56,966 blogs · [ { "id": "01a0d754-9a62-7319-a8a2-dc3ee90d9f0f", "title": "Experimenting with Jev for Offensive Security", "url": "https://blog.xpnsec.com/articles/#jev-for-offsec", "published_at": "2026-09-23T20:47:16+00:00" }, { "id": "01a08756-3b8d-72d2-9531-b2e2b3568dd8", "title": "Accelerating EDR Evasion with LLM-Driven Analysis", "url": "https://blog.xpnsec.com/accelerating-edr-evasion-with-llm/", "published_at": "2026-07-30T12:19:16+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45c8cc6b940", "title": "Disposable Tooling - Building LLM-Generated Mythic Agents from Prompt to Deployment", "url": "https://blog.xpnsec.com/disposable-tooling/", "published_at": "2026-07-29T23:19:16+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45c8d020458", "title": "Prompt Engineering for Security Agents - A Measurable Approach with GEPA", "url": "https://blog.xpnsec.com/prompt-engineering-for-security-agents/", "published_at": "2026-07-29T19:19:16+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45c8d8c62b5", "title": "Jailbreaking Local Models with JSON", "url": "https://blog.xpnsec.com/articles/#jailbreaking-local-models-with-json", "published_at": "2026-07-25T19:19:16+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45c8e24fdd8", "title": "Benchmarking Malicious Agents", "url": "https://blog.xpnsec.com/articles/#benchmarking-malicious-agent", "published_at": "2026-07-16T19:19:16+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45c8f15d53c", "title": "Extracting creds with Foundation Model", "url": "https://blog.xpnsec.com/articles/#extracting-creds", "published_at": "2026-07-13T19:19:16+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45c8faecbec", "title": "The Accidental C2 - Exploring Dev Tunnels for Remote Access", "url": "https://blog.xpnsec.com/accidental-c2/", "published_at": "2026-05-09T19:19:16+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45c8fe74202", "title": "An Evening with Claude (Code)", "url": "https://blog.xpnsec.com/an-evening-with-claude-code/", "published_at": "2025-11-29T19:19:16+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45c90e63909", "title": "Administrator Protection Review", "url": "https://blog.xpnsec.com/administrator-protection/", "published_at": "2025-06-20T23:01:46+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45c917a7e87", "title": "Tokenization Confusion", "url": "https://blog.xpnsec.com/tokenization-confusion/", "published_at": "2025-06-04T23:01:46+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45c91ba90d3", "title": "The SQL Server Crypto Detour", "url": "https://blog.xpnsec.com/the-sql-server-crypto-detour/", "published_at": "2025-04-16T23:01:46+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45c92237957", "title": "ADFS - Living in the Legacy of DRS", "url": "https://blog.xpnsec.com/adfs-living-in-the-legacy-of-drs/", "published_at": "2025-01-12T23:01:46+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45c92483529", "title": "Identity Providers for RedTeamers", "url": "https://blog.xpnsec.com/identity-providers-redteamers/", "published_at": "2024-03-18T23:01:46+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45c9332dae0", "title": "MacOS \"DirtyNIB\" Vulnerability", "url": "https://blog.xpnsec.com/dirtynib/", "published_at": "2023-10-04T23:01:46+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45c9415c2fc", "title": "Okta for Red Teamers", "url": "https://blog.xpnsec.com/okta-for-redteamers/", "published_at": "2023-10-02T20:01:46+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45c94b4dc28", "title": "LAPS 2.0 Internals", "url": "https://blog.xpnsec.com/lapsv2-internals/", "published_at": "2023-08-13T10:03:31+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45c94eb321f", "title": "PNG Steganography from First Principles", "url": "https://blog.xpnsec.com/png-steganography/", "published_at": "2023-08-09T10:03:31+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45c95608019", "title": "Building a Custom Mach-O Memory Loader for macOS - Part 1", "url": "https://blog.xpnsec.com/building-a-mach-o-memory-loader-part-1/", "published_at": "2023-02-04T10:03:31+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45c960b62c8", "title": "Restoring Dyld Memory Loading", "url": "https://blog.xpnsec.com/restoring-dyld-memory-loading/", "published_at": "2023-01-14T12:03:31+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45c96f6de35", "title": "WAM BAM - Recovering Web Tokens From Office", "url": "https://blog.xpnsec.com/wam-bam/", "published_at": "2022-10-17T17:40:29+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45c978b3a79", "title": "Exploring SCCM by Unobfuscating Network Access Accounts", "url": "https://blog.xpnsec.com/unobfuscating-network-access-accounts/", "published_at": "2022-07-09T23:00:00+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45c97a0a6b8", "title": "g_CiOptions in a Virtualized World", "url": "https://blog.xpnsec.com/gcioptions-in-a-virtualized-world/", "published_at": "2022-05-15T06:43:29+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45c986a61db", "title": "NTLMquic", "url": "https://blog.xpnsec.com/ntlmquic/", "published_at": "2022-04-11T03:00:00+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45c99190000", "title": "Object Overloading", "url": "https://blog.xpnsec.com/object-overloading/", "published_at": "2022-02-15T20:01:46+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45c995358cb", "title": "Weird Ways to Run Unmanaged Code in .NET", "url": "https://blog.xpnsec.com/weird-ways-to-execute-dotnet/", "published_at": "2021-05-05T08:40:46+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45c9969a206", "title": "Azure Application Proxy C2", "url": "https://blog.xpnsec.com/azure-application-proxy-c2/", "published_at": "2021-04-24T13:01:02+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45c9a099010", "title": "Tailoring Cobalt Strike on Target", "url": "https://blog.xpnsec.com/tailoring-cobalt-strike-on-target/", "published_at": "2021-02-04T14:16:07+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45c9a83670d", "title": "Bring Your Own VM - Mac Edition", "url": "https://blog.xpnsec.com/bring-your-own-vm-mac-edition/", "published_at": "2020-12-28T10:53:00+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45c9a9f976d", "title": "The .NET Export Portal", "url": "https://blog.xpnsec.com/the-net-export-portal/", "published_at": "2020-11-24T09:10:00+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45c9ac7cda4", "title": "We Need To Talk About MACL", "url": "https://blog.xpnsec.com/we-need-to-talk-about-macl/", "published_at": "2020-10-18T16:24:00+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45c9b7b5b62", "title": "MacOS Injection via Third Party Frameworks", "url": "https://blog.xpnsec.com/macos-injection-via-third-party-frameworks/", "published_at": "2020-09-23T00:05:59+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45c9c44fcb4", "title": "Debugging into .NET", "url": "https://blog.xpnsec.com/debugging-into-net/", "published_at": "2020-08-10T01:00:00+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45c9d402590", "title": "Hiding your .NET - COMPlus_ETWEnabled", "url": "https://blog.xpnsec.com/hiding-your-dotnet-complus-etwenabled/", "published_at": "2020-06-06T00:04:30+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45c9db6af38", "title": "Designing The Adversary Simulation Lab", "url": "https://blog.xpnsec.com/designing-the-adversary-simulation-lab/", "published_at": "2020-04-18T13:31:06+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45c9e70dcea", "title": "Hiding your .NET - ETW", "url": "https://blog.xpnsec.com/hiding-your-dotnet-etw/", "published_at": "2020-03-17T23:57:20+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45c9f2e4ad3", "title": "AWS Lambda Redirector", "url": "https://blog.xpnsec.com/aws-lambda-redirector/", "published_at": "2020-02-25T12:09:00+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45c9fd376a9", "title": "Testing your RedTeam Infrastructure", "url": "https://blog.xpnsec.com/testing-redteam-infra/", "published_at": "2020-01-28T19:47:05+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45ca0911d8d", "title": "MacOS Filename Homoglyphs Revisited", "url": "https://blog.xpnsec.com/macos-filename-homoglyphs-revisited/", "published_at": "2019-12-10T11:59:31+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45ca0dc8bb7", "title": "Protecting Your Malware with blockdlls and ACG", "url": "https://blog.xpnsec.com/protecting-your-malware/", "published_at": "2019-11-04T09:42:45+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45ca0eec4bf", "title": "Bypassing MacOS Privacy Controls", "url": "https://blog.xpnsec.com/bypassing-macos-privacy-controls/", "published_at": "2019-09-23T06:17:49+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45ca1ae47ce", "title": "Inter-Realm Key Roasting (well... within the first 30 days)", "url": "https://blog.xpnsec.com/inter-realm-key-roasting/", "published_at": "2019-09-06T11:06:35+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45ca1f4184d", "title": "Analysing RPC With Ghidra and Neo4j", "url": "https://blog.xpnsec.com/analysing-rpc-with-ghidra-neo4j/", "published_at": "2019-08-01T06:43:29+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45ca26df719", "title": "Evading Sysmon DNS Monitoring", "url": "https://blog.xpnsec.com/evading-sysmon-dns-monitoring/", "published_at": "2019-06-15T22:48:05+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45ca2ed6403", "title": "Exploring Mimikatz - Part 2 - SSP", "url": "https://blog.xpnsec.com/exploring-mimikatz-part-2/", "published_at": "2019-06-07T08:24:10+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45ca3217aa1", "title": "Exploring Mimikatz - Part 1 - WDigest", "url": "https://blog.xpnsec.com/exploring-mimikatz-part-1/", "published_at": "2019-05-10T07:10:40+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45ca38a6337", "title": "Silencing Cylance: A Case Study in Modern EDRs", "url": "https://blog.xpnsec.com/silencing-cylance-a-case-study-in-modern-edrs/", "published_at": "2019-04-18T23:21:06+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45ca450b768", "title": "Building, Modifying, and Packing with Azure DevOps", "url": "https://blog.xpnsec.com/building-modifying-packing-devops/", "published_at": "2019-03-11T18:54:07+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45ca4a25718", "title": "Azure AD Connect for Red Teamers", "url": "https://blog.xpnsec.com/azuread-connect-for-redteam/", "published_at": "2019-02-18T08:50:46+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45ca4a76bd7", "title": "How to Argue like Cobalt Strike", "url": "https://blog.xpnsec.com/how-to-argue-like-cobalt-strike/", "published_at": "2019-01-28T08:11:44+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45ca5987408", "title": "ActiveBreach, powered by Ethereum Blockchain", "url": "https://blog.xpnsec.com/blockchainc2/", "published_at": "2019-01-05T17:00:06+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45ca621a4ec", "title": "RunDLL32 your .NET (AKA DLL exports from .NET)", "url": "https://blog.xpnsec.com/rundll32-your-dotnet/", "published_at": "2018-11-05T18:37:33+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45ca6356853", "title": "Cisco AMP - Bypassing Self-Protection", "url": "https://blog.xpnsec.com/cisco-amp-bypassing-self-protection/", "published_at": "2018-10-27T21:48:34+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45ca6e83076", "title": "AppLocker CLM Bypass via COM", "url": "https://blog.xpnsec.com/constrained-language-mode-bypass/", "published_at": "2018-10-01T09:56:18+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45ca72eb537", "title": "macOS Research Outtakes - File Extensions", "url": "https://blog.xpnsec.com/macos-phishing-tricks/", "published_at": "2018-09-22T11:56:29+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45ca7d80882", "title": "Disabling MacOS SIP via a VirtualBox kext Vulnerability", "url": "https://blog.xpnsec.com/disabling-macos-sip-via-a-virtualbox-kext-vulnerability/", "published_at": "2018-08-20T12:01:20+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45ca84d6f10", "title": "Endpoint Security Self-Protection on MacOS", "url": "https://blog.xpnsec.com/macos-av-self-protection-methods/", "published_at": "2018-08-14T17:56:04+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45ca85d9443", "title": "Escaping the Sandbox – Microsoft Office on MacOS", "url": "https://blog.xpnsec.com/escaping-the-sandbox-microsoft-office-on-macos/", "published_at": "2018-08-08T13:11:20+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45ca8cc2f10", "title": "Exploring PowerShell AMSI and Logging Evasion", "url": "https://blog.xpnsec.com/exploring-powershell-amsi-and-logging-evasion/", "published_at": "2018-07-09T00:19:41+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45ca92060c7", "title": "Exploiting CVE-2018-1038 - Total Meltdown", "url": "https://blog.xpnsec.com/total-meltdown-cve-2018-1038/", "published_at": "2018-04-23T06:16:32+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45ca93ef47a", "title": "Understanding and Evading Get-InjectedThread", "url": "https://blog.xpnsec.com/undersanding-and-evading-get-injectedthread/", "published_at": "2018-04-09T07:02:33+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45ca969905d", "title": "Exploring Cobalt Strike's ExternalC2 framework", "url": "https://blog.xpnsec.com/exploring-cobalt-strikes-externalc2-framework/", "published_at": "2018-03-30T10:24:58+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45caa1df5f5", "title": "Moving jobs and exploiting flash (CVE-2018-4878)", "url": "https://blog.xpnsec.com/cve-2018-4878/", "published_at": "2018-02-15T19:16:50+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45caae61415", "title": "Universal XSS via Evernote WebClipper", "url": "https://blog.xpnsec.com/evernote-webclipper-uxss/", "published_at": "2018-01-18T08:58:52+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45cabc64096", "title": "Exploiting Windows 10 Kernel Drivers - NULL Pointer Dereference", "url": "https://blog.xpnsec.com/hevd-null-pointer/", "published_at": "2018-01-15T07:00:00+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45cacc394c1", "title": "Exploiting Windows 10 Kernel Drivers - Stack Overflow", "url": "https://blog.xpnsec.com/hevd-stack-overflow/", "published_at": "2018-01-02T12:40:32+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45cad08f627", "title": "Windows Anti-Debug techniques - OpenProcess filtering", "url": "https://blog.xpnsec.com/anti-debug-openprocess/", "published_at": "2017-12-13T12:27:08+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45cad1db10a", "title": "Kernel Exploit Demo - Windows 10 privesc via WARBIRD", "url": "https://blog.xpnsec.com/windows-warbird-privesc/", "published_at": "2017-11-27T13:02:00+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45cade16f39", "title": "Alternative methods of becoming SYSTEM", "url": "https://blog.xpnsec.com/becoming-system/", "published_at": "2017-11-20T11:02:26+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45cae34886d", "title": "Kerberos AD Attacks - More Roasting with AS-REP", "url": "https://blog.xpnsec.com/kerberos-attacks-part-2/", "published_at": "2017-11-08T12:30:00+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45caee9ea87", "title": "Defcon 25 in Review", "url": "https://blog.xpnsec.com/defcon-25/", "published_at": "2017-11-04T08:00:00+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45cafac0722", "title": "Setting Service Principal Names To Roast Accounts", "url": "https://blog.xpnsec.com/setting-service-principal-names-to-roast-accounts/", "published_at": "2017-11-04T01:38:53+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45cb04fed1b", "title": "Using machine account credentials during an engagement", "url": "https://blog.xpnsec.com/using-machine-accounts-during-an-engagement/", "published_at": "2017-10-30T11:53:50+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45cb0604ca7", "title": "Kerberos AD Attacks - Kerberoasting", "url": "https://blog.xpnsec.com/kerberos-attacks-part-1/", "published_at": "2017-09-30T22:28:08+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45cb0936918", "title": "ExplodingCan - A vulnerability review", "url": "https://blog.xpnsec.com/explodingcan-a-vulnerability-review/", "published_at": "2017-09-18T14:16:57+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45cb11071f3", "title": "Analysis of APT28 hospitality malware (Part 2)", "url": "https://blog.xpnsec.com/apt28-hospitality-malware-part-2/", "published_at": "2017-08-13T20:19:00+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45cb15db549", "title": "Analysis of APT28 hospitality malware", "url": "https://blog.xpnsec.com/apt28-hospitality-malware/", "published_at": "2017-08-12T14:48:55+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45cb160a99b", "title": "How GitHub login detection banner works", "url": "https://blog.xpnsec.com/how-github-login-detection-works/", "published_at": "2017-08-11T16:11:08+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45cb18908d4", "title": "Industroyer C2 Communication", "url": "https://blog.xpnsec.com/industroyer-c2-protocol/", "published_at": "2017-07-04T20:22:30+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45cb28181a4", "title": "Using Hopper scripting to analyse MacRansom", "url": "https://blog.xpnsec.com/hopper-scripting-macransom/", "published_at": "2017-06-15T22:18:17+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45cb28e3c98", "title": "Reviewing the APT32 phishing malware", "url": "https://blog.xpnsec.com/apt32-phishing-malware/", "published_at": "2017-05-20T21:50:16+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45cb313fe9d", "title": "Exploiting with pwndbg - Solving PlaidCTF 2016 SmartStove", "url": "https://blog.xpnsec.com/pwndbg/", "published_at": "2017-05-02T08:28:16+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45cb333c5ed", "title": "Revisiting PlaidCTF - bigpicture", "url": "https://blog.xpnsec.com/revisiting-plaidctf-bigpicture/", "published_at": "2017-04-25T23:40:29+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45cb3340491", "title": "PlaidCTF - no_mo_flo writeup", "url": "https://blog.xpnsec.com/plaidctf-no_mo_flo-writeup/", "published_at": "2017-04-24T23:19:53+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45cb3fe2314", "title": "Linux ptrace introduction AKA injecting into sshd for fun", "url": "https://blog.xpnsec.com/linux-process-injection-aka-injecting-into-sshd-for-fun/", "published_at": "2017-04-19T09:27:50+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45cb4e7c8e9", "title": "New Blog and the Technology that powers it", "url": "https://blog.xpnsec.com/blog-tech/", "published_at": "2017-04-06T13:58:17+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45cb57495d0", "title": "BSidesSF CTF - DNSCap Walkthrough", "url": "https://blog.xpnsec.com/bsidessf-dnscap/", "published_at": "2017-03-06T01:24:18+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45cb61cf4e0", "title": "BSidesSF CTF - Steel Mountain: Sensors Walkthrough", "url": "https://blog.xpnsec.com/bsidessf-sensors/", "published_at": "2017-03-05T19:06:50+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45cb7058c81", "title": "BSidesSF CTF: b-64-b-tuff Walkthrough", "url": "https://blog.xpnsec.com/bsidessf-b-64-b-tuff/", "published_at": "2017-03-05T19:06:13+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45cb764731a", "title": "ROP Primer - Walkthrough of Level 2", "url": "https://blog.xpnsec.com/rop-primer-level-2/", "published_at": "2017-03-05T19:05:32+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45cb85264c0", "title": "ROP Primer - Walkthrough of Level 1", "url": "https://blog.xpnsec.com/rop-primer-level-1/", "published_at": "2017-03-05T19:04:58+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45cb89b3f34", "title": "ROP Primer - Walkthrough of Level 0", "url": "https://blog.xpnsec.com/rop-primer-level-0/", "published_at": "2017-03-05T19:04:20+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45cb9703170", "title": "Radare2 - Using Emulation To Unpack Metasploit Encoders", "url": "https://blog.xpnsec.com/radare2-using-emulation-to-unpack-metasploit-encoders/", "published_at": "2017-03-05T19:03:31+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45cb9b43df0", "title": "Windows Server 2016 / Docker Privilege Escalation", "url": "https://blog.xpnsec.com/windows-server-2016-docker-privilege-escalation/", "published_at": "2017-03-05T19:02:16+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45cba234770", "title": "Kentico CMS (< 9.0.42) SQLi", "url": "https://blog.xpnsec.com/kentico-cms-9-0-42-sqli/", "published_at": "2017-03-05T19:01:10+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45cbacd2033", "title": "Offensive Forensics - Recovering Files", "url": "https://blog.xpnsec.com/offensive-forensics/", "published_at": "2017-03-05T18:57:26+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45cbb8adb9e", "title": "Github Desktop - DOM XSS", "url": "https://blog.xpnsec.com/github-desktop-dom-xss/", "published_at": "2017-03-05T18:56:43+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45cbc56e270", "title": "Extracting SQL Server Hashes From master.mdf", "url": "https://blog.xpnsec.com/extracting-master-mdf-hashes/", "published_at": "2017-03-05T18:54:23+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45cbcc073c0", "title": "Linux USBIP overflow (CVE-2016-3955)", "url": "https://blog.xpnsec.com/cve-2016-3955/", "published_at": "2017-03-05T18:53:41+00:00" }, { "id": "01a08756-3b8e-73b3-a553-a45cbd76ea1f", "title": "GitHub Desktop - RCE", "url": "https://blog.xpnsec.com/github-desktop-rce/", "published_at": "2017-03-05T18:45:14+00:00" } ] posts Claim your blog

Back to blog.xpnsec.com

Blog · corpus.blog/blogs/blog.xpnsec.com/posts

blog.xpnsec.com

blog.xpnsec.com

2026

Experimenting with Jev for Offensive Security original ↗

23 Sept 2026

Accelerating EDR Evasion with LLM-Driven Analysis original ↗

30 Jul 2026

Disposable Tooling - Building LLM-Generated Mythic Agents from Prompt to Deployment original ↗

29 Jul 2026

Prompt Engineering for Security Agents - A Measurable Approach with GEPA original ↗

29 Jul 2026

Jailbreaking Local Models with JSON original ↗

25 Jul 2026

Benchmarking Malicious Agents original ↗

16 Jul 2026

Extracting creds with Foundation Model original ↗

13 Jul 2026

The Accidental C2 - Exploring Dev Tunnels for Remote Access original ↗

9 May 2026

2025

An Evening with Claude (Code)original ↗

29 Nov 2025

Administrator Protection Review original ↗

20 Jun 2025

Tokenization Confusion original ↗

4 Jun 2025

The SQL Server Crypto Detour original ↗

16 Apr 2025

ADFS - Living in the Legacy of DRS original ↗

12 Jan 2025

2024

Identity Providers for RedTeamers original ↗

18 Mar 2024

2023

MacOS "DirtyNIB" Vulnerability original ↗

4 Oct 2023

Okta for Red Teamers original ↗

2 Oct 2023

LAPS 2.0 Internals original ↗

13 Aug 2023

PNG Steganography from First Principles original ↗

9 Aug 2023

Building a Custom Mach-O Memory Loader for macOS - Part 1 original ↗

4 Feb 2023

Restoring Dyld Memory Loading original ↗

14 Jan 2023

2022

WAM BAM - Recovering Web Tokens From Office original ↗

17 Oct 2022

Exploring SCCM by Unobfuscating Network Access Accounts original ↗

9 Jul 2022

g_CiOptions in a Virtualized World original ↗

15 May 2022

NTLMquic original ↗

11 Apr 2022

Object Overloading original ↗

15 Feb 2022

2021

Weird Ways to Run Unmanaged Code in .NET original ↗

5 May 2021

Azure Application Proxy C2 original ↗

24 Apr 2021

Tailoring Cobalt Strike on Target original ↗

4 Feb 2021

2020

Bring Your Own VM - Mac Edition original ↗

28 Dec 2020

The .NET Export Portal original ↗

24 Nov 2020

We Need To Talk About MACL original ↗

18 Oct 2020

MacOS Injection via Third Party Frameworks original ↗

23 Sept 2020

Debugging into .NET original ↗

10 Aug 2020

Hiding your .NET - COMPlus_ETWEnabled original ↗

6 Jun 2020

Designing The Adversary Simulation Lab original ↗

18 Apr 2020

Hiding your .NET - ETW original ↗

17 Mar 2020

AWS Lambda Redirector original ↗

25 Feb 2020

Testing your RedTeam Infrastructure original ↗

28 Jan 2020

2019

MacOS Filename Homoglyphs Revisited original ↗

10 Dec 2019

Protecting Your Malware with blockdlls and ACG original ↗

4 Nov 2019

Bypassing MacOS Privacy Controls original ↗

23 Sept 2019

Inter-Realm Key Roasting (well... within the first 30 days)original ↗

6 Sept 2019

Analysing RPC With Ghidra and Neo4j original ↗

1 Aug 2019

Evading Sysmon DNS Monitoring original ↗

15 Jun 2019

Exploring Mimikatz - Part 2 - SSP original ↗

7 Jun 2019

Exploring Mimikatz - Part 1 - WDigest original ↗

10 May 2019

Silencing Cylance: A Case Study in Modern EDRs original ↗

18 Apr 2019

Building, Modifying, and Packing with Azure DevOps original ↗

11 Mar 2019

Azure AD Connect for Red Teamers original ↗

18 Feb 2019

How to Argue like Cobalt Strike original ↗

28 Jan 2019

ActiveBreach, powered by Ethereum Blockchain original ↗

5 Jan 2019

2018

RunDLL32 your .NET (AKA DLL exports from .NET)original ↗

5 Nov 2018

Cisco AMP - Bypassing Self-Protection original ↗

27 Oct 2018

AppLocker CLM Bypass via COM original ↗

1 Oct 2018

macOS Research Outtakes - File Extensions original ↗

22 Sept 2018

Disabling MacOS SIP via a VirtualBox kext Vulnerability original ↗

20 Aug 2018

Endpoint Security Self-Protection on MacOS original ↗

14 Aug 2018

Escaping the Sandbox – Microsoft Office on MacOS original ↗

8 Aug 2018

Exploring PowerShell AMSI and Logging Evasion original ↗

9 Jul 2018

Exploiting CVE-2018-1038 - Total Meltdown original ↗

23 Apr 2018

Understanding and Evading Get-InjectedThread original ↗

9 Apr 2018

Exploring Cobalt Strike's ExternalC2 framework original ↗

30 Mar 2018

Moving jobs and exploiting flash (CVE-2018-4878)original ↗

15 Feb 2018

Universal XSS via Evernote WebClipper original ↗

18 Jan 2018

Exploiting Windows 10 Kernel Drivers - NULL Pointer Dereference original ↗

15 Jan 2018

Exploiting Windows 10 Kernel Drivers - Stack Overflow original ↗

2 Jan 2018

2017

Windows Anti-Debug techniques - OpenProcess filtering original ↗

13 Dec 2017

Kernel Exploit Demo - Windows 10 privesc via WARBIRD original ↗

27 Nov 2017

Alternative methods of becoming SYSTEM original ↗

20 Nov 2017

Kerberos AD Attacks - More Roasting with AS-REP original ↗

8 Nov 2017

Defcon 25 in Review original ↗

4 Nov 2017

Setting Service Principal Names To Roast Accounts original ↗

4 Nov 2017

Using machine account credentials during an engagement original ↗

30 Oct 2017

Kerberos AD Attacks - Kerberoasting original ↗

30 Sept 2017

ExplodingCan - A vulnerability review original ↗

18 Sept 2017

Analysis of APT28 hospitality malware (Part 2)original ↗

13 Aug 2017

Analysis of APT28 hospitality malware original ↗

12 Aug 2017

How GitHub login detection banner works original ↗

11 Aug 2017

Industroyer C2 Communication original ↗

4 Jul 2017

Using Hopper scripting to analyse MacRansom original ↗

15 Jun 2017

Reviewing the APT32 phishing malware original ↗

20 May 2017

Exploiting with pwndbg - Solving PlaidCTF 2016 SmartStove original ↗

2 May 2017

Revisiting PlaidCTF - bigpicture original ↗

25 Apr 2017

PlaidCTF - no_mo_flo writeup original ↗

24 Apr 2017

Linux ptrace introduction AKA injecting into sshd for fun original ↗

19 Apr 2017

New Blog and the Technology that powers it original ↗

6 Apr 2017

BSidesSF CTF - DNSCap Walkthrough original ↗

6 Mar 2017

BSidesSF CTF - Steel Mountain: Sensors Walkthrough original ↗

5 Mar 2017

BSidesSF CTF: b-64-b-tuff Walkthrough original ↗

5 Mar 2017

ROP Primer - Walkthrough of Level 2 original ↗

5 Mar 2017

ROP Primer - Walkthrough of Level 1 original ↗

5 Mar 2017

ROP Primer - Walkthrough of Level 0 original ↗

5 Mar 2017

Radare2 - Using Emulation To Unpack Metasploit Encoders original ↗

5 Mar 2017

Windows Server 2016 / Docker Privilege Escalation original ↗

5 Mar 2017

Kentico CMS (< 9.0.42) SQLi original ↗

5 Mar 2017

Offensive Forensics - Recovering Files original ↗

5 Mar 2017

Github Desktop - DOM XSS original ↗

5 Mar 2017

Extracting SQL Server Hashes From master.mdf original ↗

5 Mar 2017

Linux USBIP overflow (CVE-2016-3955)original ↗

5 Mar 2017

GitHub Desktop - RCE original ↗

5 Mar 2017