RedTeam feed

HTTP/3 in Burp Suite - it’s time to find a bigger wordlist
#portswigger

How many bugs have you missed because you didn’t send quite enough HTTP requests? Turbo Intruder now supports HTTP/3, can comfortably exceed 100,000 requests per second over Wi-Fi, and auto-tunes for

via PortSwigger Research

From Fork to Framework: What Modifying Apollo Taught Us About Agent Invasion
#bishopfox

Forking an existing C2 agent sounds faster than building from scratch. Bishop Fox learned otherwise. This post documents what happened when they forked Apollo, built a custom obfuscation pipeline to defeat EDR detection, and spent months fighting an architecture that was never designed for it.

via BishopFox Blog

MikroTrick: Inside the RouterOS Takeover Chain
#bishopfox

Attackers were exploiting MikroTik routers before fixes went public. Bishop Fox reproduced the full unauthenticated takeover chain, found persistence artifacts on real compromised devices, and breaks down what defenders need to investigate beyond patching to confirm they are actually clean.

via BishopFox Blog

CiliumHound: Graphing Kubernetes Network Policies
#specterops

TLDR: CiliumHound is a BloodHound OpenGraph extension for auditing Cilium network policies. It ingests a folder of JSON or YAML policies and creates a searchable, Kubernetes namespace-scoped graph. Introduction On some recent assessments, I’ve had to review large, complex Cilium network policies in a Kubernetes cluster, looking for ways in or out of isolated namespaces. […]

via SpecterOps Blog (author: Andrew Luke)

Unpacking a laZzzy Donut
#trustedsec

Recently, we came across an interesting malware sample. It used a multi-stage malware loader that chains together obfuscation and shellcode-injection techniques. The sample begins as obfuscated Python bytecode and…

via TrustedSec Blog (author: Scott Nusbaum)

Ghostwriter v7.3.0: A Fresh New Look
#specterops

TL;DR: The upcoming Ghostwriter v7.3.0 release brings a major UI refresh to nearly every part of the application. The new design is easier on the eyes, more accessible, and better organized, with a new engagement bar, customizable sidebar with pinned work, a completely redesigned dashboard, and a plethora of other changes. Introduction As it is […]

via SpecterOps Blog (author: Katherine)

CVE-2026-82329: Unauthenticated Administrative Access in JFrog Artifactory via an Empty Cluster Join Key
#bishopfox

A misconfigured cluster join key in JFrog Artifactory's default install lets unauthenticated attackers mint a permanent admin token in one request. Bishop Fox reproduced the full chain, confirmed in-the-wild exploitation, and shares a non-invasive detection check and remediation guidance.

via BishopFox Blog

Mind the Config: Detecting and Weaponizing NetScaler CVE-2026-19490
#bishopfox

A single unauthenticated request bypasses authentication on NetScaler Gateway and AAA virtual servers. Whether that means a dead-end session, a proxy into the internal network, or root on the appliance depends entirely on configuration. Bishop Fox maps every branch and shares a safe detection tool.

via BishopFox Blog

Unmasking SCCM Application Execution
#specterops

TL;DR: Executing applications instead of scripts via SCCM’s deploy application feature will generate different artifacts due to the fundamental differences in the execution flow. While existing detection tools can catch script-based execution, they often miss stealthier methods. This post covers how to detect the more evasive SCCM application execution. Introduction: During BlackHat 2025’s offering of […]

The post Unmasking SCCM Application Execution appeared first on SpecterOps.

via SpecterOps Blog (author: Joshua Prager)

So… You Found AWS Access Keys (Part 1)
#trustedsec

&LTp>Finding plaintext access keys to an AWS account during an engagement is always great thrill. What can be done with them? What do they have access to? Are they even for any of the accounts in scope? It can be super…&LT/p>

via TrustedSec Blog (author: Lilly Mayo)

Token Analysis and Tracking System (TATS)
#specterops

TL;DR: Tracking OAuth tokens is hard, but Token Analysis and Tracking System (TATS) can help. TATS will collect, store, decode, analyze and provide visual tracking for OAuth token exchanges. It was built to account for known OAuth deviations in the Microsoft ecosystem and will work with any OAuth implementation. This blog explores functionality along with […]


via SpecterOps Blog (author: Hope Walker)

NetNTLMv1 Is Dead. Long Live NetNTLMv1.
#outflank

Fitting lossless rainbow tables on a 4 TB disk and cracking NetNTLMv1 with WebGPU and ntlmrain.

Google’s release of the NetNTLMv1 rainbow tables made it much more practical to recover an NT hash from a NetNTLMv1 response captured with the fixed challenge 1122334455667788, further reducing the needed compute power.

NetNTLMv1 cracking is a problem I’ve kept returning to over the past several years. The recent table release prompted me to explore whether the process could be made cheaper, faster and easier to run. This post describes the result: a compact indexed table format, a WebGPU browser client and a native command-line tool.

Highlights

This post explains a new ntlmrain rainbow table layout. We are publicly releasing a browser tool and command-line client together with the optimized tables.

via Outflank Blog (author: Cedric Van Bockhaven)

Signature Optional - Analysis of CVE-2026-28323
#bishopfox

SolarWinds Web Help Desk treated SAML signature verification as optional and skipped every other validation the spec requires. Bishop Fox confirmed the full exploit end to end: one forged POST request, no credentials, full session takeover. Here is the root cause, the fix, and how to detect it.

via BishopFox Blog

LLMHaxor Update
#trustedsec

&LTp>Today I am sharing some updates on a tool I created from an earlier time — before Burp Suite included native AI testing enhancements and before an almost explosive growth of open-source AI tooling and testing frameworks…&LT/p>

via TrustedSec Blog (author: Geoff Walton)

Improving Your Simple Windows Domain for Offensive Testing: Installing MS SQL Server Express on Windows Server 2022 Server Core Edition
#redsiege

by Justin Palk A couple of years ago, I put together a series on standing up a simple Windows AD domain in a lab environment. This article is part of […]

via RedSiege Blog (author: Taryn Downey)

Red Team AI Skills
#outflank

Today, SpecterOps released a new open-source skills marketplace for offensive security research and red team operations. We are proud to have collaborated on this project over the last few weeks and hope more teams will join now that it’s public. The initial release includes plugins for Fortra’s Cobalt Strike and Outflank C2. Get started here: https://github.com/SpecterOps/skills

Background

I recently reached out to a few red teams we’ve worked with before to discuss developing a public AI marketplace focused on offensive security. I was inspired by the Trail of Bits marketplace and wanted to see a similar project for offensive security. This task was too large to take on alone, so I contacted a few other researchers to discuss a joint effort. Imagine my surprise when SpecterOps told me they were nearly done implementing a similar project!

via Outflank Blog (author: Kyle Avery)

waf-fu, or Some Log Replay Nonsense
#trustedsec

&LTp>1    waf-fu Your Way to Better Credential&ampnbsp;AccessSo, a gig or two ago I was reviewing CloudWatch logs to search for any credentials that I may be able to use, in order to gain additional access to the environment.…&LT/p>

via TrustedSec Blog (author: Lilly Mayo)

Traefik | Version Through 3.7.11
#bishopfox

Traefik's request read timeout is enabled by default and documented without exception, but it has never applied to HTTP/3. Bishop Fox confirmed the gap across four years of releases, measured it against the backend, and reported it to the vendor, who shipped a fix within twelve days.

via BishopFox Blog

Simuler des services Active Directory légitimes sur un réseau interne : le cas de l’exploitation de GPO
#synacktiv

La simulation de services Active Directory légitimes sur un réseau interne est une capacité puissante et polyvalente qui peut être exploitée dans le contexte de divers vecteurs d'attaque. De nombreux exemples d'exploits reposant sur la capacité à simuler des services LDAP et/ou SMB fonctionnels peuvent être cités, tels que l'exploitation des Group Policy Objects (GPO) ou, plus récemment, la faille ADCS Certighost (CVE-2026-54121). Il s’agit d’un sujet sur lequel nous avons commencé à travailler il y a plusieurs années dans le cadre de l'exploitation des GPO (voir cet article ainsi que cet article). La présente publication introduit une recherche complémentaire qui fournit un moyen de simuler des services LDAP et SMB authentifiés sur un réseau interne, d'une manière flexible pouvant être adaptée à divers cas d'usage. Cette recherche s'appuie sur scapy et l'excellent travail de Gabriel Potter. Elle sera présentée au travers du prisme de l'exploitation des GPO, mais le but des outils qui en résultent est d'offrir une flexibilité facilitant les recherches futures dans d'autres domaines.

via Synacktiv Blog (author: Quentin Roland)

When it Snows it Pours – Anatomy of a ServiceNow Red Team
#mdsec

Introduction What if I told you six thousand of your employees were two steps removed from gaining full control over your IT infrastructure. If we told you this was related...

via MDSec Blog (author: Tim Carrington)