The Curious Engineer

All blogs / Security

Praetorian

praetorian.com

Explore the latest insights in the offensive security blog to enhance your cybersecurity knowledge and skills.

SecurityAI / MLReverse engineering

’15’20’25
Posts
326 from 9 Jul 2012 to 27 Oct 2026
Posting
weekly (56 in the last year)
Kind
company blog
Feed
https://www.praetorian.com/feed/

2026 53

  1. php2shell in Practice: Exploitable, Conditional, and Hard to Mass-Exploit
  2. Hunt, Triage, and Act on Guard Findings in Slack
  3. Hannibal Puts Autonomous Penetration Testing Under Your Control
  4. Credentials Are Still the Shortest Path In
  5. Bluetooth Low Energy Security Testing, Consolidated: Introducing Caeruleus
  6. FreeBSoD: Leveraging Language Models to Find and Exploit Kernel Bugs (Part 2 of 2)
  7. Knossos: Procedurally Generated Decoy Environments
  8. GhostPack Necromancy: Reforging C# Tools with WasmForge
  9. FreeBSoD: Leveraging Language Models to Find and Exploit Kernel Bugs (Part 1 of 2)
  10. Sharing is Caring: SMB Secret Scanning with Sulla
  11. Centurion: Bring Your Own Execution Environment
  12. Enter the WasmForge: Compiling Sliver into WebAssembly
  13. When Encryption Isn’t Really Encryption
  14. Adversarial Oracles: LLM-Guided EDR Signature Reduction
  15. Your Login Page Is Lying: What AI Agents Find When They Read Your Frontend
  16. 500,000 Vulnerabilities, 14 That Matter: How Exploit Chain Analysis Cuts Through the Noise
  17. The Attack Helix: Praetorian’s AI & Economic Architecture for Offensive Security
  18. Shadow Admins in Active Directory: Hidden Privilege Paths Attackers Exploit
  19. Bypassing LLM Supervisor Agents Through Indirect Prompt Injection
  20. Meet Vespasian. It Sees What Static Analysis Can’t.
  21. A Possible Solution to the Zodiac Killer Z32 Cipher
  22. Your API Has Authorization Bugs. Hadrian Finds Them.
  23. Reflecting on Your Tier Model: CVE-2025-33073 and the One-Hop Problem
  24. Which Came First: The System Prompt, or the RCE?
  25. Julius v0.2.0: From 33 to 63 Probes — Now Detecting Cloud AI, Enterprise Inference, and RAG Pipelines
  26. Azure APIM Signup Bypass: 97.9% of Developer Portals Still Exploitable Anonymously and from the Internet
  27. AI-Driven Offensive Security: The Current Landscape and What It Means for Defense
  28. Reunifying the Cloud: Introducing Aurelian for Multi-Cloud Security Testing
  29. CVE-2026-3630: Critical Buffer Overflow in Delta Electronics COMMGR2 Enables Remote Code Execution
  30. When HttpOnly Isn’t Enough: Chaining XSS and GhostScript for Full RCE Compromise
  31. Augustus v0.0.9: Multi-Turn Attacks for LLMs That Fight Back
  32. Et Tu, RDP? Detecting Sticky Keys Backdoors with Brutus and WebAssembly
  33. Mapping the Unknown: Introducing Pius for Organizational Asset Discovery
  34. When Proxies Become the Attack Vectors in Web Architectures
  35. Beyond Prompt Injection: The Hidden AI Security Threats in Machine Learning Platforms
  36. Building Bridges, Breaking Pipelines: Introducing Trajan
  37. How AI Agents Automate CVE Vulnerability Research
  38. What’s Running on That Port? Introducing Nerva for Service Fingerprinting
  39. AI-Powered CVE Research: Winning the Race Against Emerging Vulnerabilities
  40. There’s Always Something: Secrets Detection at Engagement Scale with Titus
  41. Praetorian Guard finds critical flaws in OpenClaw – And What It Means for Your Software Supply Chain
  42. MCP Server Security: The Hidden AI Attack Surface
  43. Julius Update: From 17 to 33 Probes (and Now Detecting OpenClaw)
  44. Et Tu, Default Creds? Introducing Brutus for Modern Credential Testing
  45. Introducing Augustus: Open Source LLM Prompt Injection Tool
  46. Deterministic AI Orchestration: A Platform Architecture for Autonomous Development
  47. Gone Phishing, Got a Token: When Separate Flaws Combine
  48. Introducing Julius: Open Source LLM Service Fingerprinting
  49. Corrupting the Hive Mind: Persistence Through Forgotten Windows Internals
  50. Stealing AI Models Through the API: A Practical Model Extraction Attack
  51. As Strong As Your Weakest Parameter: An AI Authorization Bypass
  52. Exploiting LLM Write Primitives: System Prompt Extraction When Chat Output Is Locked Down
  53. Where AI Systems Leak Data: A Lifecycle Review of Real Exposure Paths

2025 23

  1. Critical Advisory: Remote Code Execution in Next.js (CVE-2025-66478) with Working Exploit
  2. CVE-2025-52493: When Password FieldsAren’t Enough – Client-Side SecretExposure in PagerDuty Cloud Runbook
  3. How I Found the Worst ASP.NET Vulnerability — A $10K Bug (CVE-2025-55315)
  4. Your Vulnerability Scanner Might Be Your Weakest Link
  5. Domain Fronting is Dead. Long Live Domain Fronting!
  6. The Security Time Capsule: Evolving Beyond Legacy Pen Testing
  7. OAuthSeeker: Leveraging OAuth Phishing for Initial Access and Lateral Movement on Red Team Engagements
  8. Ghost Calls: Abusing Web Conferencing for Covert Command & Control (Part 2 of 2)
  9. Ghost Calls: Abusing Web Conferencing for Covert Command & Control (Part 1 of 2)
  10. Hunting for Secrets in Plain Sight: Leveraging Internal Logging and Monitoring Services
  11. CI/CD Training from the Front Lines: Offensive Security at Black Hat
  12. GitPhish: Automating Enterprise GitHub Device Code Phishing
  13. Introducing: GitHub Device Code Phishing
  14. Hardware Hacking a Nicotine Vape
  15. Agent of Chaos: Hijacking NodeJS’s Jenkins Agents
  16. ELFDICOM: PoC Malware Polyglot Exploiting Linux-Based Medical Devices
  17. An Improved Detection Signature for the Kubernetes IngressNightmare Vulnerability
  18. CodeQLEAKED – Public Secrets Exposure Leads to Supply Chain Attack on GitHub CodeQL
  19. Azure RBAC Privilege Escalations: Azure VM
  20. Leveraging Microsoft Text Services Framework (TSF) for Red Team Operations
  21. Introducing Nosey Parker Explorer
  22. ETW Threat Intelligence and Hardware Breakpoints
  23. Tarbomb Denial of Service via Path Traversal

2024 27

  1. Breaking the Air Gap Through Hardware Implants
  2. Nosey Parker Turns Two: Celebrating Two Years of Open-Source Secrets Discovery
  3. RF Fortune Telling: Frequency Hopping Predictability
  4. Skeletons in the Closet: Legacy Software, Novel Exploits
  5. Cutting Through the Noise: Chariot’s Zero False Positive Guarantee
  6. The CTEM Cookbook: Improving Your Vulnerability Program with Continuous Threat Exposure Management (CTEM)
  7. Identifying SQL Injections in a GraphQL API
  8. Introducing Goffloader: A Pure Go Implementation of an In-Memory COFFLoader and PE Loader
  9. 3CX Phone System Local Privilege Escalation Vulnerability
  10. Account Takeover via Broken Authentication Workflow: Free Lifetime Streaming!
  11. Drop the Mic (CVE-2019-1166)
  12. Amazon Cloud Integration Capability with Chariot
  13. Exploiting Broken Authentication Control In GraphQL
  14. Recursive Amplification Attacks: Botnet-as-a-Service
  15. Capturing Exposed AWS Keys During Dynamic Web Application Tests
  16. Unconstrained Delegation in Active Directory
  17. Continuous Threat Exposure Management for Google Cloud
  18. Attack Surface Management: A Free Enablement Technology for Effective Continuous Threat Exposure Management
  19. Secrets Exposed: The Rise of GitHub as an Attack Vector
  20. CVE-2024-6387: RegreSSHion
  21. Chariot Continuous Threat Exposure Management (CTEM) Updates
  22. Compromising ByteDance’s Rspack using GitHub Actions Vulnerabilities
  23. Local Privilege Escalation Vulnerability in Ant Media Server (CVE-2024-32656)
  24. MeshCentral Cross-Site Websocket Hijacking Vulnerability (CVE-2024-26135)
  25. Exploiting Kubernetes through Operator Injection
  26. Relution Remote Code Execution via Java Deserialization Vulnerability
  27. TensorFlow Supply Chain Compromise via Self-Hosted Runner Attack

2023 38

  1. Understanding the Impact of the new Apache Struts File Upload Vulnerability
  2. SonicWall WXA – Authentication Bypass and Remote Code Execution Vulnerability
  3. Analyzing the SonicWall Custom Grub LUKS Encryption Modifications
  4. Why Azure B2C ROPC Custom Flows Are Inherently Insecure
  5. Nosey Parker’s Ongoing Machine Learning Development
  6. Every Rose Has Its Thorn SFTP Gateway
  7. Refresh: Compromising F5 BIG-IP With Request Smuggling | CVE-2023-46747
  8. Technical Advisory: F5 BIG-IP Unauthenticated RCE Vulnerability, CVE-2023-46747
  9. Understanding the Recent Confluence Vulnerability (CVE-2023-22515) and Digging into Atlassian Bamboo
  10. Technical Advisory: Vulnerabilities Identified within ListServ
  11. Long Live the Pwn Request: Hacking Microsoft GitHub Repositories and More
  12. DoubleQlik: Bypassing the Fix for CVE-2023-41265 to Achieve Unauthenticated Remote Code Execution
  13. Helpdesk Telephone Attack: How to Close Process and Technology Gaps
  14. Advisory: Qlik Original Fix for CVE 2023-41265 Vulnerable to RCE
  15. Back to the 90s: Fujitsu “IP series” Real-time Video Transmission Gear Hard Coded Credentials
  16. ZeroQlik: Achieving Unauthenticated Remote Code Execution via HTTP Request Tunneling and Path Traversal
  17. Advisory: Qlik Sense Enterprise for Windows Remote Code Execution Vulnerabilities
  18. Announcing Nosey Parker Update to v0.14.0
  19. Konstellation: A Tool for RBACpacking in Kubernetes
  20. Introducing Konstellation, for Kubernetes RBAC Analysis
  21. The Power of Chariot Managed Service
  22. Announcing Gato Version 1.5!
  23. fwd:cloudsec 2023: Top Four Themes in Cloud Security for 2023
  24. Improving Performance and Scalability: Updates and Lessons from Inspector, Our End-to-End Testing Solution
  25. MOVEit! An Overview of CVE-2023-34362
  26. Content Discovery: Understanding Your Web Attack Surface
  27. In Brief: Chariot Alignment with FDA Section 524B.1
  28. Measuring People, Process, and Technology Effectiveness with NIST CSF 2.0
  29. Cyber Cartography: Mapping a Target
  30. Screenshotting: Can You See What I See?
  31. Dynamic Linking Injection and LOLBAS Fun
  32. Find More Secrets with Nosey Parker v.0.12.0
  33. Bypassing Akamai’s Web Application Firewall Using an Injected Content-Encoding Header
  34. Technical Advisory – Azure B2C – Crypto Misuse and Account Compromise
  35. ASM: The Best Defense is a Good Offense
  36. Open Source Tools: From Our Lab to Your Fingertips
  37. Phantom of the Pipeline: Abusing Self-Hosted CI/CD Runners
  38. ABAC in Lambda

2022 44

  1. Doing the Work: How to Architect a Systematic Security Program, Part 3
  2. Web3 Trust Dependencies: A Closer Look at Development Frameworks & Tools
  3. Nosey Parker RegEx: A Positive Community Response
  4. Instrumenting an Automotive Module for Bench Testing
  5. Automating the Discovery of NTLM Authentication Endpoints
  6. Inspector, or: How I Learned to Stop Worrying and Love Testing in Prod
  7. Measuring Up: How to Architect a Systematic Security Program – Part 2
  8. From Self-Hosted GitHub Runner to Self-Hosted Backdoor
  9. Best Practices for Identity and Access Management When Using Google Cloud Platform
  10. Six Months of Finding Secrets with Nosey Parker
  11. Assessment of an Ecosystem: The importance of end to end, holistic testing
  12. Introducing FingerprintX: The fastest port fingerprint scanner
  13. Developing a Hidden Virtual File System Capability That Emulates the Uroburos Rootkit
  14. Framework Selection: How to Architect a Systematic Security Program – Part 1
  15. Safeguarding Memory in Higher-Level Programming Languages
  16. Whitebox Security Assessments: Doing More with More
  17. NTLMv1 vs NTLMv2: Digging into an NTLM Downgrade Attack
  18. NIST CSF 2.0 Workshop Themes: Praetorian’s View
  19. Part 3 – Trends in the Cybersecurity Talent Marketplace in the Face of Sustained Shortages
  20. Thinking Outside the Mailbox: Modernized Phishing Techniques
  21. The Economy of Trust in Smart Contract Security
  22. AWS Security Trends of 2022: Five Themes and Why They Matter
  23. Anatomy of an Automotive Security Assessment
  24. Part 2 – Adapting Security Strategy to the Rise of Opportunistic Attacks
  25. Multi-Step Attack Vectors: When Vulnerabilities Form an Attack Chain
  26. Part I – CyberSecurity is Adversarial, and What that Means for Security Strategy
  27. Inter-Chip Communication: Design Considerations to Mitigate Commonly Overlooked Attack Paths
  28. Elevating Privileges with Authentication Coercion Using DFSCoerce
  29. How to Detect DFSCoerce
  30. Relaying to ADFS Attacks
  31. Chaining MFA-Enabled IAM Users with IAM Roles for Potential Privilege Escalation in AWS
  32. Signing and Encrypting with JSON Web Tokens
  33. Computer Account Relaying Vulnerabilities Part 2
  34. Guest who? Insecure Azure Defaults!
  35. Hunting for Spring Core Exploitation
  36. Spring Core on JDK9+ is vulnerable to remote code execution
  37. Always Be Modeling: How to Threat Model Effectively
  38. Meet Nosey Parker — An Artificial Intelligence Based Scanner That Sniffs Out Secrets
  39. Ides of March – Chariot’s Launch Day
  40. 23 and Me: Offensive DNA and Nuclei Templates
  41. Palo Alto Networks GlobalProtect Remote Code Execution Vulnerability (CVE-2022-0016)
  42. The Click Heard Around the World
  43. North Korean Lazarus APT phishing defense contractors
  44. Log4J Detector Tool

2021 28

  1. Log4j vulnerability: Lessons learned in a week
  2. Log4j 2.15.0 stills allows for exfiltration of sensitive data
  3. Log4j Update: False Negatives and Additional Recommendations
  4. Log4j: It’s worse than you think
  5. Introducing Snowcat: World’s First Dedicated Security Scanner for Istio
  6. How to Write and Execute Great Incident Response Playbooks
  7. How to Detect and Dump Credentials from the Windows Registry
  8. Incident Response Best Practices: Building an Evidence Wiki
  9. 10 Common Security Issues when Migrating from On Premises to Azure
  10. Introducing GoKart, a Smarter Go Security Scanner
  11. How to improve your Incident Response (IR) with Live Response
  12. Threat Intelligence: Tools for Making Your Blue Team Smarter
  13. Email Security (SPF, DKIM, and DMARC)
  14. How to Implement Consistent Identity Management for Improved SaaS Security
  15. Methodology for Hacking IoT: From Chip to Cloud
  16. How to redirect traffic from an incoming TCP port using the Portbender utility
  17. How to Exploit Active Directory ACL Attack Paths Through LDAP Relaying Attacks
  18. CIS Controls Version 8 Overview: Bye-Bye “Top 20”
  19. Google Cloud IAM: Designs for Self-Service Privilege Escalation
  20. Red Team Tooling: Writing Custom Shellcode
  21. Attacking and Defending OAuth 2.0 (Part 2 of 2: Attacking OAuth 2.0 Authorization Servers)
  22. How to Prevent, Detect and Remediate ProxyLogon
  23. Red Team Privilege Escalation – RBCD Based Privilege Escalation – Part 2
  24. Reproducing the Microsoft Exchange Proxylogon Exploit Chain
  25. NIST Cybersecurity Framework Vignettes: Backups
  26. The Elephant in the Room: Why Security Programs Fail
  27. Red Team Local Privilege Escalation – Writable SYSTEM Path Privilege Escalation – Part 1
  28. A simple and effective way to detect Broadcast Name Resolution Poisoning (BNRP)

2020 24

  1. Alibaba Cloud Cross Account Trust: The Confused Deputy Problem
  2. Google Cloud Platform (GCP) Service Account-based Privilege Escalation paths
  3. NIST Cybersecurity Framework Vignettes: Broadcast Name Resolution Poisoning
  4. Building a Domain Specific Language for Red Team Payload Generation
  5. Inside the Mimikatz Pass-the-Hash Command (Part 2)
  6. Inside the Mimikatz Pass-the-Hash Command (Part 1)
  7. A New Tool for Password Spraying Emulation
  8. Threat Hunting: How to Detect PsExec
  9. Red Team Infrastructure Tooling: Command Line Utilities and U2F
  10. How to Create a Secure Authentication Scheme for IoT Systems
  11. NIST Cybersecurity Framework Vignettes: Phishing
  12. Attacking and Defending OAuth 2.0 (Part 1 of 2: Introduction, Threats, and Best Practices)
  13. Active Directory Computer Account SMB Relaying Attack
  14. Solving Cybersecurity’s Hardest Problems with Machine Learning
  15. Leveraging DevSecOps Practices to Secure Red Team Infrastructure
  16. Praetorian’s Approach to Red Team Infrastructure
  17. Cloud Security and Architecture: The 8 Pillars
  18. Obtaining LAPS Passwords Through LDAP Relaying Attacks
  19. AWS IAM Assume Role Vulnerabilities Found in Many Top Vendors
  20. What is Threat Modeling, and Why it’s Important
  21. 10 Cybersecurity Technical Priorities for Telework
  22. Evaluating SAST Tools
  23. Extending LLVM for Code Obfuscation (2 of 2)
  24. Extending LLVM for Code Obfuscation (1 of 2)

2019 19

  1. Lessons from ATT&CKcon 2.0 and SANS Purple Team Summit
  2. Bypassing Google’s Santa Application Whitelisting on macOS (Part 2 of 2)
  3. Bypassing Google’s Santa Application Whitelisting on macOS (Part 1 of 2)
  4. Implementing Application Whitelisting with Google Santa and Upvote (Part 2 of 2)
  5. Implementing Application Whitelisting with Google Santa and Upvote (Part 1 of 2)
  6. CI/CD Supply Chain Attacks for Data Exfiltration or Cloud Account Takeover
  7. Secure and Scalable Secrets Management in the Cloud for DevOps
  8. Getting Started with Praetorian’s ATT&CK Automation
  9. Cross-Site Websocket Hijacking (CSWSH)
  10. Process Injection and Process Hollowing (ATT&CK T1055 & T1093)
  11. Cloud Data Exfiltration via GCP Storage Buckets and How to Prevent It
  12. Red Team Supply Chain Attacks in Modern Software Development Environments
  13. ICMP C2 Standard Non-Application Layer Protocol (ATT&CK T1095)
  14. Using Slack Web Services as a C2 Channel (ATT&CK T1102)
  15. Why Praetorian Benchmarks to MITRE ATT&CK™ and Why You Should Too
  16. Safely Conduct Security Assessments of Industrial Control System (ICS) Environments
  17. Running a .NET Assembly in Memory with Meterpreter
  18. Active Directory Visualization for Blue Teams and Threat Hunters
  19. Benchmarking Enterprise Cybersecurity Programs with NIST CSF

2018 7

  1. Signed Binaries Proxy Execution – T1218
  2. Signed Scripts Proxy Execution – T1216
  3. How to use Kerberoasting – T1208 for Privilege Escalation
  4. Summary of April MITRE ATT&CK RELEASE
  5. Privilege Escalation in AWS with PassRole Attacks
  6. Breaking Through Single Sign On (SSO)
  7. Path.Combine Security Issues in ASP.NET Applications

2017 2

  1. KRACK (Key Installation Attack) Against Wi-Fi Networks
  2. Shadow Brokers After Action Report

2016 24

  1. Hashjacking: Anyone Can Steal Your Windows Password
  2. Well-tested Authorization Design Patterns
  3. How to Mitigate Mimikatz WDigest Cleartext Credential Theft
  4. Reversing and Exploiting Embedded Devices: The Software Stack (Part 1)
  5. Broadcast Name Resolution Poisoning / WPAD Attack Vector
  6. An Opinionated Series on Why Signal Protocol is Well-Designed: Deniability
  7. Engineering Efficiency and Continuous Improvement in Security Services
  8. JTAGulator vs. JTAGenum, Tools for Identifying JTAG Pins in IoT Devices
  9. Email Filters: A Reliable Phishing Protection?
  10. End-to-End WhatsApp: An Opinionated Series on Why Signal Protocol is Well-Designed
  11. Why are JTAG and UART still effective attack vectors for IoT devices?
  12. Secure Password Storage in Go, Python, Ruby, Java, Haskell, and NodeJS
  13. Internetwache RE60 Writeup: Symbolic Execution Tramples CTF Challenge
  14. Pentestly Framework: When Pentesting Meets Python and Powershell
  15. Machine Learning Tutorial
  16. Hob0Rules Released: Statistics Based Password Cracking Rules
  17. Ruby Unsafe Reflection Vulnerabilities
  18. Gladius: Automatic Responder Cracking
  19. Introducing MitM-VM & Trudy: A Dead Simple TCP Intercepting Proxy Tool Set
  20. IPv6 Has Arrived — Is Your Security Infrastructure Prepared?
  21. The Reason My Lamp is Insecure
  22. Getting Started with Damn Vulnerable Router Firmware (DVRF) v0.1
  23. Javascript Sensor API and New Browser Features Raise Privacy Concerns
  24. Engineer Spotlight: Cory Duplantis and the 2015 SANS Holiday Hack Write-up

2015 5

  1. Group Policy Preferences (GPP) Pwned
  2. Microsoft’s Local Administrator Password Solution (LAPS)
  3. Statistics Will Crack Your Password
  4. Navigating Today’s Shared Security Responsibility Model in the Cloud
  5. NIST Cybersecurity Framework vs. NIST Special Publication 800-53

2014 13

  1. Cloud Security Best Practices for Amazon Web Services (AWS)
  2. CRITICAL: Bash “Shellshock” Vulnerability
  3. Building the HashCat API in Ruby to Crack Passwords in the Cloud
  4. Why You Should Add Joern to Your Source Code Audit Toolkit
  5. Using Developer Debugging Tools to Pentest Mobile Applications
  6. Man-in-the-Middle TLS Protocol Downgrade Attack
  7. PHP-CGI Remote Command Execution Vulnerability Exploitation
  8. MAC Cryptographic Errors and Vulnerabilities in SSO Authentication
  9. CRITICAL: New Internet Explorer Zero-day Vulnerability
  10. Exploiting Mobile Banking with HeartBleed Vulnerability
  11. CRITICAL: HeartBleed Vulnerability
  12. Whats up with WhatsApp’s Security?
  13. How to Identify and Prevent UIWebView Cross-Site Scripting

2013 8

  1. How To Identify and Prevent LDAP Injection (Part 2)
  2. How To Identify and Prevent Query and Command Injections (Part 1)
  3. Develop Secure Mobile Apps by Studying Vulnerable Android, iOS, and Mobile Web Apps
  4. NECCDC Red Team: Quick Twitter Command and Control (C2) Trojan
  5. NECCDC Red Team: Quick HTTP Command and Control (C2) Trojans
  6. NECCDC Red Team: Quick DNS Command and Control (C2) Trojan
  7. Advanced Threats: Driving Senior Leadership Awareness
  8. Introducing the New ROTA Tech Challenge

2012 11

  1. Metasploit Integration for Password Auditor
  2. Password Auditing with Style
  3. Easy to Use Password Cracking Tool with Advanced Features
  4. Burp SQLmap plugin for Windows
  5. Twitter’s Charlie Miller is Coming to Austin ISSA to Discuss iOS Security
  6. Praetorian sponsors 2012 Boston Application Security Conference (BASC)
  7. The Honeynet Project Maps Real-Time Attacks From Around the World
  8. Multi-Core and Distributed Programming in Python
  9. HTTP/HTTPS Bruteforcing Using a List of IPs and Hostnames with Metasploit
  10. Black Hat USA 2012 (Jabra Edition)
  11. Effectively Measuring Risk Associated with Vulnerabilities in Web Applications