joshua Prager)
#specterops
TL;DR: Executing applications instead of scripts via SCCM’s deploy application feature will generate different artifacts due to the fundamental differences in the execution flow. While existing detection tools can catch script-based execution, they often miss stealthier methods. This post covers how to detect the more evasive SCCM application execution. Introduction: During BlackHat 2025’s offering of […]
The post Unmasking SCCM Application Execution appeared first on SpecterOps.
via SpecterOps Blog (author: Joshua Prager)
Mind the Config: Detecting and Weaponizing NetScaler CVE-2026-19490
#bishopfox
A single unauthenticated request bypasses authentication on NetScaler Gateway and AAA virtual servers. Whether that means a dead-end session, a proxy into the internal network, or root on the appliance depends entirely on configuration. Bishop Fox maps every branch and shares a safe detection tool.
via BishopFox Blog
#bishopfox
A single unauthenticated request bypasses authentication on NetScaler Gateway and AAA virtual servers. Whether that means a dead-end session, a proxy into the internal network, or root on the appliance depends entirely on configuration. Bishop Fox maps every branch and shares a safe detection tool.
via BishopFox Blog
CVE-2026-82329: Unauthenticated Administrative Access in JFrog Artifactory via an Empty Cluster Join Key
#bishopfox
A misconfigured cluster join key in JFrog Artifactory's default install lets unauthenticated attackers mint a permanent admin token in one request. Bishop Fox reproduced the full chain, confirmed in-the-wild exploitation, and shares a non-invasive detection check and remediation guidance.
via BishopFox Blog
#bishopfox
A misconfigured cluster join key in JFrog Artifactory's default install lets unauthenticated attackers mint a permanent admin token in one request. Bishop Fox reproduced the full chain, confirmed in-the-wild exploitation, and shares a non-invasive detection check and remediation guidance.
via BishopFox Blog
Ghostwriter v7.3.0: A Fresh New Look
#specterops
TL;DR: The upcoming Ghostwriter v7.3.0 release brings a major UI refresh to nearly every part of the application. The new design is easier on the eyes, more accessible, and better organized, with a new engagement bar, customizable sidebar with pinned work, a completely redesigned dashboard, and a plethora of other changes. Introduction As it is […]
via SpecterOps Blog (author: Katherine)
#specterops
TL;DR: The upcoming Ghostwriter v7.3.0 release brings a major UI refresh to nearly every part of the application. The new design is easier on the eyes, more accessible, and better organized, with a new engagement bar, customizable sidebar with pinned work, a completely redesigned dashboard, and a plethora of other changes. Introduction As it is […]
via SpecterOps Blog (author: Katherine)
Unpacking a laZzzy Donut
#trustedsec
Recently, we came across an interesting malware sample. It used a multi-stage malware loader that chains together obfuscation and shellcode-injection techniques. The sample begins as obfuscated Python bytecode and…
via TrustedSec Blog (author: Scott Nusbaum)
#trustedsec
Recently, we came across an interesting malware sample. It used a multi-stage malware loader that chains together obfuscation and shellcode-injection techniques. The sample begins as obfuscated Python bytecode and…
via TrustedSec Blog (author: Scott Nusbaum)
CiliumHound: Graphing Kubernetes Network Policies
#specterops
TLDR: CiliumHound is a BloodHound OpenGraph extension for auditing Cilium network policies. It ingests a folder of JSON or YAML policies and creates a searchable, Kubernetes namespace-scoped graph. Introduction On some recent assessments, I’ve had to review large, complex Cilium network policies in a Kubernetes cluster, looking for ways in or out of isolated namespaces. […]
via SpecterOps Blog (author: Andrew Luke)
#specterops
TLDR: CiliumHound is a BloodHound OpenGraph extension for auditing Cilium network policies. It ingests a folder of JSON or YAML policies and creates a searchable, Kubernetes namespace-scoped graph. Introduction On some recent assessments, I’ve had to review large, complex Cilium network policies in a Kubernetes cluster, looking for ways in or out of isolated namespaces. […]
via SpecterOps Blog (author: Andrew Luke)
MikroTrick: Inside the RouterOS Takeover Chain
#bishopfox
Attackers were exploiting MikroTik routers before fixes went public. Bishop Fox reproduced the full unauthenticated takeover chain, found persistence artifacts on real compromised devices, and breaks down what defenders need to investigate beyond patching to confirm they are actually clean.
via BishopFox Blog
#bishopfox
Attackers were exploiting MikroTik routers before fixes went public. Bishop Fox reproduced the full unauthenticated takeover chain, found persistence artifacts on real compromised devices, and breaks down what defenders need to investigate beyond patching to confirm they are actually clean.
via BishopFox Blog
From Fork to Framework: What Modifying Apollo Taught Us About Agent Invasion
#bishopfox
Forking an existing C2 agent sounds faster than building from scratch. Bishop Fox learned otherwise. This post documents what happened when they forked Apollo, built a custom obfuscation pipeline to defeat EDR detection, and spent months fighting an architecture that was never designed for it.
via BishopFox Blog
#bishopfox
Forking an existing C2 agent sounds faster than building from scratch. Bishop Fox learned otherwise. This post documents what happened when they forked Apollo, built a custom obfuscation pipeline to defeat EDR detection, and spent months fighting an architecture that was never designed for it.
via BishopFox Blog
HTTP/3 in Burp Suite - it’s time to find a bigger wordlist
#portswigger
How many bugs have you missed because you didn’t send quite enough HTTP requests? Turbo Intruder now supports HTTP/3, can comfortably exceed 100,000 requests per second over Wi-Fi, and auto-tunes for
via PortSwigger Research
#portswigger
How many bugs have you missed because you didn’t send quite enough HTTP requests? Turbo Intruder now supports HTTP/3, can comfortably exceed 100,000 requests per second over Wi-Fi, and auto-tunes for
via PortSwigger Research
What's New in hate_crack Since 2.0
#trustedsec
<p>Part 1 of 3. This post is the reference for the attacks and features. Part 2 (coming soon) is a deep dive into HashcatRosetta, the rule-analysis engine behind &quot;Analyze Hashcat rules&quot; in Rule File Tools, and…</p>
via TrustedSec Blog (author: Justin Bollinger)
#trustedsec
<p>Part 1 of 3. This post is the reference for the attacks and features. Part 2 (coming soon) is a deep dive into HashcatRosetta, the rule-analysis engine behind &quot;Analyze Hashcat rules&quot; in Rule File Tools, and…</p>
via TrustedSec Blog (author: Justin Bollinger)
AI for Offensive Security: What Works, What Does Not, and How to Adopt It
#specterops
Companies frequently ask SpecterOps some version of the same question: How are you using AI in offensive security, and how can we begin using it too? They want practical guidance. Which parts of an assessment are improving now? Where does the technology still fail? What should a team learn or build first? Demystifying adversary tradecraft is part of SpecterOps’s core purpose. Through GhostWorks, we apply that purpose to AI by testing […]
via SpecterOps Blog (author: Heather Simpson)
#specterops
Companies frequently ask SpecterOps some version of the same question: How are you using AI in offensive security, and how can we begin using it too? They want practical guidance. Which parts of an assessment are improving now? Where does the technology still fail? What should a team learn or build first? Demystifying adversary tradecraft is part of SpecterOps’s core purpose. Through GhostWorks, we apply that purpose to AI by testing […]
via SpecterOps Blog (author: Heather Simpson)
SpecterOps
AI for Offensive Security: What Works, What Does Not, and How to Adopt It
SpecterOps practitioners break down where AI is proving useful in offensive security, where current workflows reliably fail, and what a team should build first.
Red Siege at Wild West Hackin’ Fest Deadwood 2026: What to Expect
#redsiege
As proud sponsors of Wild West Hackin’ Fest, Red Siege is heading back to Deadwood! WWHF is always a big one for us, and this year we’re bringing training, talks, […]
via RedSiege Blog (author: Taryn Downey)
#redsiege
As proud sponsors of Wild West Hackin’ Fest, Red Siege is heading back to Deadwood! WWHF is always a big one for us, and this year we’re bringing training, talks, […]
via RedSiege Blog (author: Taryn Downey)