RedTeam feed

ARM64 stack internals and obfuscation on Apple Silicon #mdsec Introduction We closely monitor the detection mechanisms employed by EDR sensors to better understand how they identify suspicious activity. Recently, we observed that one of the major players in the... via MDSec Blog (author: Admin)

Improving Your Simple Windows Domain for Offensive Testing: Sysmon #redsiege by Justin Palk A couple of years ago, I put together a series on standing up a simple Windows AD domain in a lab environment. This article is part of […] via RedSiege Blog (author: Taryn Downey)

Return of the Cookie Monster #specterops TL;DR: Cookie protections have made traditional session theft harder, but they do not eliminate the value of an authenticated browser session to adversaries. This post explores enabling the Chrome DevTools Protocol (CDP) inside a running Chromium browser to perform post-ex activities such as browser enumeration, cookie theft, and browser takeover Intro In Dough No! Revisiting […] via SpecterOps Blog (author: Andrew Gomez)

Attack of The Extensions #specterops TL;DR: Browser extensions can turn Chromium into a persistent foothold. This post introduces a way to silently install extensions turning Chromium browsers into a command and control (C2) platform for persistent cookie theft. Intro This blog is a continuation of Dough No! Revisiting Cookie Theft. In the previous blog, we looked at how Chromium’s Application […] via SpecterOps Blog (author: Andrew Gomez)

AI Offense is Not Noclip Mode #trustedsec &LTp>AI doesn't let attackers walk through walls, but it makes finding the cracks more efficient. In this blog, we cut through the hype and explain what AI-driven offense really looks like and why hard controls still work.&LT/p> via TrustedSec Blog (author: Justin Elze)

Blacklight: Illuminating AI Agent Artifacts for Attackers and Defenders #specterops TL;DR: Blacklight is an open-source security research toolkit for discovering and analyzing AI agent artifacts that reside on endpoints. It helps authorized security teams assess exposure, guide next decisions, and develop detection and hardening guidance. This project used models made available through SpecterOps’ participation in OpenAI’s Trusted Access for Cyber program to support this security […] via SpecterOps Blog (author: Gavin Kramer)

Can AI invent new attack techniques? New research from James Kettle and PortSwigger Research #portswigger We already know AI can find vulnerabilities. James Kettle, PortSwigger's Director of Research, wanted to answer a harder question: can an autonomous system invent genuinely new attack techniques? To f via PortSwigger Blog

Critical SQL Injection in Metabase via Password Reset: CVE-2026-72898 #bishopfox Immediate action is advised for all organizations running self-hosted Metabase. A critical, unauthenticated SQL injection vulnerability has been disclosed in Metabase's password reset functionality, and Metabase has confirmed active exploitation in the wild. via BishopFox Blog

A Vault With No Treasure - CMMC Level 2 Compliance for Subcontractors With No CUI #trustedsec &LTp>This blog post should not exist, but it does due to an unfortunate reality: Many large prime defense contractors are attempting to impose CMMC Level 2 audit requirements on subcontractors that do not handle Controlled…&LT/p> via TrustedSec Blog (author: Chris Camejo)

Python Software Foundation - Python 3.11.0a3 to 3.15.0b2 #bishopfox Bishop Fox discovered a privilege escalation vulnerability in Python for Windows affecting versions 3.11.0a3 through 3.15.0b2. A low-privilege user can plant malicious files and wait for a privileged account to run the interpreter, inheriting that account's elevated access. Patches are available. via BishopFox Blog

CSS:the bomb inside your inbox #portswigger Gareth Heyes - gareth.heyes@portswigger.net - @garethheyes It's quite common for webmail clients to render untrusted CSS in a trusted UI. They attempt to make this safe using CSS sanitization. In this via PortSwigger Research

Can AI do novel security research? Meet the HTTP Terminator #portswigger Abstract We all know AI can find bugs. After a decade of research, I asked a harder question: can an autonomous system invent new attack techniques, and use them to hack live websites at scale? Buildi via PortSwigger Research

The Art of Hunting Azure Cloud Secrets #trustedsec &LTp>Finding secrets in the cloud is what can turn a normal cloud test into a privilege escalation game changer. The approach to finding secrets is what may separate your next cloud penetration test from a finding expedition…&LT/p> via TrustedSec Blog (author: Edwin David)

CRLF-Powered Desync Attacks: Beheading HTTP Streams #portswigger Abstract In this paper we’ll show that HTTP Header Injection is severely underestimated. Forget open redirects or Cross-Site Scripting and instead, embrace the catastrophic potential of the CRLF-Power via PortSwigger Research

Can AI do novel security research? Meet the HTTP Terminator #portswigger Abstract We all know AI can find bugs. After a decade of research, I asked a harder question: can an autonomous system invent new attack techniques, and use them to hack live websites at scale? Buildi via PortSwigger Research

Turning Enterprise Update Servers Into Backdoor Factories (0_o) – Part 2 #specterops TL;DR: When WSUS downloads files for updates, it requires the server to leverage the BITS protocol. WSUS normally requires executables to be digitally signed, however this can be bypassed by appending the .esd or .txt file extensions. Introduction In Part 1 of this series, I walked through the necessary stored procedures used to create a […] via SpecterOps Blog (author: Beyviel David)

Turning Enterprise Update Servers Into Backdoor Factories (0_o) – Part 1 #specterops TL;DR: This is part 1 of a 2 part blog series sharing what I have discovered in my Windows Service Update Service (WSUS) research. If the WSUS database is configured on a separate server from the upstream WSUS server, we can coerce the WSUS computer account to the WSUS database and establish a SQL session. […] via SpecterOps Blog (author: Beyviel David)

Of Course We Built a WSUS Ludus Lab #specterops TL;DR: This blog walks you through setting up a WSUS lab using Ludus for testing. The associated GitHub repo is here. Introduction I have been researching the Windows Service Update Service (WSUS) and discovered a new way we could take over the WSUS infrastructure and deploy custom payloads for lateral movement. As part of this […] via SpecterOps Blog (author: Beyviel David)

Weaponizing Windows Updates with NotWSUSpicious #specterops TL;DR: NotWSUSpicious is a tool repo to aid in creating custom updates after gaining access to a WSUS database server. The Turning Enterprise Update Servers Into Backdoor Factories (0_o) series covers how the database takeover works. This blog strictly covers how to use the tooling. The series can be found here: Turning Enterprise Update Servers […] via SpecterOps Blog (author: Beyviel David)

Borrowing Windows Hello keys for authentication and persistence #dirkjanm Most research into Windows Hello focuses on the mechanics in use when authenticating to the local device. As an Entra ID researcher, I’ve always been more interested in how these keys are used to authenticate to the cloud. I’ve given several talks on Windows Hello for Business (WHFB for short) and about the many implementation flaws discovered in the process, most of which were fixed by Microsoft. For this blog I want to focus on a technique that was left as-is since it is more or less a consequence of how WHFB works: the ability to perform single-sign on with the backing cryptographic keys from a user session, without needing the PIN or other information/user presence. We will not just look at how we can utilize this to request Primary Refresh Tokens (PRTs), but also how we can use this to perform device registration by using the WHFB key as a FIDO key/passkey. via Dirk-jan Blog (author: Dirk-jan Mollema)