These posts are from my old blog that I have migrated over to the new page.
A reflective look back on what my first year as penetration tester/cyber security consultant taught me, and how those lessons can potentially help you.
An overview and lab exploitation example of the ESC11 vulnerability, present in Active Directory Certificate Services when request encryption is disabled.
Hathor from Hack the Box was an Insane Windows machine that involves exploiting a misconfigured file upload, then identifying credentials in log files, before performing some DLL hijacking and finally, abusing an account with replication rights to obtain the administrator’s password hash.
A guide on how to terraform the Active Directory Home Lab from the Practical Ethical Hacking course by TCM Security - and coincidentally - My first attempt at Infrastructure-as-Code and DevOps!
In an attempt to broaden my skill set, I’ll be using the SliverC2 to complete Hack the Box machines and learn more about this fantastic Command and Control framework. This time around it’s the retired box: Anubis!
A blog post for me to try and finally fully understand the internals of how Kerberos and Active Directory authentication works within a domain (and how it’s broken).
A review of ZeroPointSecurity’s Certified Red Team Operator course.
A thorough review of The Cyber Mentor’s new certification: The Practical Network Penetration Tester. Wondering what I thought of this new certificate disrupting the industry? Fear not! Let’s dive right in.
What’s up, security folks! Today I’ll be putting pen to the paper and going over my thoughts on the Evasion Techniques and Breaching Defenses course from Offensive Security, colloquially known as the OSEP. I passed my exam at the end of November, so consider this a review of the updated exam (Post leak)! I’ll go over the contents of the course, how I prepared for the exam and any useful tidbits that helped me along the way. ...
Insecure Deserialization is a concept that is often conveyed as one of the harder vulnerabilities to exploit, and I for one struggled to get my head around it initially. This has led to the creation of this post, where I’ll be attempting to break down the concepts behind it and how it can be exploited, whilst also offering some advice for ensuring your code is secure as a developer. I’ll be demonstrating some lab exercises from Burpsuite’s Web Academy whilst trying to break down some of the jargon and provide some metaphors to illustrate the concepts. ...