Blog

By category:
Karol Mazurek

The article presents a detailed breakdown of how ISO files can be used to bypass Microsoft Defender SmartScreen protections.

Karol Mazurek

Explore advanced techniques for bypassing anti-execution defenses in corporate environments. This article delves into methods for executing code on hardened systems during Red Team Operations after gaining initial access.

Security updates in Android 15 heading image
Marcin Węgłowski

Take a look at the security & privacy improvements brought to its users in Android 15. The article explores what was changed, how it affects daily users and application developers.

Zbigniew Piotrak

Read about multiple vulnerabilities in IBM i Access Client Solutions software related to connecting AS400 servers. Chaining those vulnerabilities could allow remote attackers to access client and server machines.

Mateusz Wojciechowski

Understand the risks associated with the use of large language models based on the OWASP Top 10 for LLMs list. The article aims to illustrate and explain through examples the vulnerabilities in applications that use LLMs.

Karol Mazurek

This article will guide you in gaining initial access to a target during a Red Team assessment. It is divided into two parts for easy comprehension. The first part details the use of OSINT for Malware delivery, primarily for spear phishing. The second part covers creating malware and making use of evasion techniques. We hope you find this article both informative and enjoyable!

Artur Byszko

This guide explores practical strategies for exploiting FILE READ vulnerabilities. It delves into what File Read vulnerabilities entail, their potential risks, and the underlying vulnerabilities that can lead to them. The content also offers insights into confirming the presence of these vulnerabilities and provides useful tips for addressing them. Additionally, it examines the possible advantages and drawbacks of exploiting these vulnerabilities, along with offering general prevention and detection strategies for web applications.

AFINE

This article is a comprehensive guide to testing and exploiting Java deserialization in 2021. It provides valuable insights and practical tips based on the author’s experience in Java application penetration testing. As Java environments evolve, the article addresses the question of whether Java deserialization remains a threat or if patches have mitigated its risks.

AFINE

In the second part of this series, we delve into automated reconnaissance and attacks within the Java RMI framework. Leveraging the RMI interface/server introduced in Part One, we explore practical techniques for penetration testing. This installment aims to equip pentesters with essential skills for efficient RMI exploitation.

AFINE

Welcome to the comprehensive guide on Java Remote Method Invocation (RMI) tailored for penetration testers. This article aims to demystify RMI interfaces encountered during infrastructure penetration testing. Due to the depth of this topic, we’ve divided it into two parts. In this initial section, we’ll provide a concise overview of RMI interfaces, demonstrate how to create one for testing purposes, and guide you through the manual construction of an RMI Client to invoke remote methods.

Is your company secure online?

Join our list of satisfied customers and safeguard your company’s data!

Trust us and leave your contact details. Our team will contact you to discuss the details and prepare a tailor-made offer for you. Full discretion and confidentiality of your data are guaranteed.