YouTube video by Compass Security

Guest Post: In modern network architecture, we often assume that perimeter defences are robust enough to keep internal traffic secure. However, vulnerabilities inherent in the trust mechanisms of fund...

Tool to enumerate privileged Scheduled Tasks on Remote Systems - 1r0BIT/TaskHound

Lab used for workshop and CTF. Contribute to Pennyw0rth/NetExec-Lab development by creating an account on GitHub.

Extracts browser-stored data such as refresh tokens, cookies, saved credentials, credit cards, autofill entries, browsing history, and bookmarks from modern Chromium-based and Gecko-based browsers ...

ProfileHound - BloodHound OpenGraph collector for user profiles stored on domain machines. Make informed decisions about looting secrets by identifying active user profiles on domain machines. - m4...

Learn how to eliminate manual deployment and reduce operational risk with Sysmon functionality in Windows.     

Harden Windows Safely, Securely using Official Supported Microsoft methods and proper explanation | Always up-to-date and works with the latest build of Windows | Provides tools and Guides for Pers...

Prowler is the Open Cloud Security platform for AWS, Azure, GCP, Kubernetes, M365 and more. It helps for continuous monitoring, security assessments & audits, incident response, compliance, har...

A resource containing all the tools each ransomware gangs uses - BushidoUK/Ransomware-Tool-Matrix

Threat actors are bypassing MFA with adversary-in-the-middle attacks via reverse proxies. Phishing-as-a-Service tools like Evilproxy make these threats harder to detect.

Generate obfuscated command-line arguments for common system-native executables now with ArgFuscator.

The Privacy Checkup was launched as part of Data Privacy Week 2024 and helps you to determine whether or not you’re sufficiently protecting your data online.

Recent VMware vulnerabilities have reignited the threat of VM escapes, enabling attackers to bypass security controls and deploy ransomware. Learn how adversaries exploit these flaws and how to streng...

Du bestellst im Internet? Natürlich bestellst Du im Internet. Aber dieses Mal wird Deine Ware nicht geliefert. Stattdessen sind Dein Geld...

Today is the day! I'm announcing the release of my guide: "Mastering Sysmon: Deploying, Configuring, and Fine-Tuning", a free mini eBook designed specifically for digital forensics and incident respon...

Datenschutz – Unter dem Radar

Python implementation of GhostPack's Seatbelt situational awareness tool - 0xthirteen/Carseat

Captchas, Monero, Scams and absolutely no JavaScript

Explore the art of phishing, learn how to spot common phishing scams and red flags, and understand the importance of security awareness training.

A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server. - netero1010/EDRSilencer

Die 24. BigBrotherAwards fanden am 11. Oktober 2024 in der Hechelei in Bielefeld statt. Eine vorläufige Version des Livestreams finden Sie auf unserer

The difficult part of the initial response to a human-operated ransomware attack is identifying the attack vector. You may already know from recent security incident trends that the vulnerabilities of...

Channel Binding is a LDAP hardening setting that is often misunderstood and as a result is often not enabled.  In this post I explain why it is important along..

Tool designed to find folder exclusions using Windows Defender using command line utility MpCmdRun.exe as a low privileged user, without relying on event logs - Friends-Security/SharpExclusionFinder

Password spraying is a well-known technique which consists of testing the same password on several accounts. Although the technique seems simple, it’s not easy to put it into practice without side eff...

Like every year at LeHack, I was lucky enough to take part in mpgn's Active Directory workshop. The aim of the workshop was to compromise an Active Directory environment and become a Domain Admin of 2...

During an internal penetration test, Cortex EDR was installed in the domain controller. After obtaining Domain Admin privileges on the…

Kerberoasting allows attackers to determine sensitive passwords and the most common place for detecting this attack is on the domain controller. In this

An ADCS honeypot to catch attackers in your internal network. - srlabs/Certiception

Der belgische Vorschlag zur Chatkontrolle, den wir im Volltext veröffentlichen, wird die Verschlüsselung schwächen. Das sehen auch 36 Abgeordnete aus dem Europaparlament und dem Bundestag so. Am Donne...

Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows fixing issues that you may find in them. - GitHub - EvotecIT/GPOZaurr: Group Policy E...

I’ll Make You Great at Phishing or Your Money Back

ScriptSentry finds misconfigured and dangerous logon scripts. - techspence/ScriptSentry

Active Directory delegation management tool. Contribute to mtth-bfft/adeleg development by creating an account on GitHub.

Morphisec researchers have identified a critical Microsoft Outlook vulnerability, CVE-2024-30103, and detail its technical impact and recommended actions.

A small tool built to find and fix common misconfigurations in Active Directory Certificate Services. - TrimarcJake/Locksmith

Penetration testing applications for both iOS and Android platforms serve as invaluable tools for security professionals and ethical hackers to assess the security posture of mobile applications. These applications typically offer a range of features...

We will cover various policies and procedures to harden a Windows LAPS deployment.

Living Off the Living Off the Lands

How to Give your Phishing Domains a Reputation Boost