DiagNG, the open-source successor to QCSuper: a Linux GUI tool, now in beta, that produces 2G/3G/4G/5G PCAP captures from Qualcomm Snapdragon basebands.

Details a pre-auth format string vulnerability in tac_plus, a popular daemon implementing TACACS+ for network device management, and the shared secret oracle that makes it a practical RCE chain.

Card Relay Internals How a physical smart card connected to a desk-side reader can be made to communicate with a remote terminal as if the card were connected locally. The research focuses on ISO/I…

Revive any Raspberry Pi as a self-hosted audio streamer. AirPlay 2, Spotify, Snapcast multiroom, Home Assistant. One curl install. Free Volumio alternative.

Deep dive analysis of the TETRA cyber incident which disrupted operations at Taiwan High Speed Rail (THSR) in April 2026.

Read every packet. Spot every anomaly. Baseline your OT network before attackers do.

Comprehensive telecom protocol reference for Diameter AVPs, GTPv2-C IEs, MAP operations, 5G SBI APIs, and PFCP. Search and explore protocol specifications instantly.

Interactive RFID Attack Matrix with discovery workflows, attack paths, and countermeasures.

Analyze Entra ID Conditional Access policies offline. CAPSlock simulates sign-ins and exposes enforcement gaps without generating tenant activity.

Leaders in Information Security

A simple database of Windows RPC interfaces (DCE/RPC & Named Pipes)

TL;DR When operating out of a ceded access or phishing payload with no credential material, you can use low-privilege HTTP authentication from the current user context to perform a proxied relay to LD...

I was already worked with smart cards and I am familiar with APDU commands (that are defined in ISO/IEC 7816 and Global Platform specifications). Now I want to know if there is any way to send an...

Complete SMS packet manipulation. Contribute to mnemonic-no/ScapySMS development by creating an account on GitHub.

Windows RPC enumeration, discovery, and auditing via NtObjectManager. We will audit the vulnerable RPC interfaces that lead to PetitPotam, discover how they have changed over the past year, and overco...

Policy Module for Microsoft Active Directory Certificate Services - Sleepw4lker/TameMyCerts

Learn the basics of RPC, develop a client and server using C++

Three device vulnerabilities in Gen 3 Sepura devices (such as the SC20 series) ranging from code execution to key exfil, requiring only brief physical access.

* USING LLFUZZ TO EXPOSE CRITICAL VULNERABILITIES IN BASEBAND LOWER LAYERS * - One malformed packet is enough to crash a smartphone -- To be presented at USENIX Security 2025 Baseband modems handle a...

PENGUIN (Personalized EmulatioN Generated Using Instrumented Analysis) takes a target centric approach to rehosting using a precise and tailored specification of the rehosting process - rehosting/p...

NTLM relay attacks targeting SMB restrict lateral movement options to those that solely require port 445/TCP. Learn at least one method of overcoming this restriction to enable additional lateral move...

Local SYSTEM auth trigger for relaying. Contribute to rtecCyberSec/RAITrigger development by creating an account on GitHub.

Network Access Account, Task Sequence, and Collection Settings policies can be recovered from SCCM by relaying a remote management point site system to the site database server.

LudusHound is a tool for red and blue teams that transforms BloodHound data into a fully functional, Active Directory replica environment via the Ludus framework for controlled testing.

The independent security researcher Adam Gowdiak has published an extensive report on flaws he found in some eUICCs (the chips used to store eSIM profiles within the GSMA eSIM architecture). While th

During a recent incident response case, my colleague Yann M. observed the following file access: \\localhost\C$\@ GMT-2025.06.21-10.53.43\Windows\NTDS\ntds.dit This is a...

Leaders in Information Security

The ability of an attacker controlling one domain to compromise another through an Active Directory (AD) trust depends on the trust type and configuration. To better map these relationships and make i...

Account Operators can compromise an Active Directory domain by using Incoming Forest Trust Builders and DnsAdmins to create a trust with TGT delegation enabled.

Explore the vulnerabilities of the GPRS Roaming eXchange (GRX) network, its exposure to cyber threats, and the critical security measures needed to protect mobile operators and nation-state infrastruc...

Last year I challenged myself to successfully revisit buffer overflows on a fully patched and updated version of Windows 11. Specifically, Windows 11 24H2. The last time I had messed with buffer ove...