🆕 New blog post!

"Offline Extraction of Symantec Account Connectivity Credentials (ACCs)"

Following my previous post on the subject, here is how to extract ACCs purely offline.

👉 itm4n.github.io/offline-extr...

#redteam #pentesting

Did you miss #SOCON2025? Did you have a favorite talk you'd like to rewatch?

🎥 All presentations from SO-CON 2025 are now live at ghst.ly/socon25-talks.

💻 Slides for each talk are available at ghst.ly/socon25-slides.

I'm thrilled to announce "HTTP/1 Must Die! The Desync Endgame", at #BHUSA! This is going to be epic, check out the abstract for a teaser ↓

Firefox treats multipart/x-mixed-replace like HTML. Chrome doesn’t.
That tiny difference? It can turn a "non-exploitable" XSS into a real one.
Abuse boundary handling, bypass filters, and make your payload land.

thespanner.co.uk/making-the-u...

In our latest article, @croco-byte.bsky.social and @scaum.bsky.social demonstrate a trick allowing to make Windows SMB clients fall back to WebDav HTTP authentication, enhancing the NTLM and Kerberos relaying capabilities of multicast poisoning attacks!
www.synacktiv.com/publications...

In this blog post, I explain how I was able to create a PowerShell console in C/C++, and disable all its security features (AMSI, logging, transcription, execution policy, CLM) in doing so. 💪

👉 blog.scrt.ch/2025/02/18/r...

The results are in! We're proud to announce the Top 10 Web Hacking Techniques of 2024! portswigger.net/research/top...

THC RELEASE: Article - Practical HTTPS Interception - exploiting the cleartext ACME-HTTP-AUTH loophole (Let's Encrypt, ...) to retrieve valid HTTPS certificates. #tls #https

blog.thc.org/practical-ht...

This is smart. I had to read it twice to figure out why they weren't just using eBPF, but it works for non-superusers: it dynamically creates network namespaces, tun devices, and an intercepting CA (like Burp) to capture all the HTTP requests made by a Linux program.

github.com/monasticacad...

New blog post on the abuse of the IDispatch COM interface to get unexpected objects loaded into a process. Demoed by using this to get arbitrary code execution in a PPL process. googleprojectzero.blogspot.com/2025/01/wind...

Hot out of the oven! The Cookie Sandwich – a technique that lets you bypass the HttpOnly protection! This isn't your average dessert; it’s a recipe for disaster if your app isn’t prepared: portswigger.net/research/ste...

Really great blog post about bypassing BitLocker using "PXE soft reboot" (even if PXE boot is disabled in the BIOS).

"Windows BitLocker -- Screwed without a Screwdriver"

👉 neodyme.io/en/blog/bitl...
👉 media.ccc.de/v/38c3-windo...