Summary Part 1 ended with a question: how does a proxy configured by an interactive user arrive inside ncsi.dll when the service thread is not impersonating that user? In this part we will walk t...
Summary In February 2026, I started investigating a Windows proxy behaviour in which a proxy configured by an unprivileged user caused NCSI to negotiate NTLM with an attacker-controlled proxy from...
Introduction Recently, in a Linux server compromise, the TA used a gsocket binary as a reverse shell tunnel. The compromise started with a WordPress site affected by CVE-2026-18322 and the attacke...
Analysis and Exploitation of FortiGate Symlink Persistence Method Background📚 Around April 2025 Fortinet started warning customers that a Threat Actor (TA) continued to have remote read-only acc...
FortiGate VPN-SSL Honeypot The following blog post contains an example of running and configuring the FortiGate VPN-SSL Honeypot project. This project can be found in Github here: https://githu...
Bypass Azure Admin Approval Mode for User Consent Workflow When Enumerating In this short blog post we will see a trick/technique to enumerate an Azure environment when the User App Consent Workfl...
Finding TeamViewer 0days. Part 3: Putting it all together. PARTY TIME :)! Now comes the interesting part. I am sorry about the two last lazy parts, but I wanted to explain the whole process :). B...
Finding TeamViewer 0days. Part 2: Reversing the Authentication Protocol I started reversing the client in order to find how the authentication was being made. I will skip this whole part as I fina...
Finding TeamViewer 0days. Part 1: The story begins This series of blog posts are about some findings related to TeamViewer (TV) IPC communication with its SYSTEM service. I was trying to find some...
Kerberos Diamond and Sapphire Tickets As you may known, one of the approaches for persistence in a Windows Active Directory are the well-known techniques Golden Ticket and Silver Ticket. In the po...