Ivan Ožić Bebek

GitHub - e-m-b-a/emba: EMBA - The firmware security analyzer

EMBA - The firmware security analyzer. Contribute to e-m-b-a/emba development by creating an account on GitHub.

windows-internals.com

Random Windows Things Part 2: Unexpected Clipboard Data Behavior – Winsider Seminars & Solutions Inc.

Semperis

AD Research: Two new vulnerabilities could lead to full domain takeover

Read the research that led to the discovery of Active Directory privilege escalation vulnerabilities CVE-2026-25177 and CVE-2026-27912.

Can we *really* automate with AI?

I roasted every AI pentester on GitHub in P1, so heres how I actually built mine: real Burp Suite, three MCP servers, machine-verified evidence, and a coverage gate the LLM cant talk its way past.

Checkmate

Special Token Injection (STI) Attack Guide

Large Language Models introduce security issues reminiscent of early-2000s software bugs. Special Token Injection (STI) exploits how LLMs parse structured prompts. This post breaks down what STI is, how it works, where it appears, and why it matters—through a pentester’s lens.

GitHub - AlloySecureGroup/LOL-Forager: Living off the Land Binary Capability Discovery

Living off the Land Binary Capability Discovery. Contribute to AlloySecureGroup/LOL-Forager development by creating an account on GitHub.

SpecterOps

There and Back Again: An Operators Guide on NTLM Relaying Egress

See how the "There and Back Again" NTLM relay attack coerces outbound auth to compromise Active Directory, plus the defenses that stop it.

josephthacker.com

The Bug Bounty Singularity: Our Hackbot

This past December, it became feasible for any skilled hacker to scale up a hacking agent, spending hundreds in token cost to find thousands in bounties. I call this the “Bug Bounty Singularity”. This is the story of JD (xssdoctor) and I building a hackbot which found 126 bugs in the last 5 months.

Censys

Roblox, Minecraft, and the Insidious Internet for Children - Censys

An exploration of Roblox and Minecraft offerwalls and phishing lures — infrastructure that isn’t well covered by conventional threat intelligence.

fearsoff.org

FastJson 1.2.83 Remote Code Execution

Turning fastjson 1.2.83 into remote code execution with AutoType off and no gadget on the classpath: an SSRF inside checkAutoType, the @JSONType bypass, and a /proc/self/fd trick that carries it from JDK 8 to 25. By FearsOff.

bad-jubies.github.io

CVE-2026-50469 - ProjFS File Delete

Introducing Burp AT: agentic AI, built on two decades of Burp Suite

Introduction of Burp AT. PortSwigger's agentic AI capabilities, now accessible in Burp Suite Professional. Public beta now open.

GitHub - imbas007/CVE-2026-48282

Contribute to imbas007/CVE-2026-48282 development by creating an account on GitHub.

Microsoft Corporate Responsibility

Open Weights and American AI Leadership

Open weight AI can expand access, strengthen competition, improve security, and help sustain American AI leadership.

GitHub - tcyph3r/wp2shell-cve-2026-63030-root-cause

Contribute to tcyph3r/wp2shell-cve-2026-63030-root-cause development by creating an account on GitHub.

GitHub - sfewer-r7/CVE-2026-16232: A proof-of-concept script to exploit CVE-2026-16232, an authentication bypass via the SmartConsole login process using an application token.

A proof-of-concept script to exploit CVE-2026-16232, an authentication bypass via the SmartConsole login process using an application token. - sfewer-r7/CVE-2026-16232

Security incident disclosure — July 2026

We’re on a journey to advance and democratize artificial intelligence through open source and open science.

GitHub - MaorSabag/NaX: Custom Adaptix-compatible C2 agent - PIC beacon + Stardust UDRL + Go extender plugins

Custom Adaptix-compatible C2 agent - PIC beacon + Stardust UDRL + Go extender plugins - MaorSabag/NaX

GitHub - nnnnino/rbcdbrute: Pure-impacket parallel local-admin discovery via RBCD.

Pure-impacket parallel local-admin discovery via RBCD. - nnnnino/rbcdbrute

Mohamed Alzhrani

The SID that wasn’t there: bypassing KB5014754 to Domain Admin on a fully patched AD CS

A fully patched AD CS issued me a client-auth certificate with no szOID_NTDS_CA_SECURITY_EXT in it at all. No requester SID. Not mine, not anyone’s. The extension that is the entire point of KB5014754 was simply absent from the issued certificate.

Semperis

Windows Privilege Abuse: Attackers' Path to Active Directory Compromise

Learn how attackers exploit Windows privileges to escalate and extend their foothold in Active Directory ... even in well-patched environments.

SpecterOps

Clustered Points of Failure

Windows Server Failover Clusters share credentials across every node: compromise one, and you compromise the entire cluster

GitHub - wupco/gitlab-rce-demo

Contribute to wupco/gitlab-rce-demo development by creating an account on GitHub.

TrainSec - CyberSecurity online training

Windows Privileges Explained: SeDebugPrivilege and AdjustTokenPrivileges in C++ » TrainSec

Pavel Yosifovich explains what Windows privileges are, why they live in the token, and how to enable SeDebugPrivilege in C++ with OpenProcessToken, LookupPrivilegeValue, and AdjustTokenPrivileges.

Hook Chains (how I built Crystal Kit incorrectly*)

Despite what some would lead you to believe, Crystal Kit is not, and was never intended to be, an all-encompassing nirvana of evasion tradecraft. It was a simple project to experiment with Crystal Palace (CPL) by applying evasion tradecraft to Cobalt Strike's Beacon. There are some capabilities of

White Knight Labs

Harnessing the Power of Cobalt Strike Profiles for EDR Evasion – Part 3 | White Knight Labs

This blog post is a continuation of the previous entry “Harnessing the Power of Cobalt Strike Profiles for EDR Evasion“ and its follow-up, Part 2. Following

GitHub - abhisek3122/HoundMasker: Privacy-Perserving Attack Path Analysis for Bloodhound

Privacy-Perserving Attack Path Analysis for Bloodhound - abhisek3122/HoundMasker

Pentest and Red Team TTPs with RustPack · MSec Operations Blog

GitHub - DepthFirstDisclosures/Nginx-Rift: NGINX RCE exploits

NGINX RCE exploits. Contribute to DepthFirstDisclosures/Nginx-Rift development by creating an account on GitHub.

AI Assisted Vulnerability Research on Embedded Targets

I gave an AI agent access to a cable modem, a serial console, Ghidra, and a custom GDB stub, then asked it to reverse the firmware and hunt for bugs. It re-discovered known vulnerabilities, found new ones, and wrote working exploits. This post covers the setup, what it managed to do on its own, and where I still had to step in. The real problem is that the same approach now works on millions of devices nobody plans to fix.

Sophos Intercept X: A Technical Bypass

Why Zig I got bored again. So I started learning Zig syntax and how it could be beneficial when it comes to writing loaders. I just wanted something new to try, and with Zig being early days still I thought why not. There aren’t many variations out there currently, so in terms of signatures and pattern detection Zig plays a role here although the underlying behaviour is the same. If you’re new to Windows internals there are some amazing resources and tools out there to help, such as SysWhispers