56,966 blogs · [ { "id": "01a07df5-21bb-71db-812f-ba08423135c4", "title": "SensePost’s 2026 Artwork", "url": "https://sensepost.com/blog/2026/senseposts-2026-artwork/", "published_at": "2026-07-08T06:15:40+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0842b01645", "title": "Process Parameter Poisoning", "url": "https://sensepost.com/blog/2026/process-parameter-poisoning/", "published_at": "2026-07-06T15:11:53+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba084398e0eb", "title": "Mobile device interception with MikroTik", "url": "https://sensepost.com/blog/2026/mobile-device-interception-with-mikrotik/", "published_at": "2026-06-04T09:34:57+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0843b9787f", "title": "OpenSSL, Certpinning and Memory patching. Sounds fun right?", "url": "https://sensepost.com/blog/2026/openssl-certpinning-and-memory-patching.-sounds-fun-right/", "published_at": "2026-04-01T13:08:35+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0844b66363", "title": "From flat networks to locked up domains with tiering models", "url": "https://sensepost.com/blog/2026/from-flat-networks-to-locked-up-domains-with-tiering-models/", "published_at": "2026-03-09T11:26:05+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0844b99cdb", "title": "pipetap – a windows named pipe proxy tool", "url": "https://sensepost.com/blog/2025/pipetap-a-windows-named-pipe-proxy-tool/", "published_at": "2025-11-21T06:03:03+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba08458ec612", "title": "Noooooooooo Touch!", "url": "https://sensepost.com/blog/2025/noooooooooo-touch/", "published_at": "2025-11-19T13:20:10+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba08461a7d9e", "title": "A journey implementing Channel Binding on MSSQLClient.py", "url": "https://sensepost.com/blog/2025/a-journey-implementing-channel-binding-on-mssqlclient.py/", "published_at": "2025-07-25T12:03:56+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba084645ee3c", "title": "pwning asus driverhub, msi center, acer control centre and razer synapse 4", "url": "https://sensepost.com/blog/2025/pwning-asus-driverhub-msi-center-acer-control-centre-and-razer-synapse-4/", "published_at": "2025-07-24T17:32:16+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba08474470a1", "title": "No Egress, No Shell, No Problem", "url": "https://sensepost.com/blog/2025/no-egress-no-shell-no-problem/", "published_at": "2025-06-26T07:35:59+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0847852394", "title": "Depscanner: Find orphaned packages before the bad guys do", "url": "https://sensepost.com/blog/2025/depscanner-find-orphaned-packages-before-the-bad-guys-do/", "published_at": "2025-06-03T15:20:54+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0847a6df36", "title": "Investigating an in-the-wild campaign using RCE in CraftCMS", "url": "https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/", "published_at": "2025-04-18T17:31:39+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0847c13988", "title": "Intercepting HTTPS Communication in Flutter: Going Full Hardcore Mode with Frida", "url": "https://sensepost.com/blog/2025/intercepting-https-communication-in-flutter-going-full-hardcore-mode-with-frida/", "published_at": "2025-04-16T16:26:33+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba08480a2c61", "title": "Is TLS more secure? The WinRMS case.", "url": "https://sensepost.com/blog/2025/is-tls-more-secure-the-winrms-case./", "published_at": "2025-04-14T09:07:33+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba08483ef930", "title": "Browser Cache Smuggling: the return of the dropper", "url": "https://sensepost.com/blog/2025/browser-cache-smuggling-the-return-of-the-dropper/", "published_at": "2025-03-24T08:25:35+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0848af7906", "title": "Leakymetry: Circumventing GLPI Authentication", "url": "https://sensepost.com/blog/2025/leakymetry-circumventing-glpi-authentication/", "published_at": "2025-03-21T10:10:56+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba084994001d", "title": "Using & improving frida-trace", "url": "https://sensepost.com/blog/2025/using-improving-frida-trace/", "published_at": "2025-03-19T08:01:41+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0849e608c2", "title": "NoSQL error-based injection", "url": "https://sensepost.com/blog/2025/nosql-error-based-injection/", "published_at": "2025-03-15T15:54:46+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba084a1200bb", "title": "Capchan – Solving CAPTCHA with Image Classification", "url": "https://sensepost.com/blog/2025/capchan-solving-captcha-with-image-classification/", "published_at": "2025-03-13T14:44:49+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba084a68fbc8", "title": "Getting rid of pre- and post-conditions in NoSQL injections", "url": "https://sensepost.com/blog/2025/getting-rid-of-pre-and-post-conditions-in-nosql-injections/", "published_at": "2025-03-11T12:52:49+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba084b55620d", "title": "goLAPS", "url": "https://sensepost.com/blog/2025/golaps/", "published_at": "2025-03-10T11:51:33+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba084c0b9639", "title": "Diving Into AD CS: Exploring Some Common Error Messages", "url": "https://sensepost.com/blog/2025/diving-into-ad-cs-exploring-some-common-error-messages/", "published_at": "2025-03-07T12:02:23+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba084c8d2694", "title": "InvokeADCheck – A PowerShell Module for Assessing Active Directory", "url": "https://sensepost.com/blog/2025/invokeadcheck-a-powershell-module-for-assessing-active-directory/", "published_at": "2025-03-06T10:24:28+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba084d42692f", "title": "PsExec’ing the right way and why zero trust is mandatory", "url": "https://sensepost.com/blog/2025/psexecing-the-right-way-and-why-zero-trust-is-mandatory/", "published_at": "2025-02-10T07:57:49+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba084da014e3", "title": "make prs, not war", "url": "https://sensepost.com/blog/2024/make-prs-not-war/", "published_at": "2024-07-08T12:37:28+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba084dbed069", "title": "Dumping LSA secrets: a story about task decorrelation", "url": "https://sensepost.com/blog/2024/dumping-lsa-secrets-a-story-about-task-decorrelation/", "published_at": "2024-07-03T17:07:10+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba084e72119b", "title": "From a GLPI patch bypass to RCE", "url": "https://sensepost.com/blog/2024/from-a-glpi-patch-bypass-to-rce/", "published_at": "2024-06-20T10:04:24+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba084ed5364b", "title": "Targeting an industrial protocol gateway", "url": "https://sensepost.com/blog/2024/targeting-an-industrial-protocol-gateway/", "published_at": "2024-05-30T11:19:55+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba084f188e44", "title": "Guest vs Null session on Windows", "url": "https://sensepost.com/blog/2024/guest-vs-null-session-on-windows/", "published_at": "2024-04-18T19:12:05+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba084fe89ef8", "title": "From Discovery to Disclosure: ReCrystallize Server Vulnerabilities", "url": "https://sensepost.com/blog/2024/from-discovery-to-disclosure-recrystallize-server-vulnerabilities/", "published_at": "2024-03-22T07:47:02+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0850e873e4", "title": "Mail in the Middle – A tool to automate spear phishing campaigns", "url": "https://sensepost.com/blog/2024/mail-in-the-middle-a-tool-to-automate-spear-phishing-campaigns/", "published_at": "2024-02-26T14:32:27+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0851a58b9a", "title": "Deck of Cards CTF", "url": "https://sensepost.com/blog/2024/deck-of-cards-ctf/", "published_at": "2024-02-19T10:39:21+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0852397d28", "title": "Serial PitM", "url": "https://sensepost.com/blog/2024/serial-pitm/", "published_at": "2024-02-06T15:04:48+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba085258db7d", "title": "Sensecon 23: from Windows drivers to an almost fully working EDR", "url": "https://sensepost.com/blog/2024/sensecon-23-from-windows-drivers-to-an-almost-fully-working-edr/", "published_at": "2024-01-31T08:33:14+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0852f73c3e", "title": "your contributions, today", "url": "https://sensepost.com/blog/2023/your-contributions-today/", "published_at": "2023-12-20T07:14:53+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0853c8265c", "title": "Why defend harder won’t work in the long run and what to do instead – arrest criminals", "url": "https://sensepost.com/blog/2023/why-defend-harder-wont-work-in-the-long-run-and-what-to-do-instead-arrest-criminals/", "published_at": "2023-12-12T11:21:56+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0854a38400", "title": "we’re going to bsides cape town 2023", "url": "https://sensepost.com/blog/2023/were-going-to-bsides-cape-town-2023/", "published_at": "2023-11-28T07:17:03+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba085583ede7", "title": "Black Hat Card Deck CTF", "url": "https://sensepost.com/blog/2023/black-hat-card-deck-ctf/", "published_at": "2023-10-31T07:10:26+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0855d61828", "title": "P4wnP1 LTE updates", "url": "https://sensepost.com/blog/2023/p4wnp1-lte-updates/", "published_at": "2023-10-27T15:12:27+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0856b5c06f", "title": "Reading Large Files and Perf", "url": "https://sensepost.com/blog/2023/reading-large-files-and-perf/", "published_at": "2023-09-19T08:08:18+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0857314941", "title": "Dress Code – The Talk", "url": "https://sensepost.com/blog/2023/dress-code-the-talk/", "published_at": "2023-08-23T16:29:05+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0858291b8c", "title": "Filter-Mute Operation: Investigating EDR Internal Communication", "url": "https://sensepost.com/blog/2023/filter-mute-operation-investigating-edr-internal-communication/", "published_at": "2023-07-28T14:38:54+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0858b67653", "title": "Orange Cyberdefense at Hacker Summer Camp", "url": "https://sensepost.com/blog/2023/orange-cyberdefense-at-hacker-summer-camp/", "published_at": "2023-07-17T15:55:03+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0858de9fb1", "title": "Browsers’ cache smuggling", "url": "https://sensepost.com/blog/2023/browsers-cache-smuggling/", "published_at": "2023-07-10T08:33:20+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0859b18fa2", "title": "P4wnP1-LTE", "url": "https://sensepost.com/blog/2023/p4wnp1-lte/", "published_at": "2023-07-09T18:06:49+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba085a67aa9d", "title": "select * from projectdiscovery join steampipe", "url": "https://sensepost.com/blog/2023/select-from-projectdiscovery-join-steampipe/", "published_at": "2023-07-03T09:52:34+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba085aa0f291", "title": "an offensive look at docker desktop extensions", "url": "https://sensepost.com/blog/2023/an-offensive-look-at-docker-desktop-extensions/", "published_at": "2023-05-30T07:24:42+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba085b67b148", "title": "Investigating the Wink Hub 2", "url": "https://sensepost.com/blog/2023/investigating-the-wink-hub-2/", "published_at": "2023-05-26T10:40:21+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba085c13a7bd", "title": "hash-cracker – password cracking done effectively", "url": "https://sensepost.com/blog/2023/hash-cracker-password-cracking-done-effectively/", "published_at": "2023-04-05T12:35:21+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba085c270350", "title": "Protected Users: you thought you were safe uh?", "url": "https://sensepost.com/blog/2023/protected-users-you-thought-you-were-safe-uh/", "published_at": "2023-03-31T06:03:38+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba085c62fb1b", "title": "From BitLocker-Suspended to Virtual Machine", "url": "https://sensepost.com/blog/2023/from-bitlocker-suspended-to-virtual-machine/", "published_at": "2023-03-28T18:06:02+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba085d5f209b", "title": "Decoding BlazorPack", "url": "https://sensepost.com/blog/2023/decoding-blazorpack/", "published_at": "2023-02-22T02:05:00+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba085e11413c", "title": "Jumping into SOCKS", "url": "https://sensepost.com/blog/2023/jumping-into-socks/", "published_at": "2023-01-24T10:59:07+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba085ef82369", "title": "CertPotato – Using ADCS to privesc from virtual and network service accounts to local system", "url": "https://sensepost.com/blog/2022/certpotato-using-adcs-to-privesc-from-virtual-and-network-service-accounts-to-local-system/", "published_at": "2022-11-04T13:27:54+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba085feab968", "title": "Abusing Windows’ tokens to compromise Active Directory without touching LSASS", "url": "https://sensepost.com/blog/2022/abusing-windows-tokens-to-compromise-active-directory-without-touching-lsass/", "published_at": "2022-10-27T16:48:02+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0860955652", "title": "WireSocks for Easy Proxied Routing", "url": "https://sensepost.com/blog/2022/wiresocks-for-easy-proxied-routing/", "published_at": "2022-09-30T04:48:00+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0860acb921", "title": "sensecon 2022 – wait a minute, you got legs? edition", "url": "https://sensepost.com/blog/2022/sensecon-2022-wait-a-minute-you-got-legs-edition/", "published_at": "2022-08-03T13:27:41+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0860e034f2", "title": "me vs request smugglingPOST", "url": "https://sensepost.com/blog/2022/me-vs-request-smugglingpost/", "published_at": "2022-07-19T08:35:32+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0861125a81", "title": "Sail away, sail away, sail away", "url": "https://sensepost.com/blog/2022/sail-away-sail-away-sail-away/", "published_at": "2022-05-31T18:09:14+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0861f8b82a", "title": "using a cloud mac with a local ios device", "url": "https://sensepost.com/blog/2022/using-a-cloud-mac-with-a-local-ios-device/", "published_at": "2022-05-28T16:34:37+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0862cbf348", "title": "Constrained Delegation Considerations for Lateral Movement", "url": "https://sensepost.com/blog/2022/constrained-delegation-considerations-for-lateral-movement/", "published_at": "2022-05-18T06:35:32+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0863ad7013", "title": "Left To My Own Devices – Fast NTCracking in Rust", "url": "https://sensepost.com/blog/2022/left-to-my-own-devices-fast-ntcracking-in-rust/", "published_at": "2022-02-16T12:33:23+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0863db342d", "title": "SIM Hijacking", "url": "https://sensepost.com/blog/2022/sim-hijacking/", "published_at": "2022-02-07T12:29:41+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0863f7cc54", "title": "Android Application Testing Using Windows 11 and Windows Subsystem for Android", "url": "https://sensepost.com/blog/2021/android-application-testing-using-windows-11-and-windows-subsystem-for-android/", "published_at": "2021-11-16T09:10:15+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba08641c1f00", "title": "sensecon 2021 – wargames edition", "url": "https://sensepost.com/blog/2021/sensecon-2021-wargames-edition/", "published_at": "2021-09-28T13:14:33+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba086459dd74", "title": "Building an offensive RPC interface", "url": "https://sensepost.com/blog/2021/building-an-offensive-rpc-interface/", "published_at": "2021-08-03T17:50:13+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0865541322", "title": "blackhat_defcon_virtual_vegas_2021.zip", "url": "https://sensepost.com/blog/2021/blackhat_defcon_virtual_vegas_2021.zip/", "published_at": "2021-07-31T18:39:23+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0865beed66", "title": "Come do Wi-Fi!", "url": "https://sensepost.com/blog/2021/come-do-wi-fi/", "published_at": "2021-07-19T08:42:08+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba086670d297", "title": "Exploring The Fundamentals", "url": "https://sensepost.com/blog/2021/exploring-the-fundamentals/", "published_at": "2021-07-18T18:59:40+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0866ddb3d6", "title": "Our Enterprise Infrastructure Hacking Course", "url": "https://sensepost.com/blog/2021/our-enterprise-infrastructure-hacking-course/", "published_at": "2021-07-18T16:23:16+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba086750f832", "title": "Adventures into HTTP2 and HTTP3", "url": "https://sensepost.com/blog/2021/adventures-into-http2-and-http3/", "published_at": "2021-05-27T08:02:02+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0867e8c35f", "title": "From 500 to Account Takeover", "url": "https://sensepost.com/blog/2021/from-500-to-account-takeover/", "published_at": "2021-03-02T19:24:02+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba08686531a8", "title": "on ios binary protections", "url": "https://sensepost.com/blog/2021/on-ios-binary-protections/", "published_at": "2021-03-02T14:22:01+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0869248860", "title": "dwn – a docker pwn tool manager experiment", "url": "https://sensepost.com/blog/2021/dwn-a-docker-pwn-tool-manager-experiment/", "published_at": "2021-02-08T09:42:28+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0869b49946", "title": "Android Application Specific Proxies, Easy Mode", "url": "https://sensepost.com/blog/2021/android-application-specific-proxies-easy-mode/", "published_at": "2021-01-29T11:33:26+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba086a736278", "title": "Duo Two-factor Authentication Bypass", "url": "https://sensepost.com/blog/2021/duo-two-factor-authentication-bypass/", "published_at": "2021-01-28T08:39:54+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba086aff3193", "title": "sconwar – sensecon 2020", "url": "https://sensepost.com/blog/2020/sconwar-sensecon-2020/", "published_at": "2020-11-23T18:01:33+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba086b4be60a", "title": "DualSense Reverse Engineering", "url": "https://sensepost.com/blog/2020/dualsense-reverse-engineering/", "published_at": "2020-11-23T09:52:32+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba086bf14212", "title": "sensecon 2020 ex post facto", "url": "https://sensepost.com/blog/2020/sensecon-2020-ex-post-facto/", "published_at": "2020-11-13T16:21:41+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba086cbf25b5", "title": "Szensecon Discord Bot", "url": "https://sensepost.com/blog/2020/szensecon-discord-bot/", "published_at": "2020-11-09T17:47:01+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba086d507685", "title": "thumbscr-ews – a python EWS tool", "url": "https://sensepost.com/blog/2020/thumbscr-ews-a-python-ews-tool/", "published_at": "2020-11-04T14:39:55+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba086d8aeb59", "title": "More On Foreign Hashes", "url": "https://sensepost.com/blog/2020/more-on-foreign-hashes/", "published_at": "2020-10-08T07:40:14+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba086df5b3c1", "title": "Pass-the-hash WiFi", "url": "https://sensepost.com/blog/2020/pass-the-hash-wifi/", "published_at": "2020-10-02T14:29:44+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba086ee89332", "title": "Let me store that for you", "url": "https://sensepost.com/blog/2020/let-me-store-that-for-you/", "published_at": "2020-09-11T15:44:51+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba086fa4b03e", "title": "building a hipster-aware pi home server", "url": "https://sensepost.com/blog/2020/building-a-hipster-aware-pi-home-server/", "published_at": "2020-09-02T15:48:23+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba086fce7bc8", "title": "DirectAccess and Kerberos Resource-based Constrained Delegation", "url": "https://sensepost.com/blog/2020/directaccess-and-kerberos-resource-based-constrained-delegation/", "published_at": "2020-08-19T15:16:21+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0870aa4e32", "title": "NTHashes and Encodings", "url": "https://sensepost.com/blog/2020/nthashes-and-encodings/", "published_at": "2020-08-19T11:44:40+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba087177d162", "title": "Routopsy – Hacking Routing with Routers", "url": "https://sensepost.com/blog/2020/routopsy-hacking-routing-with-routers/", "published_at": "2020-08-03T18:23:23+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0871c3a51a", "title": "SensePost is now an ethical hacking team of Orange Cyberdefense", "url": "https://sensepost.com/blog/2020/sensepost-is-now-an-ethical-hacking-team-of-orange-cyberdefense/", "published_at": "2020-07-31T07:35:23+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba08720f9c2d", "title": "ACE to RCE", "url": "https://sensepost.com/blog/2020/ace-to-rce/", "published_at": "2020-07-24T12:28:26+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba087214fd50", "title": "Seeing (Sig)Red", "url": "https://sensepost.com/blog/2020/seeing-sigred/", "published_at": "2020-07-20T14:01:31+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0872ecc99c", "title": "Avoiding detection via DHCP options", "url": "https://sensepost.com/blog/2020/avoiding-detection-via-dhcp-options/", "published_at": "2020-07-20T13:22:32+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba08731eb9a8", "title": "Clash of the (Spam)Titan", "url": "https://sensepost.com/blog/2020/clash-of-the-spamtitan/", "published_at": "2020-07-14T07:14:29+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0873610b57", "title": "Covert Login Alerting", "url": "https://sensepost.com/blog/2020/covert-login-alerting/", "published_at": "2020-07-13T05:40:20+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0873723e82", "title": "Making the Perfect Red Team Dropbox (Part 2)", "url": "https://sensepost.com/blog/2020/making-the-perfect-red-team-dropbox-part-2/", "published_at": "2020-07-09T10:28:05+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba087449e81a", "title": "Multiple Android User Profiles", "url": "https://sensepost.com/blog/2020/multiple-android-user-profiles/", "published_at": "2020-06-29T18:46:40+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba08749b20f0", "title": "Resurrecting an old AMSI Bypass", "url": "https://sensepost.com/blog/2020/resurrecting-an-old-amsi-bypass/", "published_at": "2020-06-24T09:02:40+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba087574c63b", "title": "The hunt for Chromium issue 1072171", "url": "https://sensepost.com/blog/2020/the-hunt-for-chromium-issue-1072171/", "published_at": "2020-05-29T16:56:54+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0875cf976b", "title": "Being Stubborn Pays Off pt. 2 – Tale of two 0days on PRTG Network Monitor", "url": "https://sensepost.com/blog/2020/being-stubborn-pays-off-pt.-2-tale-of-two-0days-on-prtg-network-monitor/", "published_at": "2020-05-22T09:22:00+00:00" }, { "id": "01a07df5-21bb-71db-812f-ba0876aac0cd", "title": "Making the Perfect Red Team Dropbox (Part 1)", "url": "https://sensepost.com/blog/2020/making-the-perfect-red-team-dropbox-part-1/", "published_at": "2020-05-18T11:02:02+00:00" } ] posts Claim your blog

Back to SensePost

Blog · corpus.blog/blogs/sensepost.com/posts

SensePost

sensepost.com

2026

SensePost’s 2026 Artwork original ↗

8 Jul 2026

Process Parameter Poisoning original ↗

6 Jul 2026

Mobile device interception with MikroTik original ↗

4 Jun 2026

OpenSSL, Certpinning and Memory patching. Sounds fun right?original ↗

1 Apr 2026

From flat networks to locked up domains with tiering models original ↗

9 Mar 2026

2025

pipetap – a windows named pipe proxy tool original ↗

21 Nov 2025

Noooooooooo Touch!original ↗

19 Nov 2025

A journey implementing Channel Binding on MSSQLClient.py original ↗

25 Jul 2025

pwning asus driverhub, msi center, acer control centre and razer synapse 4 original ↗

24 Jul 2025

No Egress, No Shell, No Problem original ↗

26 Jun 2025

Depscanner: Find orphaned packages before the bad guys do original ↗

3 Jun 2025

Investigating an in-the-wild campaign using RCE in CraftCMS original ↗

18 Apr 2025

Intercepting HTTPS Communication in Flutter: Going Full Hardcore Mode with Frida original ↗

16 Apr 2025

Is TLS more secure? The WinRMS case.original ↗

14 Apr 2025

Browser Cache Smuggling: the return of the dropper original ↗

24 Mar 2025

Leakymetry: Circumventing GLPI Authentication original ↗

21 Mar 2025

Using & improving frida-trace original ↗

19 Mar 2025

NoSQL error-based injection original ↗

15 Mar 2025

Capchan – Solving CAPTCHA with Image Classification original ↗

13 Mar 2025

Getting rid of pre- and post-conditions in NoSQL injections original ↗

11 Mar 2025

goLAPS original ↗

10 Mar 2025

Diving Into AD CS: Exploring Some Common Error Messages original ↗

7 Mar 2025

InvokeADCheck – A PowerShell Module for Assessing Active Directory original ↗

6 Mar 2025

PsExec’ing the right way and why zero trust is mandatory original ↗

10 Feb 2025

2024

make prs, not war original ↗

8 Jul 2024

Dumping LSA secrets: a story about task decorrelation original ↗

3 Jul 2024

From a GLPI patch bypass to RCE original ↗

20 Jun 2024

Targeting an industrial protocol gateway original ↗

30 May 2024

Guest vs Null session on Windows original ↗

18 Apr 2024

From Discovery to Disclosure: ReCrystallize Server Vulnerabilities original ↗

22 Mar 2024

Mail in the Middle – A tool to automate spear phishing campaigns original ↗

26 Feb 2024

Deck of Cards CTF original ↗

19 Feb 2024

Serial PitM original ↗

6 Feb 2024

Sensecon 23: from Windows drivers to an almost fully working EDR original ↗

31 Jan 2024

2023

your contributions, today original ↗

20 Dec 2023

Why defend harder won’t work in the long run and what to do instead – arrest criminals original ↗

12 Dec 2023

we’re going to bsides cape town 2023 original ↗

28 Nov 2023

Black Hat Card Deck CTF original ↗

31 Oct 2023

P4wnP1 LTE updates original ↗

27 Oct 2023

Reading Large Files and Perf original ↗

19 Sept 2023

Dress Code – The Talk original ↗

23 Aug 2023

Filter-Mute Operation: Investigating EDR Internal Communication original ↗

28 Jul 2023

Orange Cyberdefense at Hacker Summer Camp original ↗

17 Jul 2023

Browsers’ cache smuggling original ↗

10 Jul 2023

P4wnP1-LTE original ↗

9 Jul 2023

select * from projectdiscovery join steampipe original ↗

3 Jul 2023

an offensive look at docker desktop extensions original ↗

30 May 2023

Investigating the Wink Hub 2 original ↗

26 May 2023

hash-cracker – password cracking done effectively original ↗

5 Apr 2023

Protected Users: you thought you were safe uh?original ↗

31 Mar 2023

From BitLocker-Suspended to Virtual Machine original ↗

28 Mar 2023

Decoding BlazorPack original ↗

22 Feb 2023

Jumping into SOCKS original ↗

24 Jan 2023

2022

CertPotato – Using ADCS to privesc from virtual and network service accounts to local system original ↗

4 Nov 2022

Abusing Windows’ tokens to compromise Active Directory without touching LSASS original ↗

27 Oct 2022

WireSocks for Easy Proxied Routing original ↗

30 Sept 2022

sensecon 2022 – wait a minute, you got legs? edition original ↗

3 Aug 2022

me vs request smugglingPOST original ↗

19 Jul 2022

Sail away, sail away, sail away original ↗

31 May 2022

using a cloud mac with a local ios device original ↗

28 May 2022

Constrained Delegation Considerations for Lateral Movement original ↗

18 May 2022

Left To My Own Devices – Fast NTCracking in Rust original ↗

16 Feb 2022

SIM Hijacking original ↗

7 Feb 2022

2021

Android Application Testing Using Windows 11 and Windows Subsystem for Android original ↗

16 Nov 2021

sensecon 2021 – wargames edition original ↗

28 Sept 2021

Building an offensive RPC interface original ↗

3 Aug 2021

blackhat_defcon_virtual_vegas_2021.zip original ↗

31 Jul 2021

Come do Wi-Fi!original ↗

19 Jul 2021

Exploring The Fundamentals original ↗

18 Jul 2021

Our Enterprise Infrastructure Hacking Course original ↗

18 Jul 2021

Adventures into HTTP2 and HTTP3 original ↗

27 May 2021

From 500 to Account Takeover original ↗

2 Mar 2021

on ios binary protections original ↗

2 Mar 2021

dwn – a docker pwn tool manager experiment original ↗

8 Feb 2021

Android Application Specific Proxies, Easy Mode original ↗

29 Jan 2021

Duo Two-factor Authentication Bypass original ↗

28 Jan 2021

2020

sconwar – sensecon 2020 original ↗

23 Nov 2020

DualSense Reverse Engineering original ↗

23 Nov 2020

sensecon 2020 ex post facto original ↗

13 Nov 2020

Szensecon Discord Bot original ↗

9 Nov 2020

thumbscr-ews – a python EWS tool original ↗

4 Nov 2020

More On Foreign Hashes original ↗

8 Oct 2020

Pass-the-hash WiFi original ↗

2 Oct 2020

Let me store that for you original ↗

11 Sept 2020

building a hipster-aware pi home server original ↗

2 Sept 2020

DirectAccess and Kerberos Resource-based Constrained Delegation original ↗

19 Aug 2020

NTHashes and Encodings original ↗

19 Aug 2020

Routopsy – Hacking Routing with Routers original ↗

3 Aug 2020

SensePost is now an ethical hacking team of Orange Cyberdefense original ↗

31 Jul 2020

ACE to RCE original ↗

24 Jul 2020

Seeing (Sig)Red original ↗

20 Jul 2020

Avoiding detection via DHCP options original ↗

20 Jul 2020

Clash of the (Spam)Titan original ↗

14 Jul 2020

Covert Login Alerting original ↗

13 Jul 2020

Making the Perfect Red Team Dropbox (Part 2)original ↗

9 Jul 2020

Multiple Android User Profiles original ↗

29 Jun 2020

Resurrecting an old AMSI Bypass original ↗

24 Jun 2020

The hunt for Chromium issue 1072171 original ↗

29 May 2020

Being Stubborn Pays Off pt. 2 – Tale of two 0days on PRTG Network Monitor original ↗

22 May 2020

Making the Perfect Red Team Dropbox (Part 1)original ↗

18 May 2020