https://pgj11.com/Hacking, Security Researching, Pentesting/Ethical Hacking, Operating Systems... 2026-08-16T07:21:19+02:00 Pedro Gabaldón Juliá https://pgj11.com/ Jekyll © 2026 Pedro Gabaldón Juliá /assets/img/favicons/favicon.ico /assets/img/favicons/favicon-96x96.png 2026-02-10T00:00:00+01:00 2026-08-13T22:39:11+02:00 https://pgj11.com/posts/FortiGate-Symlink-Attack/ Pedro Gabaldón Juliá

Analysis and Exploitation of FortiGate Symlink Persistence Method Background📚 Around April 2025 Fortinet started warning customers that a Threat Actor (TA) continued to have remote read-only access to filesystem after patching FortiGates (FGT) units. This was achieved by a path in the VPN-SSL. Basically, requesting some route (we will see it later in the post) in the VPN-SSL, it allowed to a...

2025-08-02T00:00:00+02:00 2026-08-13T22:39:11+02:00 https://pgj11.com/posts/FortiGate-VPN-SSL-Honeypot/ Pedro Gabaldón Juliá

FortiGate VPN-SSL Honeypot The following blog post contains an example of running and configuring the FortiGate VPN-SSL Honeypot project. This project can be found in Github here: https://github.com/PeterGabaldon/Fortigate.VPN-SSL.Honeypot Description and Capabilities A deception honeypot that mimics FortiGate VPN-SSL devices to trap brute force attempts, detect deliberately exfiltrated ...

2024-10-11T00:00:00+02:00 2026-08-13T22:39:11+02:00 https://pgj11.com/posts/Bypass-Azure-Admin-Approval-Mode-Enumeration/ Pedro Gabaldón Juliá

Bypass Azure Admin Approval Mode for User Consent Workflow When Enumerating In this short blog post we will see a trick/technique to enumerate an Azure environment when the User App Consent Workflow is blocked and it is necessary to request permission to an administrator. After the administrator approves the consent the user can user the application. When this mode is set an we attempt to enu...

2024-10-04T00:00:00+02:00 2026-08-13T22:39:11+02:00 https://pgj11.com/posts/Finding-TeamViewer-0days-Part-3/ Pedro Gabaldón Juliá

Finding TeamViewer 0days. Part 3: Putting it all together. PARTY TIME :)! Now comes the interesting part. I am sorry about the two last lazy parts, but I wanted to explain the whole process :). Because I had spoiled you, we already know that TV is not filtering the parameter sent by the client to ask for the driver installation nor signature check, etc. So the idea that we will review in thi...

2024-10-04T00:00:00+02:00 2026-08-13T22:39:11+02:00 https://pgj11.com/posts/Finding-TeamViewer-0days-Part-2/ Pedro Gabaldón Juliá

Finding TeamViewer 0days. Part 2: Reversing the Authentication Protocol I started reversing the client in order to find how the authentication was being made. I will skip this whole part as I finally ended understanding the authentication method revering the service. Reversing the client was a tedious task because of Overlapped I/O, multiple threads handling it, CFG and so on. This conducted ...