pagedout.institute ← we've just released Paged Out! zine Issue #7 pagedout.institute/download/Pag... ← direct link lulu.com/search?page=... ← prints for zine collectors pagedout.institute/download/Pag... ← issue wallpaper Enjoy! Please please please share to spread the news - thank you!

Romhack was absolute 🔥! The conference, the community, the vibe - all of it was just something else. Special mention to merlos1977@x and the CybersaiyanIT@x team for making the speaking experience excellent too. 🙃

🇮🇹👋

Soon™ Private invites at Romhack next week, public release a while later.

added a cheat sheet to the official Git website (with a lot of help from other folks who work on the website) git-scm.com/cheat-sheet

I've been hacking on a new Windows Named Pipe tool called PipeTap which helps analyse named pipe communications. Born out of necessity while doing some vulnerability research on a target, its been super useful in reversing it's fairly complex protocol. :)

Did you know your MacBook has a sensor that knows the exact angle of the screen hinge? It’s not exposed as a public API, but I figured out a way to read it and make it sound like an old wooden door.

Using @radareorg.bsky.social to dynamically get the virtual address of a @golang.org embed.FS structure to extract some sus embed's with go-embed-extractor¹ in this "dodgy-go-bin" 🔥 ¹ github.com/BreakOnCrash...

Phrack turns 40. The digital drop is live. Download it. Archive it. Pass it on. 💾 www.phrack.org #phrackat40 #phrack72

Hah! Made it to a @badsectorlabs.com LWiS release with my collection of bloatware exploits released @defcon.bsky.social earlier this month! Check out the POC's for CVE-2025-3462, CVE-2025-3463, CVE-2025-27812, CVE-2025-27813, CVE-2025-5491 and CVE-2025-27811 here: github.com/sensepost/bl...

Always dig the @defcon.bsky.social artwork around the convention center.

👋 Vegas! 🔥👀

Reverse engineering Microsoft’s SQLCMD.exe to implement Channel Binding support for MSSQL into Impacket’s mssqlclient.py. Storytime from Aurelien (@Defte_ on the bird site), including instructions for reproducing the test environment yourself. sensepost.com/blog/2025/a-...

Had a fairly complex exploit for an LPE, when @ipmegladon.bsky.social showed me a way to make it a one-liner last night. Gosh I love working with the people @sensepost.com.

[BLOG] My thoughts (and code examples) for writing modular PIC C2 agents. rastamouse.me/modular-pic-...

The Apple Watch has a closed down ecosystem, only compatible with the iPhone. Nils reverse engineered its interfaces to open it up for Android! ✨ WatchWitch ✨ allows using your Apple Watch ⌚ on Android devices, interpreting your health data, answering messages on the Watch & more. (1/2)

This was fun to see coming to life given the situation Adriaan found himself in! And in no time, he made a plan 🙃

Introducing the BloodHound Query Library! 📚 @martinsohn.dk & @joeydreijer.bsky.social explore the new collection of Cypher queries designed to help BloodHound users to unlock the full potential of the BloodHound platform by creating an open query ecosystem. ghst.ly/4jTgRQQ

Quite stoked to be speaking at @defcon.bsky.social 33 this year, presenting: "7 Vulns in 7 Days: Breaking Bloatware Faster Than It’s Built". Reversing, exploits, disclosure pain - it has it all, and it's going to be fun! 💥 See ya soon Vegas. ☀️

I was talking with someone about dependency confusion and suply chain attacks and I was confused myself with the feasibility of doing this in 2025, so I decided to take a practical aproach and create my own tool 🔨 to detect Orphan and Mispelled packages 📦: sensepost.com/blog/2025/de...

[BLOG] Integrating Tradecraft Garden PIC loaders into Cobalt Strike rastamouse.me/harvesting-t...

Looking for the keys to BeaconGate? In our latest blog, get a walk through of techniques that show how BeaconGate can be used to quickly PoC, debug, and weaponize custom call stack spoofing routines in Cobalt Strike. www.cobaltstrike.com/blog/instrum...

So, here's a little thread on my new open source project: The Tradecraft Garden. tradecraftgarden.org It's Crystal Palace, an open-source linker and linker script specialized to writing PIC DLL loaders. And, a corpora of DLL loaders demonstrating design patterns building tradecraft with it.

Excited by this proposal to gate access to local network resources in browsers. It would block at least one exploit chain I found this year as an example. github.com/explainers-b...

Great thread that challenges what you know about modern WiFi hacking. The next iteration of our BlackHat Las Vegas course takes it further — you do the hacking, hands-on, in the cloud. Sign-up link at the end of the thread.

llm-llama-server now supports tools, which means this demo should work (if you have 3.2GB free): brew install llama.cpp llama-server --jinja -hf unsloth/gemma-3-4b-it-GGUF:Q4_K_XL uvx --with llm-llama-server llm -m llama-server-tools -T llm_time 'what time is it?' simonwillison.net/2025/May/28/...

I’m seeing a large disconnect between “thought leader” takes about AI aiding attackers versus hands-on practical use - but I’d love a wider view. If we look at deepfakes, malware & phishing as the most common places people believe attackers are advantaged by AI one by one 1/5

🆕 New blog post! It's a rather short one, nothing crazy. Just wanted to share a random finding I made recently. 🤷‍♂️ 'Hijacking the Windows "MareBackup" Scheduled Task for Privilege Escalation' 👉 blog.scrt.ch/2025/05/20/h... #pentest #pentesting #redteam #windows #privilegeescalation

Punching through NAT like it’s paper 💥✉️ – Tailscale connects your devices peer-to-peer even behind NATs. Curious how? Our “How NAT Traversal Works” blog unpacks the tricks (STUN, hole punching, and more) we use to get through firewalls and routers. 🔗 tailscale.com/blog/how-nat-traversal-works

We are very excited to announce that Volatility 3 has reached parity with Volatility 2! With this achievement, Volatility 2 is now deprecated. See the full details in our blog post: volatilityfoundation.org/announcing-t...

I’m really enjoying nerve for building agents, but found myself wanting to limit tool output to reduce input tokens or avoid tripping message length limits, so I made this PR https://github.com/evilsocket/nerve/pull/58 For example, this page parameter was auto added by nerve.

CLion Is Now Free for Non-Commercial Use | Discussion

mitmproxy 12 is out! 🚀 It’s now possible to modify the prettified representation of binary protocols. Editing Protobufs is now as easy as editing YAML, no .proto schema needed. 🙌 mitmproxy.org/posts/releas...

Working with s/mime on macOS has first class support with the "security cms" command and keychain. Here's how to replace openssl with it, with the mutt mail client being the specific use case github.com/singe/smutt

Microsoft Outlook is pants at usability and running a fat GUI isn’t great for security. About a year ago I went on a mission to make mutt (the CLI mail client) work in a sandbox so I could read my work Microsoft365 mail nicely and more securely. Here’s how

WinRMS relay (@Defte_), plaintext Zip attacks (@pfiatde), SQL Server Crypto deep dive (@_xpn_), FindUnusualSessions (@podalirius_), and more! blog.badsectorlabs.com/last-week-in...

Another example of a Windows 0-day found with PrivescCheck. Congrats to Compass Security for investigating the issue and exploiting it. 👏 blog.compass-security.com/2025/04/3-mi...

The S is for Security. How to use WinRMS as a solid NTLM relay target, and why it’s less secure than WinRM over HTTP. writeup: sensepost.com/blog/2025/is... PR to impacket: github.com/fortra/impac... Demo: youtu.be/3mG2Ouu3Umk

Think NTLM relay is a solved problem? Think again. Relay attacks are more complicated than many people realize. Check out this deep dive from Elad Shamir on NTLM relay attacks & the new edges we recently added to BloodHound. ghst.ly/4lv3E31

Have all those tasty $vpnproduct companies been vibecoding all along and we're just late to the party?

A Visual Guide to SSH Tunnels: Local and Remote Port Forwarding - Article by Ivan Velichko @iximiuz.bsky.social #Network #SysAdmin

Whipped together a SOCKS5-over-any-transport feature today for the c2 & implant used in @sensepost.com purple teaming / emulation exercises. Here I have a cURL request, over an ICMP channel, funnelling HTTP requests in and out via our implant :D Fun! 😄🔥

Paged Out! #6 has arrived! And it's jam-packed with content! You can download it here: pagedout.institute?page=issues....

This intro! 🔥 > The hacker's mind is the beginner's mind. A mind that approaches things with all options on the table. > Embracing a beginner's mind means liberating yourself from your preconceived notions about something and face it as it is. tmpout.sh/4/1.html

Would you look at that, it's tmp.0ut Volume 4! Happy Friday, hope you enjoy this latest issue! tmpout.sh/4/

GLPI (popular in France & Brazil) versions 9.5.0-10.0.16 allow hijacking sessions of authenticated users remotely. The details & process of discovering the vulnerability is detailed by @GuilhemRioux here: sensepost.com/blog/2025/le... Tooling: github.com/Orange-Cyber... Demo: youtu.be/OTaCV4-6qHE