In June the OWASP PTK add-on graduated to beta with its integration now properly matching ZAP’s architecture, a security advisory was issued and patched for the Viewstate add-on, and the Client Spider...

Lately I’ve been studying CRTL which focuses on developing offensive tradecraft using Crystal palace framework. I never had the chance to use it before this, so am not an expert in any type of way.

LibIPC is a simple Crystal Palace shared library for inter-process communication, based on Named Pipes. - pard0p/LibIPC

Since my previous talk about this topic in 2022 major improvements in the OpenBSD network stack have been achieved. The socket API has been unlocked in the kernel. This means that multiple userland ...

The CVE‑2025‑6543 NetScaler ADC vulnerability - patched in late June 2025 - has been exploited as a zero-day vulnerability since May 2025.

Since March 2025, fake contract emails have been spreading Batavia spyware in targeted attacks on Russian organizations.

RunAs Utility Credential Stealer implementing 3 techniques : Hooking CreateProcessWithLogonW, Smart Keylogging, Remote Debugging - DarkSpaceSecurity/RunAs-Stealer

Kaspersky researchers discovered GitVenom campaign distributing stealers and open-source backdoors via fake GitHub projects.

Learn how Elastic Security leveraged open-source BOFs to achieve detection engineering goals during our most recent ON week.

Contribute to antitree/seccomp-diff development by creating an account on GitHub.

Discover how a code review uncovered a JWT algorithm confusion vulnerability (CVE-2024-54150). Learn key insights to enhance your security skills and spot vulnerabilities effectively.

В России скопилась огромная рублёвая масса, которая уже вскоре хлынет на рынок и вызовет массовый спрос на валюту, это обвалит курс рубля как минимум до 200 за доллар.

Find out about the Next.js vulnerability CVE-2024-51479 that could have exposed sensitive data. Take necessary measures to secure your Next.js application.

I am currently procrastinating undoing the mess I made with CMake files for a bigger project I’m working on. It’s not hard– it’s just annoying, and I have no one to blame but myself. I did this intent...

YouTube video by Objective-See Foundation

I am old enough to remember that it was not always possible to get domain admin within the first hour of a test via Active Directory Certificate Services (ADCS) misconfigurations or over permissioned ...

Certificate mapping is the process at the heart of multiple ADCS vulnerabilities, so I thought it would be appropriate to dedicate it its…

Learn how to patch ETW using Rust for evading EDR detection. This detailed guide includes explanations, code snippets, and testing procedures to enhance stealth in offensive security operations.

On the roadmap for Mythic is to create a DNS C2 profile, so I'd like to start a discussion as to the features, requirements, and specifications people would like to see in it before we start the de...

Introduction:

stack spoofing. Contribute to NtDallas/Fenrir development by creating an account on GitHub.

Share your videos with friends, family, and the world

YouTube video by Jeff Geerling

YouTube video by Phillip Wylie

Axlle is a Windows host with some niche Windows exploitation paths. I’ll start by phishing a user using a Excel Add-On file, XLL. These are since mostly blocked, but were previously quite big in the phishing scene. Then I’ll modify a URL file to run my reverse shell. I’ll find come creds for the next user, and change the password on the next. For administrator, I’ll abuse the StandaloneRunner.exe LOLBIN.