corpus.blog
41,554 blogs · 5,063,431 posts Claim your blog
Back to blog.xpnsec.com
Blog · corpus.blog/blogs/blog.xpnsec.com/posts

blog.xpnsec.com

blog.xpnsec.com

2026

Experimenting with Jev for Offensive Securityoriginal ↗
23 Sept 2026
Accelerating EDR Evasion with LLM-Driven Analysisoriginal ↗
30 Jul 2026
Disposable Tooling - Building LLM-Generated Mythic Agents from Prompt to Deploymentoriginal ↗
29 Jul 2026
Prompt Engineering for Security Agents - A Measurable Approach with GEPAoriginal ↗
29 Jul 2026
Jailbreaking Local Models with JSONoriginal ↗
25 Jul 2026
Benchmarking Malicious Agentsoriginal ↗
16 Jul 2026
Extracting creds with Foundation Modeloriginal ↗
13 Jul 2026
The Accidental C2 - Exploring Dev Tunnels for Remote Accessoriginal ↗
9 May 2026

2025

An Evening with Claude (Code)original ↗
29 Nov 2025
Administrator Protection Revieworiginal ↗
20 Jun 2025
Tokenization Confusionoriginal ↗
4 Jun 2025
The SQL Server Crypto Detouroriginal ↗
16 Apr 2025
ADFS - Living in the Legacy of DRSoriginal ↗
12 Jan 2025

2024

Identity Providers for RedTeamersoriginal ↗
18 Mar 2024

2023

MacOS "DirtyNIB" Vulnerabilityoriginal ↗
4 Oct 2023
Okta for Red Teamersoriginal ↗
2 Oct 2023
LAPS 2.0 Internalsoriginal ↗
13 Aug 2023
PNG Steganography from First Principlesoriginal ↗
9 Aug 2023
Building a Custom Mach-O Memory Loader for macOS - Part 1original ↗
4 Feb 2023
Restoring Dyld Memory Loadingoriginal ↗
14 Jan 2023

2022

WAM BAM - Recovering Web Tokens From Officeoriginal ↗
17 Oct 2022
Exploring SCCM by Unobfuscating Network Access Accountsoriginal ↗
9 Jul 2022
g_CiOptions in a Virtualized Worldoriginal ↗
15 May 2022
NTLMquicoriginal ↗
11 Apr 2022
Object Overloadingoriginal ↗
15 Feb 2022

2021

Weird Ways to Run Unmanaged Code in .NEToriginal ↗
5 May 2021
Azure Application Proxy C2original ↗
24 Apr 2021
Tailoring Cobalt Strike on Targetoriginal ↗
4 Feb 2021

2020

Bring Your Own VM - Mac Editionoriginal ↗
28 Dec 2020
The .NET Export Portaloriginal ↗
24 Nov 2020
We Need To Talk About MACLoriginal ↗
18 Oct 2020
MacOS Injection via Third Party Frameworksoriginal ↗
23 Sept 2020
Debugging into .NEToriginal ↗
10 Aug 2020
Hiding your .NET - COMPlus_ETWEnabledoriginal ↗
6 Jun 2020
Designing The Adversary Simulation Laboriginal ↗
18 Apr 2020
Hiding your .NET - ETWoriginal ↗
17 Mar 2020
AWS Lambda Redirectororiginal ↗
25 Feb 2020
Testing your RedTeam Infrastructureoriginal ↗
28 Jan 2020

2019

MacOS Filename Homoglyphs Revisitedoriginal ↗
10 Dec 2019
Protecting Your Malware with blockdlls and ACGoriginal ↗
4 Nov 2019
Bypassing MacOS Privacy Controlsoriginal ↗
23 Sept 2019
Inter-Realm Key Roasting (well... within the first 30 days)original ↗
6 Sept 2019
Analysing RPC With Ghidra and Neo4joriginal ↗
1 Aug 2019
Evading Sysmon DNS Monitoringoriginal ↗
15 Jun 2019
Exploring Mimikatz - Part 2 - SSPoriginal ↗
7 Jun 2019
Exploring Mimikatz - Part 1 - WDigestoriginal ↗
10 May 2019
Silencing Cylance: A Case Study in Modern EDRsoriginal ↗
18 Apr 2019
Building, Modifying, and Packing with Azure DevOpsoriginal ↗
11 Mar 2019
Azure AD Connect for Red Teamersoriginal ↗
18 Feb 2019
How to Argue like Cobalt Strikeoriginal ↗
28 Jan 2019
ActiveBreach, powered by Ethereum Blockchainoriginal ↗
5 Jan 2019

2018

RunDLL32 your .NET (AKA DLL exports from .NET)original ↗
5 Nov 2018
Cisco AMP - Bypassing Self-Protectionoriginal ↗
27 Oct 2018
AppLocker CLM Bypass via COMoriginal ↗
1 Oct 2018
macOS Research Outtakes - File Extensionsoriginal ↗
22 Sept 2018
Disabling MacOS SIP via a VirtualBox kext Vulnerabilityoriginal ↗
20 Aug 2018
Endpoint Security Self-Protection on MacOSoriginal ↗
14 Aug 2018
Escaping the Sandbox – Microsoft Office on MacOSoriginal ↗
8 Aug 2018
Exploring PowerShell AMSI and Logging Evasionoriginal ↗
9 Jul 2018
Exploiting CVE-2018-1038 - Total Meltdownoriginal ↗
23 Apr 2018
Understanding and Evading Get-InjectedThreadoriginal ↗
9 Apr 2018
Exploring Cobalt Strike's ExternalC2 frameworkoriginal ↗
30 Mar 2018
Moving jobs and exploiting flash (CVE-2018-4878)original ↗
15 Feb 2018
Universal XSS via Evernote WebClipperoriginal ↗
18 Jan 2018
Exploiting Windows 10 Kernel Drivers - NULL Pointer Dereferenceoriginal ↗
15 Jan 2018
Exploiting Windows 10 Kernel Drivers - Stack Overfloworiginal ↗
2 Jan 2018

2017

Windows Anti-Debug techniques - OpenProcess filteringoriginal ↗
13 Dec 2017
Kernel Exploit Demo - Windows 10 privesc via WARBIRDoriginal ↗
27 Nov 2017
Alternative methods of becoming SYSTEMoriginal ↗
20 Nov 2017
Kerberos AD Attacks - More Roasting with AS-REPoriginal ↗
8 Nov 2017
Defcon 25 in Revieworiginal ↗
4 Nov 2017
Setting Service Principal Names To Roast Accountsoriginal ↗
4 Nov 2017
Using machine account credentials during an engagementoriginal ↗
30 Oct 2017
Kerberos AD Attacks - Kerberoastingoriginal ↗
30 Sept 2017
ExplodingCan - A vulnerability revieworiginal ↗
18 Sept 2017
Analysis of APT28 hospitality malware (Part 2)original ↗
13 Aug 2017
Analysis of APT28 hospitality malwareoriginal ↗
12 Aug 2017
How GitHub login detection banner worksoriginal ↗
11 Aug 2017
Industroyer C2 Communicationoriginal ↗
4 Jul 2017
Using Hopper scripting to analyse MacRansomoriginal ↗
15 Jun 2017
Reviewing the APT32 phishing malwareoriginal ↗
20 May 2017
Exploiting with pwndbg - Solving PlaidCTF 2016 SmartStoveoriginal ↗
2 May 2017
Revisiting PlaidCTF - bigpictureoriginal ↗
25 Apr 2017
PlaidCTF - no_mo_flo writeuporiginal ↗
24 Apr 2017
Linux ptrace introduction AKA injecting into sshd for funoriginal ↗
19 Apr 2017
New Blog and the Technology that powers itoriginal ↗
6 Apr 2017
BSidesSF CTF - DNSCap Walkthroughoriginal ↗
6 Mar 2017
BSidesSF CTF - Steel Mountain: Sensors Walkthroughoriginal ↗
5 Mar 2017
BSidesSF CTF: b-64-b-tuff Walkthroughoriginal ↗
5 Mar 2017
ROP Primer - Walkthrough of Level 2original ↗
5 Mar 2017
ROP Primer - Walkthrough of Level 1original ↗
5 Mar 2017
ROP Primer - Walkthrough of Level 0original ↗
5 Mar 2017
Radare2 - Using Emulation To Unpack Metasploit Encodersoriginal ↗
5 Mar 2017
Windows Server 2016 / Docker Privilege Escalationoriginal ↗
5 Mar 2017
Kentico CMS (< 9.0.42) SQLioriginal ↗
5 Mar 2017
Offensive Forensics - Recovering Filesoriginal ↗
5 Mar 2017
Github Desktop - DOM XSSoriginal ↗
5 Mar 2017
Extracting SQL Server Hashes From master.mdforiginal ↗
5 Mar 2017
Linux USBIP overflow (CVE-2016-3955)original ↗
5 Mar 2017
GitHub Desktop - RCEoriginal ↗
5 Mar 2017
Next