Reflecting Your Authentication: When Windows Ends Up Talking to Itself https://decoder.cloud/2025/11/24/reflecting-your-authentication-when-windows-ends-up-talking-to-itself/

InfoSec Black Friday & Cyber Monday Deals https://github.com/0x90n/InfoSec-Black-Friday

This is such a dumpster fire. Be safe out there. #npm https://www.koi.ai/incident/live-updates-sha1-hulud-the-second-coming-hundred-npm-packages-compromised

A vulnerability in Wazuh Agent (v4.10.1) allows authenticated attackers to force NTLM authentication through malicious UNC paths https://github.com/wazuh/wazuh/security/advisories/GHSA-x697-jf34-gp5x

MSSQL | Potatos and how not to use them https://adhdmurky.github.io/posts/post/

BetterSuccessor: Still abusing dMSA for Privilege Escalation (BadSuccessor after patch) https://www.alteredsecurity.com/post/bettersuccessor-still-abusing-dmsa-for-privilege-escalation-badsuccessor-after-patch

New unpatched 0 day vulnerability allowing to leak NTLM hashes from browsers with one click https://github.com/rubenformation/ms-photos_NTLM_Leak

Impacket with added MSSQL Relay server https://github.com/epotseluevskaya/impacket_mssqlrelay/tree/ntlmrelayx_mssqlrelayserver

Mullvad VPN presents And Then? https://mullvad.net/en/blog/mullvad-vpn-present-and-then

Lab used for workshop and CTF https://github.com/Pennyw0rth/NetExec-Lab

Taming the Attack Graph: A Many Subgraphs Approach to Attack Path Analysis https://specterops.io/blog/2025/11/13/taming-the-attack-graph-a-many-subgraphs-approach-to-attack-path-analysis/

Introducing HTTP Anomaly Rank https://portswigger.net/research/introducing-http-anomaly-rank

Site Unseen: Enumerating and Attacking Active Directory Sites https://www.synacktiv.com/en/publications/site-unseen-enumerating-and-attacking-active-directory-sites

Identify Azure AD resources that issue tokens without MFA enforcement using the ROPC grant flow https://github.com/AlexLinov/EntraMFACheck

How I Found the Worst ASP.NET Vulnerability — A $10K Bug (CVE-2025-55315) https://www.praetorian.com/blog/how-i-found-the-worst-asp-net-vulnerability-a-10k-bug-cve-2025-55315/

Modifying GodPotato to Evade Antivirus https://freedium.cfd/https://medium.com/@luisgerardomoret_69654/modifying-godpotato-to-evade-antivirus-f066aa779cf9

From vendor to ESC1https://medium.com/@Debugger/from-vendor-to-esc1-ed32281b7ea7

PsExec'ing the right way and why zero trust is mandatory https://blog.whiteflag.io/blog/psexecing-the-right-way/

MSSQL Exploitation - Run Commands Like A Pro https://www.r-tec.net/r-tec-blog-mssql-exploitation-run-commands-like-a-pro.html

CVE-2025-52665 - RCE in Unifi Access ($25,000) https://www.catchify.sa/post/cve-2025-52665-rce-in-unifi-os-25-000

ShareHound: An OpenGraph Collector for Network Shares https://specterops.io/blog/2025/10/30/sharehound-an-opengraph-collector-for-network-shares/

I guess I can write about these guys till I'm blue in the face. These proxy/botnet stories have a lot of moving parts, so I get it when another big development makes everyone yawn. But don't take my word for it: If you look at Cloudflare Radar right now, you […] [Original post on infosec.exchange]

What We Talk About When We Talk About Sideloading https://f-droid.org/2025/10/28/sideloading.html

Coercing Windows Server 2025 over DCERPC https://github.com/decoder-it/printerbugnew

Hack-cessibility: When DLL Hijacks Meet Windows Helpers https://trustedsec.com/blog/hack-cessibility-when-dll-hijacks-meet-windows-helpers

PowerShell tool that shows how to read and write NTLM OWF values via samlib.dll. https://github.com/kfallahi/NTLMPasswordChanger/

PowerShell toolkit that extracts locked Windows files (SAM, SYSTEM, NTDS, ...) using MFT parsing and raw disk reads https://github.com/kfallahi/UnderlayCopy

Python exploit for CVE-2025-59287 from HawkTrace https://gist.github.com/hawktrace/76b3ea4275a5e2191e6582bdc5a0dc8b

A tool for Golden DMSA attack, which enables domain persistence. https://github.com/Semperis/GoldenDMSA

Look At This Photograph - Passively Downloading Malware Payloads Via Image Caching https://malwaretech.com/2025/10/exif-smuggling.html

Exploitation of Windows Server Update Services Remote Code Execution Vulnerability (CVE-2025-59287) https://www.huntress.com/blog/exploitation-of-windows-server-update-services-remote-code-execution-vulnerability

Hacking potential of eSCL protocol in printers https://writeups.csirt.muni.cz/content/blog/escl/

Inside the Synthient Threat Data https://www.troyhunt.com/inside-the-synthient-threat-data/

Catching Credential Guard Off Guard https://specterops.io/blog/2025/10/23/catching-credential-guard-off-guard/

The DCERPC only printerbug.py version https://github.com/decoder-it/printerbugnew

Impacket 0.13 will soon be released, and it has a lot of new features https://www.coresecurity.com/blog/whats-new-impackets-013-release

How a fake AI recruiter delivers five staged malware disguised as a dream job https://medium.com/deriv-tech/how-a-fake-ai-recruiter-delivers-five-staged-malware-disguised-as-a-dream-job-64cc68fec263

Hacking the airport X-ray machine https://kth.diva-portal.org/smash/get/diva2:1876534/FULLTEXT01.pdf

Trust Issues – Attacking Trust in Active Directory https://lorenzomeacci.com/trust-issues-attacking-trust-in-active-directory

Have You Looked in the Trash? Unearthing Privilege Escalations from the Active Directory Recycle Bin https://cravaterouge.com/articles/ad-bin/

There's More than One Way to Trigger a Windows Service https://trustedsec.com/blog/theres-more-than-one-way-to-trigger-a-windows-service

A Gentle Crash Course to LLMs https://specterops.io/blog/2025/10/16/a-gentle-crash-course-to-llms/

Decrypting credentials from SCCM site servers configured for high availability https://www.ibm.com/think/x-force/decrypting-credentials-from-sccm-site-servers

Mocked Node.js server for testing naive AI agents https://github.com/PentestPad/evil-ai

Building the Leading Open-Source Pentesting Agent: Architecture Lessons from XBOW Benchmark https://medium.com/data-science-collective/building-the-leading-open-source-pentesting-agent-architecture-lessons-from-xbow-benchmark-f6874f932ca4

DEF CON 33 - Turning your Active Directory into the attacker’s C2 - Quentin Roland, Wilfried Bécard https://www.youtube.com/watch?v=_l9_lNUCjP4

More Than DoS (Progress Telerik UI for ASP.NET AJAX Unsafe Reflection CVE-2025-3600) https://labs.watchtowr.com/more-than-dos-progress-telerik-ui-for-asp-net-ajax-unsafe-reflection-cve-2025-3600/

Apple VP Ivan Krstić tells WIRED that the company is also offering bonuses that could bring the max total reward for iPhone exploits to $5 million. https://www.wired.com/story/apple-announces-2-million-bug-bounty-reward/

Active Directory domain (join)own accounts revisited 2025 https://www.shelltrail.com/research/active-directory-domain-ownjoin-accounts-revisited/

"ZDI Drops 13 Unpatched Ivanti Zero-Days Enabling Remote Code Execution" I can't even. https://cyberinsider.com/zdi-drops-13-unpatched-ivanti-zero-days-enabling-remote-code-execution/