The Curious Engineer

All blogs / Security

Pulse Security

pulsesecurity.co.nz

Technical Information Security Services. Offensive Security, Penetration Testing, Mobile and Application, Infrastructure, Digital Forensics, Incident Response

SecurityWindows internalsNetworking

’18’19’20’21’22’23’24’25’26
Posts
46 from 1 Jun 2018 to 30 Aug 2026
Posting
monthly (10 in the last year)
Kind
company blog
Feed
https://pulsesecurity.co.nz/feed.xml

2026 9

  1. Path.Combine Can Lead to Security Vulnerabilities in .NET Applications
  2. After the Report is Delivered: Remediation and Confirmation Testing
  3. An HTTP Intercepting Proxy with Chrome DevTools Protocol (CDP)
  4. What Makes a Quality Penetration Test
  5. The Purpose of Penetration Testing
  6. Stealing Browser Sessions with DevTools
  7. Timeboxed Penetration Testing - Pulse Security’s Approach
  8. Harvesting Intune Device Scripts Without Tools
  9. Sensitive data in URLs: Why private links aren’t private anymore due to threat intelligence feeds

2025 6

  1. Primary Refresh Token Exploitation - Attacking Entra Authenticated Services, Bypassing Passwords and MFA
  2. Windows' Built-in OpenSSH for Offensive Security
  3. Bypassing WiFi Client Isolation
  4. HTTP Really Isn't That Simple (and by extension Neither Is Your Outbound Web Filtering, Actually)
  5. Making Mutual TLS Easier
  6. Airtable Formula Injection

2024 5

  1. USB Horsemen of the HID Apocalypse
  2. Tales From The Crypt: Microsoft Unicode Collation Oddities Leading to Software Vulnerabilities
  3. Noot - Encrypted resumable ICMP exfiltration
  4. A hex editor and nothing to lose - Binary patching Golang to fix net/http
  5. Pulse and Open-Source - A Retrospective

2023 3

  1. OMGCICD - Attacking GitLab CI/CD via Shared Runners
  2. Global Request Rate Limiting: Valid or Footgun?
  3. Dynamic Debugging of dotnet Without Source Code

2022 5

  1. Practical Vehicle Reverse Engineering - Ducati ECU part II
  2. A few Tailscale tricks for Security Testers
  3. Dotnet’s default AES mode is vulnerable to padding oracle attacks
  4. SameSite: Hax – Exploiting CSRF With The Default SameSite Policy
  5. 2021 Summary – Like sands through the hourglass…

2021 5

  1. Practical CANBUS Reversing - Understanding the Ducati Monster
  2. Brute Forcing TOTP Multi-Factor Authentication is Surprisingly Realistic
  3. ORM, huh, what is it good for?
  4. Reverse Engineering Golang Malware for Portable Pivoting
  5. Hybrid Security Assessment - A collaborative, research-based approach to security assurance

2020 4

  1. Authentication Security Controls You Might be Missing
  2. SQL Injection and Postgres - An adventure to eventual RCE
  3. Expression Language Injection RCE - No Strings Attached
  4. Three things that made our lives as attackers harder in 2019

2019 4

  1. Breaking MSSQL's RAND() function
  2. Application Security Automation - Three Dev Cycle Quick Wins
  3. Playing with Namespaces - Writing Docker-Aware Rootkits
  4. Extracting BitLocker keys from a TPM

2018 5

  1. Office 365 Audit Logging and Email scams
  2. Adventures with the Ducati CAN bus
  3. Extracting JavaScript from Sourcemaps
  4. Shells - brought to you by the letter 'R'
  5. Red Team vs Pentest