Exploring cross-domain & cross-forest RBCD: part 2

Wie die Schweiz sich vom liberalen Rechtsstaat verabschiedet.

Labs to learn about SSH security.

Introduction The MPT protocol used to access files via USB on your phone is not that efficient. This post shows you an alternative to MTP for accessing your files on your mobile phone. It works by ins...

A write-up of CVE-2025-13154, a privilege escalation vulnerability in Lenovo Vantage.

YouTube video by Compass Security

It's important to know if your NTLM relay will be prevented by integrity protections such as EPA, before setting up for and attempting the attack. In this post, we share how to solve this problem for ...

YouTube video by Compass Security

Introduction In pentests, connecting devices to your own network can be very useful. This enables you to exfiltrate data, download tools, analyze the network traffic and even use a transparent HTTP pr...

Uncovering the protection mechanisms provided by modern Windows security features and identifying new methods for credential dumping.

Security analyst Emanuel Duss identified a vulnerability in FortiProxy.

BalCCon2k25 - Against the current

YouTube video by Compass Security

While preparing for my Black Hat and DEF CON talks in July of this year, I found the most impactful Entra ID vulnerability that I will probably ever find. One that could have allowed me to compromise ...

YouTube video by Compass Security

YouTube video by Compass Security

YouTube video by Compass Security

Introduction There are a ton of ways to copy data between two systems. You can use a file sharing service on the Internet, transfer files via your self-hosted server or even use USB drives. This blog ...

Discover the latest enhancements to the DSInternals PowerShell module, including the Golden dMSA Attack and support for LAPS, trust passwords, or BitLocker recovery keys.

AmberWolf Security Research Blog

Find details of upcoming talks from the PortSwigger Research team. We also have research papers and recordings available from previous conferences and events.

How Entra Connect and Intune can be abused via userCertificate hijacking to bypass conditional access and compromise hybrid domains

Active Directory Certificate Services (AD CS) attack surface is pretty well explored in Active Directory itself, with *checks notes* already 16 “ESC” attacks being publicly described. Hybrid attack pa...

The BloodHound Query Library is a community-driven collection of BloodHound Cypher available at https://queries.specterops.io

It is a sad truth in IT security that some vulnerabilities never quite want to die and time and time again, vulnerabilities that have long been fixed get revived and come right back at you. While rese...