Archive

I’ve had a number of people ask me what approaches I have taken to secure that initial foothold on a machine/network during a pentest engagement. Well, the blunt and honest answer to that question is…it depends 😸 Initial access comes in many forms and depending on the type of pentest engagement, you will be afforded or NOT afforded various types of “lures” you can use to acquire that first foothold. Most clients are open to the pentest team exhausting all their resources and offensive tooling to truly assess the client’s security controls. If not they should be. Because in a real world attack, you better believe the threat actor will not hold back! In today’s post, I’ll be going over a very traditional approach to achieving initial access using email as our attack vector of choice. I’ll go over various ways to send the email (gui and non-gui) and using attachments versus links. I’ll also explain how to contend with MOTW (Mark of the Web) and SmartScreen security restrictions on your downloaded payloads for the modern Windows 11 environment.

High-Scale Driver Vulnerability Research with Agent Swarms

CVE-2026-34197 is an ActiveMQ RCE flaw exploiting Jolokia to execute remote commands. Learn how it works, affected versions, and detection steps.

CVE-2026-34980 + CVE-2026-34990: two CUPS vulnerabilities, discovered by an autonomous LLM pipeline, chainable from unaut'd remote print job to root file (over)write.

Censys ARC discovered a previously undocumented, Russian-origin remote access toolkit dubbed "CTRL." Learn about the malware and how it works.

Samsung Internet on the Galaxy S25 shipped a six-month-old version of V8, exposing it to publicly known bugs. Learn how we exploited a bytecode interpreter vulnerability to achieve renderer RCE and universal XSS in the browser.

The article demonstrates how to analyze Windows shellcode in Ghidra by identifying API-hashing routines, resolving hidden Windows API calls, and extracting C2 infrastructure without relying on automated emulation tools.

Unlock the power of Microsoft Office with the ultimate Red Teaming toolkit, leveraging Evilginx, ROADtools, TeamFiltration, and Bobber to gain…

he article demonstrates an NTLM relay attack against Active Directory using tools like ntlmrelayx and PetitPotam. By relaying authentication to LDAP, attackers can create accounts, abuse delegation, and gain administrative access.

Imagine that you’re a SOC (Security Operations Center) analyst receiving an alert about suspicious behavior from a binary on an EC2 instance. After checking the binary on VirusTotal, you find it was an AWS-developed software signed by Amazon. Further investigation reveals that it communicated only with Amazon-owned IP addresses.

Introduction Many organisations are turning to virtualisation of apps and desktops. This often involves virtualisation platforms such as Citrix to deliver these services.  Get your configuration or lock-down wrong and you’ll find users ‘breaking out’ of the environment you thought you had secured. It might not be long after that when you find that your entire domain […]

A collection of files with indicators supporting social media posts from Palo Alto Network's Unit 42 team to disseminate timely threat intelligence. - PaloAltoNetworks/Unit42-timely-threat-intel

Research shows how Palo Alto Cortex XDR predefined BIOC behavioral rules can be decrypted and analyzed. By understanding rule logic and built-in exceptions, attackers can adapt techniques to evade detection and bypass behavioral protections.

How I Found a 0-Day in an Electron App’s Email Viewer Most people think 0-days are found in glamorous places: cryptography, kernel code, browser internals, or some deeply obfuscated subsystem that …

“Silent Harvest” explains how attackers can quietly extract sensitive Windows secrets such as credentials and security keys by abusing legitimate registry and system mechanisms, avoiding LSASS dumping and bypassing many common EDR detections.

Contribute to awais0x1/2fa-bypass development by creating an account on GitHub.

TLDR This post shows how to achieve a full authentication bypass in the Ruby and PHP SAML ecosystem by exploiting several parser-level inconsistencies: including attribute pollution, namespace confusi

Introduction

I discovered a remote code execution vulnerability on the Tapo C260 after a fun journey of reverse-engineering and understanding its interactions with TP-Link Cloud.

Leveraging LLMs and patch diffing, this research details a Use-After-Free vulnerability in Windows DWM, demonstrating a reliable exploit that achieves escalation from low-privileged user permissions to SYSTEM.

Hardcoded credentials, pointless encryption, and generous APIs exposed details of every employee and made it possible to break into internal websites.

After a long week, the Eye Security Research Team thought it was time for a small light-hearted distraction. So we rooted Copilot.

A detailed walkthrough of the 'Yet Another ZIP Trick' challenge from HackArcana, covering schizophrenic ZIP file creation and binary exploitation techniques.

Мы в PT SWARM, как сейчас модно говорить, любим челленджи — ставить перед собой большие и сложные задачи, которые решаем путем их разбивки на