Research Featured AppFlowy Authenticated SQL Injection The actual bug isn't the interesting part in this case, it was the vendor's response - although it's crazy that we're still finding SQL injection in 2026.
Tutorial Guide to Bypassing Hotel Wi-Fi Captive Portals (With Permission) Have you ever been curious about how easy it is to bypass that pesky captive portal? This article guides you through 3 different methods.
Resource Should I Domain Join Backup Servers? If you run Windows-based backup infrastructure, this question comes up sooner or later: do you join the backup server to your Active Directory domain, or keep it out?
Research HestiaCP Admin Takeover & RCE A low privileged user in HestiaCP can exploit a Broken Authorisation flaw to takeover Admin accounts.
Resource CREST ANZ vs CREST International If you're evaluating cyber security providers in Australia, you've probably come across the CREST logo more than once.
Research Featured Local AI for Penetration Testing & Research How competent are local AI models for cyber security bug hunting and research?
Tutorial A user account restriction (for example, a time-of-day restriction) is preventing you from logging on. For assistance, contact your system administrator or technical support. If you've just added your user to the protected users group and can no longer RDP. Here's how to resolve that.
Research Liquidfiles Privilege Escalation An admin in a secondary domain can escalate themselves to sysadmin in Liquidfiles.
Resource Guide to Penetration Testing Services in Australia A practical guide to procuring penetration testing services in Australia, from scope and compliance to selecting the right provider.
Tutorial Remove SPNs and Fix Kerberoasting Remediate Kerberoasting vulnerabilities by removing SPNs for accounts that don't need them.
Tutorial Fixing ESC4 - User has dangerous permissions Prevent ESC4 ADCS attacks by restricting permissions assigned to users and groups.
Tutorial Fixing ESC8 - Web Enrollment is enabled over HTTP and HTTPS, and Channel Binding is disabled Stop ESC8 relay attacks by enforcing Extended Protection for Authentication (EPA) and TLS encryption.
Resource Australia Wide Internal & Wireless Network Penetration Testing We are wherever you are. Project Black maintains capabilities to perform internal and wireless network testing anywhere in Australia.
Tutorial Preventing Downloads from Unmanaged Devices in O365 Defender for Cloud has publicly documented bypasses despite the countless articles suggesting it can be used to block downloads!
News Project Black is now a CVE Numbering Authority (CNA) Project Black is now a CVE CNA! We’re proud to help secure the ecosystem by publishing CVE Records.
Tutorial Fixing ESC1 - Enrollee supplies subject and template allows client authentication ADCS misconfigurations are one of the most common privilege escalation vectors we encounter. This article covers steps to remediate ESC1 flaws.
Tutorial Importing Pre-made Kali VMware VM into ESXi The Kali prebuilt VMware VM is built for VMware Workstation but can still be imported directly into vSphere/ESXi environments with a few extra steps.
Blog Post Dumpster Diving for Data Your trash could be a data breach. I found thousands of medical records on a discarded computer Medicare numbers, DOBs, and treatment plans.
Tutorial Set ms-DS-MachineAccountQuota to 0 By default, low privileged users can create up to 10 computer accounts in an Active Directory domain. Unless you regularly have end users joining computers to the domain, it should be set to 0.
Tutorial Remote Control Android from PC Using scrcpy If you need to remotely access an Android phone this article walks through using scrcpy to remotely manage Android devices natively.
Resource ST4S Assessment So you’ve just been told you need to meet ST4S requirements? Broken down into parts the ST4S framework is relatively straightforward.
Tutorial Firebase Security Fundamentals Every application built on Firebase that we've looked at has had the same vulnerabilities. These common vulnerabilities aren’t hard to prevent but they're easy to overlook.
Research Featured Traccar Unauthenticated LFI v5.8-v6.8.1 Sometimes you search endlessly and find nothing. Other times, the gold just drops into your lap. This is a story about how we accidentally found a pretty impactful vulnerability.
Tutorial Bypassing Windows Login Without Password Forgot your Windows password? Or maybe you're in physical possession of a device that you don't have the password for? Here's a trick to bypass that login screen.
Tutorial Featured Salesforce Penetration Testing Fundamentals This blog walks you through using our script to audit a Salesforce environment, uncovering excessive permissions and platform-specific risks like SOQL injection.
