Stay updated with the newest cybersecurity articles and insights.
Learn how TelemetryController is exploited for backdoor persistence on Windows, including issues on Win7/Server 2012 R2 and defense tips.
Read Analysis of Backdoor Implementation Using TelemetryController
Analyze SharpSniper for locating domain user IPs via DC logs. Learn implementation with wevtutil and PowerShell for security log queries and IP extraction.
Read Analysis of SharpSniper Exploitation
Test and analyze Donut, a tool converting .NET assemblies to stealthy shellcode for memory-based exploitation, injection, and bypassing defenses like AppLocker.
Read Shellcode Generation Tool Donut Testing and Analysis
Analysis of Cobalt Strike's blockdlls feature, covering detection, exploitation, and differences between Win8/Win10 systems with code examples.
Read Analysis of Cobalt Strike's blockdlls Exploitation
Technical analysis of APT34's leaked HighShell and HyperShell webshells, including login credentials, Exchange backdoors, and command execution methods.
Read Analysis of APT34 Leaked Tools - HighShell and HyperShell
Learn methods to switch from admin to system privileges in penetration testing, including service creation, MSIExec, token duplication, and Capcom.sys techniques.
Read Penetration Techniques - Switching from Admin Privileges to System Privileges
Learn penetration techniques for Windows Defender: disable real-time protection, manage exclusions, bypass tamper protection, and restore quarantined files with commands.
Read Penetration Basics - Windows Defender
Learn how to exploit net sessions in Windows for penetration testing, including token theft with mimikatz and incognito, for privilege escalation and lateral movement.
Read Penetration Techniques - Exploitation of net session in Windows
Explore fileless penetration techniques using virtual disks for RAM-based execution, avoiding hard drive writes. Learn implementation, forensic analysis, and detection methods.
Read Penetration Techniques - 'Fileless' Implementation Using Virtual Disks
Learn to implement a webshell supporting NTLM Over HTTP for command-line use in environments like Exchange and SharePoint. Includes code and design details.
Read Penetration Basics - Implementation of Webshell Supporting NTLM Over HTTP Protocol
Learn how to use xwizard.exe, a Microsoft-signed binary, to load custom DLLs and bypass application whitelist restrictions. Step-by-step guide with practical testing on Win7 x86.
Read Use xwizard.exe to load dll
Step-by-step guide to install and configure F5 BIG-IP for vulnerability debugging, including setup, tmsh usage, and log management.
Read F5 BIG-IP Vulnerability Debugging Environment Setup