The Curious Engineer

All blogs / Security

TrustedSec

trustedsec.com

Experience fundamentally different cybersecurity for business success, providing end-to-end consulting from penetration testing to design and hardening.

Security

’24’25’26
Posts
819 from 25 Jul 2024 to 27 Oct 2026
Posting
weekly (75 in the last year)
Kind
company blog
Feed
https://trustedsec.com/feed.rss

2026 68

  1. What is CUI? A Contractor’s Perspective
  2. Trimarc, 18 Months Later at TrustedSec
  3. Handling Pre-Contract FCI and CUI
  4. Two Config Files, Two Release Tracks, and One Very Bad Commit
  5. TrustedSec Joins the OpenAI Daybreak Defense Network
  6. Logging is a Discipline, Not a Switch
  7. HashcatRosetta: Reading the Rosetta Stone of Password Cracking
  8. What's New in hate_crack Since 2.0
  9. Unpacking a laZzzy Donut
  10. So… You Found AWS Access Keys (Part 1)
  11. LLMHaxor Update
  12. waf-fu, or Some Log Replay Nonsense
  13. SpooNMAP Grows Up: Findings, Local LLM Detection, and a Whole Lot…
  14. We've Seen This Movie: The OT/IT Technology Divide
  15. AI Offense is Not Noclip Mode
  16. A Vault With No Treasure - CMMC Level 2 Compliance for Subcontractors…
  17. The Art of Hunting Azure Cloud Secrets
  18. TLS Encryption and Compliance
  19. CCPA Update: Cybersecurity Requirements (Part 2)
  20. CCPA Update: Who’s In Scope (Part 1)
  21. AI Directives and AI Strategy Development
  22. CMMC is (Not) Cancelled
  23. The New Hotness in Phishing: Device Code Attacks in M365
  24. Pandora’s Container Part 1: Unpacking Azure Container Security
  25. Vulnify: Giving Your Agents a CVE Brain
  26. Welcoming ObfusGit
  27. Inheriting the Receipts: Securing the AI Your Company Already Adopted
  28. Large Workflows with Local LLMs
  29. Modern Web Application Content Discovery
  30. JQ for Hackers
  31. JS-Tap v3: Endpoint Post-Exploitation With JavaScript Implants
  32. Hardening Intune: The Implementation Guide
  33. How to Train Your (Dragons) Analysts - A TrustedSec Guide to Picking…
  34. The Privileged Roles Nobody Talks About
  35. CMMC Conditional Status - Contracting Without Compliance
  36. PCI DSS, Telephone Payments, and the Problems With VoIP
  37. Shai-Hulud Is Back, and This Time It Ate the Whole Ecosystem
  38. Coverage-Driven Sustained Testing (CDST): A Graph-Oriented Model for…
  39. Finding Your Way on the Passkey Path
  40. Slamming the Door on Quick Assist Tech Support Scams and Abuse
  41. GRC in an AI World - Staying in the Fast Lane Without Losing the Race!
  42. The Defensive Stack is Exposed: LLMs, Reverse Engineering, and the…
  43. ARP Around and Find Out: Hijacking GPO UNC Paths for Code Execution…
  44. Kerberos with Titanis
  45. Mythos, Memory Loss, and the Part InfoSec Keeps Missing
  46. Dungeons and Daemons
  47. Benchmarking Self-Hosted LLMs for Offensive Security
  48. IAM the Captain Now – Hijacking Azure Identity Access
  49. Building a Detection Foundation: Part 5 - Correlation in Practice
  50. Reduce Repetition and Free up Time With Mobile File Extractor
  51. Policy as Code: Stop Writing Policies and Start Compiling Them
  52. Building a Detection Foundation: Part 4 - Sysmon
  53. Full Disclosure: A Third (and Fourth) Azure Sign-In Log Bypass Found
  54. Better Together: Combining Automation and Manual Testing
  55. LnkMeMaybe - A Review of CVE-2026-25185
  56. Building a Detection Foundation: Part 3 - PowerShell and Script…
  57. Building a Detection Foundation: Part 2 - Windows Security Events
  58. Building a Detection Foundation: Part 1 - The Single-Source Problem
  59. Notepad++ Plugins: Plug and Payload
  60. Updated GSA Contractor CUI Protection Requirements
  61. Securing Entra ID Administration: Tier 0
  62. Keys to JWT Assessments - From a Cheat Sheet to a Deep Dive
  63. MCP in Burp Suite: From Enumeration to Targeted Exploitation
  64. LDAP Channel Binding and LDAP Signing
  65. Adventures in Primary Group Behavior, Reporting, and Exploitation
  66. Colonel Clustered: Finding Outliers in Burp Intruder
  67. CMMC Scope – Understanding the Sprawl
  68. Updating the Sysmon Community Guide: Lessons Learned from the Front…

2025 68

  1. Limiting Domain Controller Attack Surface: Why Less Services, Less…
  2. Top 10 Blogs of 2025
  3. Holy Shuck! Weaponizing NTLM Hashes as a Wordlist
  4. What is a TrustedSec Program Maturity Assessment (PMA)?
  5. Helpful Hints for Writing (and Editing) Cybersecurity Reports
  6. Managing Privileged Roles in Microsoft Entra ID: A Pragmatic Approach
  7. CMMC Subcontractors and Service Providers
  8. Hack-cessibility: When DLL Hijacks Meet Windows Helpers
  9. Detecting Password-Spraying in Entra ID Using a Honeypot Account
  10. There's More than One Way to Trigger a Windows Service
  11. Skimming Credentials with Azure's Front Door WAF
  12. PCI P2PE vs. E2EE – Scoping it Out
  13. HIPAA Applicability - Understanding the Security, Breach…
  14. HIPAA Business Associates - What’s Your Function?
  15. WSUS Is SUS: NTLM Relay Attacks in Plain Sight
  16. HIPAA Covered Entities - It’s More Than Just PHI
  17. Detecting Active Directory Password-Spraying with a Honeypot Account
  18. HIPAA Protected Health Information - When Health Information Isn’t…
  19. Protecting Backup and Recovery in the Age of Ransomware
  20. Penetration Testing and Burnout
  21. A Big Step on the CMMC Rollout Timeline
  22. CMMC Level and Assessment Requirements for Defense Contractors
  23. Dealing With Unmarked and Mismarked CUI
  24. The Proliferation of “Fake” CMMC Contract Clauses
  25. PivotTables For InfoSec Dummies
  26. Let's Clone a Cloner - Part 3: Putting It All Together
  27. Why is this Finding on my Pentest Report?
  28. Hiding in the Shadows: Covert Tunnels via QEMU Virtualization
  29. HIPAA, HITECH, and HITRUST - It’s HI Time to Make Sense of it All
  30. Azure's Front Door WAF WTF: IP Restriction Bypass
  31. CVE-2025-1729 - Privilege Escalation Using TPQMAssistant.exe
  32. Abusing Chrome Remote Desktop on Red Team Operations: A Practical…
  33. NIST CSF 2.0 Ratings and Assessment Methodologies for Scorecards –…
  34. Attacking JWT using X509 Certificates
  35. Dragging Secrets Out of Chrome: NTLM Hash Leaks via File URLs
  36. Hunting Deserialization Vulnerabilities With Claude
  37. Common Mobile Device Threat Vectors
  38. Full Disclosure, GraphGhost: Are You Afraid of Failed Logins?
  39. Teaching a New Dog Old Tricks - Phishing With MCP
  40. Apples, Pears, and Oranges: Not All Pentest Firms Are the Same
  41. AppSec Cheat Sheet: Session Management
  42. Red Team Gold: Extracting Credentials from MDT Shares
  43. Purpling Your Ops
  44. I Got 99 Problems But a Log Ain’t One
  45. Why the WAF
  46. Application Layer Encryption with Web Crypto API
  47. The Necessity of Active Testing – Detection Edition
  48. How Far Should You Let Penetration Testers Go?
  49. Discovering Your Baud
  50. Blog April 16 2025 TrustedSec Achieves CREST CertificationTrustedSec has achieved CREST Certification for penetration testing, a globally recognized standard that verifies an organization's ability to conduct…Read about this article
  51. Kubernetes for Pentesters: Part 1
  52. CUI For the Rest of Us: The New Government-Wide CUI Protection…
  53. MCP: An Introduction to Agentic Op Support
  54. Getting the Most Out of Your API Security Assessment
  55. PCI DSS Payment Card Data Retention
  56. Trimarc Joins TrustedSec: Strengthening Our Commitment to Security
  57. Are Attackers "Passing Through" Your Azure App Proxy?
  58. Abusing Windows Built-in VPN Providers
  59. Measuring the Success of Your Adversary Simulations
  60. A Threat Hunter’s Guide to Decoding the Cloud
  61. Exploring NTDS.dit – Part 1: Cracking the Surface with DIT Explorer
  62. Getting Started Using LLMs in Application Testing With an MVP
  63. From RAGs to Riches: Using LLMs and RAGs to Enhance Your Ops
  64. The Hidden Trap in the PCI DSS SAQ A Changes
  65. Operating Inside the Interpreted: Offensive Python
  66. Command Line Underdog: WMIC in Action
  67. Kiosk/POS Breakout Keys in Windows
  68. Solving NIST Password Complexities: Guidance From a GRC Perspective

2024 25

  1. Malware Series: Process Injection Mapped Sections
  2. Top 10 Blogs of 2024
  3. On-Demand BOF
  4. Discovering a Deserialization Vulnerability in LINQPad
  5. A 5-Minute Guide to HTTP Response Codes
  6. Attacking JWT with Self-Signed Claims
  7. Offensively Groovy
  8. Spec-tac-ula Deserialization: Deploying Specula with .NET
  9. Let’s Clone a Cloner - Part 2: You Have No Power Here
  10. EKUwu: Not just another AD CS ESC
  11. Kicking it Old-School with Time-Based Enumeration in Azure
  12. Missing: Data Classification, Part 2 - Looking at System…
  13. Pull Your SOCs Up
  14. Console Cowboys: Navigating the Modern Terminal Frontier
  15. How to Get the Most Out of a Pentest
  16. Putting Our Hooks Into Windows
  17. When on Workstation, Do as the Local Browsers Do!
  18. Gobbling Up Forensic Analysis Data Using Velociraptor
  19. The Hunter’s Workshop: Mastering the Essentials of Threat Hunting
  20. Oops I UDL'd it Again
  21. Must I TRA?: PCI Targeted Risk Analysis
  22. Execution Guardrails: No One Likes Unintentional Exposure
  23. Government Contractor’s Ultimate Guide to CUI
  24. Specula - Turning Outlook Into a C2 With One Registry Change
  25. Lapse of Control: Applauding PCI SSC for FAQ 1572

Undated 658

  1. What is your compliance kryptonite
  2. Technical analysis killer ultra malware targeting edr products in ransomware attacks
  3. Dirdevil hiding code and content within folder structures
  4. Hackingdaves rule of five
  5. The dangers of transition mode
  6. Playing games with pci compliance deadlines
  7. Lets clone a cloner to meet my needs
  8. Tips and tricks on creating your first conference talk
  9. Hands on with chip off non volatile memory
  10. Everything you need to know about jquery and its vulnerabilities
  11. Introducing the shelf
  12. Missing data classification
  13. Assumed breach the evolution of offensive security testing
  14. Js tap mark ii now with c2 shenanigans
  15. Introducing meta detector
  16. Most reported web findings of 2023
  17. Xz utils made me paranoid
  18. The midnight alert navigating the dark web data dilemma
  19. Full disclosure a look at a recently patched microsoft graph logging bypass graphninja
  20. Loading dlls reflections
  21. Pci dss vulnerability management the most misunderstood requirement part 3
  22. Pci dss vulnerability management the most misunderstood requirement part 2
  23. Pci dss vulnerability management the most misunderstood requirement part 1
  24. A hitch hackers guide to dacl based detections the addendum
  25. Observations from business email compromise bec attacks
  26. From chaos to clarity organizing data with structured formats
  27. Securing sensitive data how ransomware challenges the healthcare industry
  28. From error to entry cracking the code of password spraying tools
  29. Failure to restrict url access its still a thing
  30. Introducing pcis new self assessment questionnaire
  31. Unwelcome guest abusing azure guest access to dump users groups and more
  32. Behind the code assessing public compile time obfuscators for enhanced opsec
  33. Weaponization of token theft a red team perspective
  34. Mailitemsaccessed woes m365 investigation challenges
  35. Cmmc nope why you dont need to be cmmc compliant
  36. Hardware hacking plunder with a bus pirate
  37. Offensive lab environments without the suck
  38. Content security policy mitigating web vulnerabilities by controlling the rules of the game
  39. A beginners guide to mobile application testing
  40. The rising threat a surge in zero day exploits
  41. Burrowing a hollow in a dll to hide
  42. From zero to purple
  43. Proxyhelper2 the sequel
  44. Engagement guide how to prepare for your purple team
  45. Level up your reporting
  46. Detection alchemy the purple team way
  47. Rekt by the rex
  48. Regex cheat sheet
  49. Unmasking business email compromise safeguarding organizations in the digital age
  50. Tech brief citrix bleed abused by ransomware crews
  51. The socks we have at home
  52. What is hackvertor and why should i care
  53. Clickjacking not just for the clicks
  54. Book review the definitive guide to pci dss version 4
  55. The triforce of initial access
  56. Js tap weaponizing javascript for red teams
  57. A hitch hackers guide to dacl based detections part 3
  58. A hitch hackers guide to dacl based detections part 2
  59. A hitch hackers guide to dacl based detections part 1b
  60. A hitchhackers guide to dacl based detections part 1 a
  61. Okta for red teamers
  62. Basic authentication versus csrf
  63. Creative process enumeration
  64. Crafting emails with html injection
  65. The client server relationship a match made in heaven
  66. Prefetch the little snitch that tells on you
  67. Modeling malicious code hacking in 3d
  68. Chaining vulnerabilities to exploit post based reflected xss
  69. Introducing cowitness enhancing web application testing with external service interaction
  70. Incident response bring out the body file
  71. Obfuscation using python bytecode
  72. Control tower pivoting using the default role
  73. The nightmare of proc hollows exe
  74. Onedrive to enum them all
  75. Critical vulnerability in progress moveit transfer technical analysis and recommendations
  76. Ppid spoofing its really this easy to fake your parent
  77. Javascript essentials for beginning pentesters
  78. Walking the tightrope maximizing information gathering while avoiding detection for red teams
  79. Cybersecurity policy enforcement strategies for success
  80. Learning sysmon videos 1 10
  81. Windows laps closing a gap for cloud native device management
  82. Why risk assessments are essential for information security maturity
  83. Cross site smallish scripting xsss
  84. Compliance abuse when compliance frameworks are misapplied
  85. Incident response rapid triage a dfir warriors guide part 3 network analysis and tooling
  86. Better hacking through cracking know your rules
  87. Incident response rapid triage a dfir warriors guide part 2 incident assessment and windows artifact processing
  88. Incident response rapid triage a dfir warriors guide part 1 process overview and preparation
  89. Hacking your cloud tokens edition 2 0
  90. On the road to detection engineering
  91. Cisco hackery tcl proxy
  92. Android hacking for beginners
  93. What you need to know about sbom
  94. Using rpc in bofs
  95. Disabling av with process suspension
  96. Data retention practices a brief overview
  97. Situational awareness bofs for script kiddies
  98. Critical outlook vulnerability in depth technical analysis and recommendations cve 2023 23397
  99. Shells in plain sight storing payloads in the cloud
  100. Red vs blue kerberos ticket times checksums and you
  101. Changes in the beacon object file landscape
  102. Getting analysis practice from windows event log sample attacks
  103. Rpc programming for the aspiring windows developer
  104. Top 5 things that will land an attacker in the azure cloud
  105. Bofs for script kiddies
  106. Azure ad kerberos tickets pivoting to the cloud
  107. Esxiargs the code behind the ransomware
  108. Esxiargs what you need to know and how to protect your data
  109. Teamfiltration v3 5 0 improve all the things
  110. The first steps on the zero trust journey
  111. What this keepass cve means for organizations searching for new password vaults
  112. How threat actors use onenote to deploy asyncrat
  113. New attacks old tricks how onenote malware is evolving
  114. Operators guide to the meterpreter bofloader
  115. Major conference roundup
  116. 2023 resolutions for script kiddies
  117. A lapse in judgement
  118. To oob or not to oob why out of band communications are essential for incident response
  119. Building a strong foundation with the information security accelerator
  120. More active directory for script kiddies
  121. Looting ios apps cache db
  122. Measuring the impact of a security awareness program
  123. The art of bypassing kerberoast detections with orpheus
  124. Linux history file timestamps
  125. Active directory for script kiddies
  126. Auditing exchange online from an incident responders view
  127. Windows processes nefarious anomalies and you threads
  128. Windows processes nefarious anomalies and you memory regions
  129. How to get the most out of your pentest
  130. Lastpass in memory exposure
  131. A primer on cloud logging for incident response
  132. The curious case of the password database
  133. Dameware mini the sleeper hit of 2019
  134. Set up an android hacking lab for 0
  135. Back to basics the trustedsec guide to strong cyber hygiene part 2
  136. Cisco hackery configuration file download
  137. Common conditional access misconfigurations and bypasses in azure
  138. Hardening backups against ransomware
  139. Working with data in json format
  140. Watch out for uuids in request parameters
  141. I wanna go fast really fast like kerberos fast
  142. Practical attacks against ntlmv1
  143. How your teams culture determines the value of your tabletop exercise
  144. Video blog using dll persist to avoid detection
  145. The crucial role of data center resiliency in business security
  146. Detection and alerting selecting a siem
  147. Maturity effectiveness and risk security program building and business resilience
  148. Scraping login credentials with xss
  149. A diamond in the ruff
  150. Wmi providers for script kiddies
  151. Intro to web app security testing burp suite tips tricks
  152. Pwnton pack an unlicensed 802 11 particle accelerator
  153. Splunk spl queries for detecting gmsa attacks
  154. Putting the team in red team
  155. Diving into pre created computer accounts
  156. Elfloader another in memory loader post
  157. G cioptions in a virtualized world
  158. Nft crime from the simple to the ingeniously simple
  159. Defending the gates of microsoft azure with mfa
  160. Persisting xss with iframe traps
  161. Making smb accessible with ntlmquic
  162. Cve 2022 22965 spring4shell vulnerability
  163. Simplifying your operational threat hunt planning
  164. Trustedsec okta breach recommendations
  165. Cve 2022 24696 glance by mirametrix privilege escalation
  166. Back to basics the trustedsec guide to strong cyber hygiene
  167. Expanding the hound introducing plaintext field to compromised accounts
  168. Manipulating user passwords without mimikatz
  169. Avoiding mixed content errors with an https python server
  170. Work from home productivity tips
  171. Social engineering basics how to win friends and infiltrate businesses
  172. Object overloading
  173. A comprehensive guide on relaying anno 2022
  174. Wmi for script kiddies
  175. Seeyoucm thief exploiting common misconfigurations in cisco phone systems
  176. Real or fake spoof proofing email with spf dkim and dmarc
  177. Real or fake how to spoof email
  178. An attack path mapping approach to cves 2021 42287 and 2021 42278
  179. Log4j playbook
  180. Hacking the my arcade contra pocket player part i
  181. Persistence through service workers part 3 easy javascript payload deployment
  182. How were making sense of cmmc 2 0
  183. Creating a malicious azure ad oauth2 application
  184. Persistence through service workers part 2 c2 setup and use
  185. Persistence through service workers part 1 introduction and target application setup
  186. Theyre watching you protecting yourself from hidden cameras
  187. Supply chain woes attacks and issues in it infrastructure what can we do
  188. Why your threat hunting program building shouldnt stop once the engagement is over
  189. Update the defensive security strategy
  190. Obsidian taming a collective consciousness
  191. Introducing ihide a new jailbreak detection bypass tool
  192. Oh behave figuring out user behavior
  193. Is cyber insurance becoming worthless
  194. Reducing merchant scope to ease the compliance burden
  195. Bits persistence for script kiddies
  196. The backup paradigm shift moving toward attack response systems
  197. Real or fake when your fraud notice looks like a phish
  198. A career in it where do i start
  199. Simple data exfiltration through xss
  200. Pci specialist art coop cooper joins trustedsec team
  201. Adexplorer on engagements
  202. Azure application proxy c2
  203. Companies on high alert for unemployment fraud
  204. Bits for script kiddies
  205. Strength training with transport cryptology part 2
  206. Strength training with transport cryptology part 1
  207. Practicing what we preach
  208. More options for response modification with responsetinker
  209. Yes its time for a security gap assessment
  210. Trustedsec incident response team slack ama 02 17 2021
  211. Trustedsec moves headquarters to fairlawn
  212. New service launched in response to hafnium attacks
  213. Trustedsec approved as a cmmc registered provider organization
  214. Cmmc small business funding roundup
  215. Coffloader building your own in memory loader or how to run bofs
  216. Who left the backdoor open using startupinfo for the win
  217. Front validate and redirect
  218. Group policy for script kiddies
  219. Injecting rogue dns records using dhcp
  220. Tailoring cobalt strike on target
  221. What spring data can teach us about api misconfiguration
  222. How i retained my qsa certification
  223. Get to hacking massively faster the release of spoonmap
  224. Risingsun decoding sunburst c2 to identify infected hosts without network telemetry
  225. Solarwinds backdoor sunburst incident response playbook
  226. Solarwinds orion and unc2452 summary and recommendations
  227. 4 free easy wins that make red teams harder
  228. An update on non aggressive reporting
  229. Nine things to know about the cmmc
  230. Fear cybersecurity and right to repair
  231. The tale of the lost but not forgotten undocumented netsync part 2
  232. The tale of the lost but not forgotten undocumented netsync part 1
  233. Intro to web app security testing logging
  234. Setting the referer header using javascript
  235. Azure account hijacking using mimikatzs lsadumpsetntlm
  236. Macos injection via third party frameworks
  237. Weaponizing group policy objects access
  238. Making edr work for pci
  239. Fuzzing the front end
  240. Sms phish an incident walkthrough
  241. So you got access to a nix system now what
  242. Red teaming with cobalt strike not so obvious features
  243. Two simple ways to start using the mitre attck framework
  244. Become the malware analyst series powershell obfuscation shellcode
  245. One size doesnt fit all penetration testing maturity
  246. A discussion on serverless application vulnerabilities
  247. Malicious macros for script kiddies
  248. The updated security pros guide to mdm mam and byod
  249. Thycotic secret server offline decryption methodology
  250. Azure automation getting started with desired state configurations
  251. A developers introduction to beacon object files
  252. Using azure to address endpoint hygiene management
  253. 8 keys to writing safer code
  254. Become the malware analyst series malicious code extraction and deobfuscation
  255. Microsoft mvp awards 2020
  256. Cve 2020 2021 pan os saml security bypass
  257. Are you looking for ants or termites
  258. Let trustedsec be your guide
  259. Msbuild a profitable sidekick
  260. Using effectiveness assessments to identify quick wins
  261. Adventures in phishing email analysis
  262. Workflow improvements for pentesters
  263. Access locked files with tscopy
  264. Abusing windows telemetry for persistence
  265. Theft from online shopping carts past and present
  266. 20 tips for certification success
  267. Automating a redelk deployment using ansible
  268. Introducing proxy helper a new wifi pineapple module
  269. A beginners guide to staying safe anonymous online
  270. Want better alerting consider your business processes
  271. Practical oauth abuse for offensive operations part 1
  272. Breaking typical windows hardening implementations
  273. Developing with vba for script kiddies
  274. The vba language for script kiddies
  275. Vendor enablement rethinking third party risk
  276. Pci recurring requirements require attention
  277. Breaking into infosec a beginners guide part 2
  278. Breaking into infosec a beginners guide part 1
  279. Prepare to write a scanner plugin before your next platform test
  280. Generating ssh config files with ansible
  281. Wanted process command lines
  282. Pentesterlab pro giveaway
  283. Is zooms lack of end to end encryption a problem
  284. Understanding new yorks shield act
  285. Tricks for weaponizing xss
  286. Working from home tips for script kiddies
  287. Securing a remote workforce top five things to focus on for everyone
  288. Crossover sec breaking down the silos
  289. Upgrade your workflow part 2 building phishing checklists
  290. From the desk of the ceo remote security testing vs on site testing understanding the difference
  291. Upgrade your workflow part 1 building osint checklists
  292. Covid 19 and preparing for changing cybersecurity risks
  293. Cve 2020 0796 smbv3 wormable remote code execution vulnerability
  294. Avoiding get injectedthread for internal thread creation
  295. Threat hunting outbound rdp surprises
  296. Intro to macros and vba for script kiddies
  297. Detecting cve 20200688 remote code execution vulnerability on microsoft exchange server
  298. Weak in weak out keeping password lists current
  299. Achieving passive user enumeration with onedrive
  300. Why we are launching the trustedsec sysmon community guide
  301. Sigint to synthesis
  302. Targeted active directory host enumeration
  303. Finding a privilege escalation in the intel trusted connect service client
  304. Netscaler honeypot
  305. Netscaler remote code execution forensics
  306. Critical exposure in citrix adc netscaler unauthenticated remote code execution
  307. Selinux and auditd
  308. Red team engagement guide how an organization should react
  309. Automation testing with ansible molecule and vagrant
  310. Creating honey credentials with lsa secrets
  311. Playing with old hacks
  312. Finding and identifying jscript vbscript callable com objects
  313. Working with the department of defense in 2020 start planning for the new certification
  314. Incident response ransomware series part 3
  315. A message of support coalfire consultants charged
  316. Incident response ransomware series part 2
  317. Incident response ransomware series part 1
  318. Discovering the anti virus signature and bypassing it
  319. The three step security strategy
  320. Buying internal domain access again
  321. Big changes in store for pci dss v4 0 and more
  322. Cracking the derbycon code
  323. Attacks on the rise through office 365
  324. Pci requirements 101
  325. Three most common physical security flaws and how to fix them
  326. Top 10 mitre attck techniques
  327. Tracing dns queries on your windows dns server
  328. Mobile hacking using frida to monitor encryption
  329. Microsoft mvp awards 2019
  330. On the possibility of obfuscating code using neural networks
  331. Is ohio senate bill 220 an example for the other 49 states
  332. Owning o365 through better brute forcing
  333. Next gen phishing leveraging azure information protection
  334. Invoice fraud is soaring what you need to know
  335. Indicators of compromise hunting for meaning part 2
  336. Indicators of compromise hunting for meaning part 1
  337. Six crucial network segmentation actions
  338. Five thoughts on securing multi cloud environments
  339. Top six security and risk management questions
  340. Sdr entering the noise floor
  341. Current security trends in 2019
  342. Internship
  343. Adventures of an rdp honeypot part three creation of an rdp honeypot
  344. Adventures of an rdp honeypot part two know you enemy
  345. Adventures of an rdp honeypot part one rdp security
  346. Local admin access and group policy dont mix
  347. Few cons to bringing in the pros why should you have a third party risk and security assessment
  348. Incident response team adds senior consultant justin vaicaro
  349. How to reduce pci compliance anxiety
  350. Nist cybersecurity risk management conference
  351. Holiday phishing office 365
  352. What information security can learn from the hospitality industry
  353. Failure and success
  354. The three best security analogies i know and how to use them
  355. Lets build a card cloner
  356. A buyers guide to beginning sdr
  357. W32 coozie discovering oracle cve 2018 3253
  358. Nist guidance for small business forthcoming
  359. Become a pentester
  360. Linux hows my memory
  361. Full disclosure microsoft lync for mac 2011 susceptible to forced browsing download attack
  362. Dumping embedded java classes
  363. Making the infosec rounds
  364. Tech support scams are a concern for all
  365. Dont delay migrate today away from ssl early tls
  366. Top 8 to dos for iot security
  367. Preparing for iot segmentation six steps to get your functional requirements right
  368. Iot and digitization are driving renewed demand for segmentation
  369. Building a quick lab environment with linux containers
  370. Credential re use enterprise
  371. First came the gdpr now comes the california consumer privacy act of 2018
  372. Another standard to keep in mind
  373. Enumerating anti sandboxing techniques
  374. Weaponizing settingcontent
  375. Pen testing evolving
  376. How to set up a quick simple webdav server for remote file sharing
  377. Caddy phishing
  378. Penetration testing has gotten tougher and why that increases your risk
  379. Working with proxmox
  380. Malware cuckoo 2
  381. Malware cuckoo 1
  382. Pci v3 2 1 is here
  383. Threat attack risk assessment
  384. Ensuring risk assessments have a business impact
  385. Art of kerberoast
  386. Building upon core security risk definitions
  387. Malware linux
  388. Summerof2018
  389. Gdpr regulation faq
  390. Webinar facebooks data scandal and gdpr how it impacts you
  391. Cors findings
  392. Magic unicorn v3 0 released
  393. Gdpr chip away at the stone
  394. Take employees phishing
  395. Hide yo servers hide yo data
  396. How to choose a pci qsa
  397. New pci controls
  398. Public release hate crack automated hash cracking techniques hashcat
  399. Meltdown spectre welcome 2018 walkthrough
  400. Complex intruder attacks burp
  401. Derbytv
  402. Full disclosure authenticated command execution vulnerability pfsense
  403. Character assassination fun games unicode
  404. Trevorc2 legitimate covert c2 browser emulation
  405. Bridging the cybersecurity culture clash
  406. Different take exam prep cissp
  407. Full disclosure jitbit helpdesk authentication bypass 0 day
  408. Rubyerb template injection
  409. Using winrm meterpreter
  410. Gdpr five important considerations
  411. Attacking self hosted skype businessmicrosoft lync installations
  412. Trustedsec expands four new
  413. Pci inventory list assets
  414. White paper why penetration testing needs continual evolution going purple
  415. New tool release nps payload
  416. Social engineer toolkit set v7 7 blackout released
  417. Equation group dump analysis full rce win7 fully patched cobalt strike
  418. Foundation people trustedsec family grows
  419. Classy inter domain routing enumeration
  420. Full disclosure adobe coldfusion path traversal cve 2010 2861
  421. Office 365 advanced threat protection features shortfalls
  422. Circumventing encodedcommand detection powershell
  423. Wire messenger new competitor signal
  424. Damaging infosec credibility news articles overhyping security threats
  425. Isc2 board directors members post read
  426. Social engineer toolkit set v7 3 underground released
  427. Pentesters framework ptf v1 8 tool depot released
  428. Happy birthday trustedsec
  429. New release social engineer toolkit set v7 2 wine gold
  430. Obd ii break box diy edition
  431. Introduction gpu password cracking owning linkedin password dump
  432. Social engineer toolkit set v7 1 blue steel released
  433. Hacker vaccine 100 protection hackers
  434. Ships version 2 released major release
  435. Wmi post exploitation
  436. Set v7 0 remembrance released
  437. Vote isc2 2015 elections vote today
  438. Introducing tap an open source attack platform
  439. New tool spraywmi mass wmi pwnage
  440. Derbycon ctf statistics
  441. Master key duplication
  442. Video using the pentesters framework ptf
  443. The pentesters framework ptf 1 0 released
  444. Third ashley madison dump released
  445. Second larger ashley madison dump released
  446. Ashley madison database dumped
  447. Sqlifun
  448. Dresscode
  449. Malicious htas
  450. The social engineer toolkit set v6 5 mr robot released
  451. Magic unicorn v2 0 released
  452. Interactive powershell sessions within meterpreter
  453. Knowing what you dont
  454. No psexec needed
  455. Understanding the why
  456. New walls ladders
  457. Passwordstorage
  458. Teamapproach
  459. Non aggressive reporting
  460. Whats new with pci dss 3 1
  461. Continual compliance
  462. Egressbuster v0 2 and github goodies
  463. New tool the pentesters framework ptf released
  464. Here phishy phishy
  465. Bypassing virtualization and sandbox technologies
  466. Dumping wdigest creds with meterpreter mimikatzkiwi in windows 8 1
  467. Ms15 034 range header integer overflow
  468. Recursive ftp searching
  469. New additions to the family
  470. The social engineer toolkit set v6 3 huglife released
  471. Trustedsec announces new certification cdactc april fools
  472. Social engineer toolkit set v6 2 released
  473. Anthem hacked heartbleed
  474. Anthem breached hunt pii
  475. Account hunting invoke tokenmanipulation
  476. Ships version 1 1 released supports linux password management
  477. Introducing ships centralized local password management windows
  478. Ms14 068 full compromise step step
  479. Ms14 066 patch em got em
  480. Meterssh meterpreter ssh
  481. Emet 5 1 installation guide
  482. Project artillery now binary defense project
  483. Spreading information security malta
  484. Changing industry binary defense born
  485. Shellshock dhcp rce proof concept
  486. Cve 2014 6271
  487. Trustedsec blackhat
  488. Home depot possible large scale breach
  489. Metasploit scripting
  490. Chs hacked heartbleed exclusive trustedsec
  491. Se toolkit online training available august 14th
  492. Cisa effect privacy
  493. Ebay breach woa response
  494. Social engineer toolkit set v6 0 rebellion released
  495. Microsoft fix two major attack methods hackers
  496. Moar shellz
  497. Target ceo resigns impact large data breach
  498. Free webinar social engineer toolkit set v6 0 pre release training
  499. Multiple vulnerabilities microsoft word 1 1a
  500. Red alert massive cyber wire fraud attacks us companies
  501. Heartbleed need know
  502. Steps make web application hackers life harder
  503. Pretexting like boss
  504. Python remote code execution socket recvfrom into
  505. Importance documentation
  506. Social engineering abroad
  507. Introducing wpupdate automatic updates wordpress
  508. Powershell reconnaissance
  509. Explaining security issues healthcare gov
  510. Stand one change infosec now
  511. Target 70 million cards compromised payday hackers billions
  512. Abusing internet facing password resets 0 day
  513. Healthcare gov operational security concerns not addressed
  514. Trustedsec congressional hearing report
  515. David kennedy testifying front congress
  516. Perform risk assessment trustedsec
  517. Running hyper v inside vmware fusion
  518. Snmp can
  519. Social engineer toolkit set v5 4 walkers released
  520. Affordable health care website secure probably
  521. Derbycon capture flag final scoreboard
  522. Introducing spearphisher simple phishing email generation tool
  523. Osx 10 8 4 local root privilege escalation exploit
  524. New front war vulnerable
  525. Alex hamerstone joins the trustedsec family
  526. The social engineer toolkit set v5 3 released
  527. Emet 4 0 security strategy and installation step by step
  528. Wpad man in the middle clear text passwords
  529. The social engineer toolkit set v5 2 urban camping released
  530. Emet 4 0 released new gui and features
  531. Native powershell x86 shellcode injection on 64 bit platforms
  532. The social engineer toolkit set v5 1 released
  533. Installing kali linux on hyper v
  534. Pauldotcom thwarting client side attacks
  535. Emet 4 0 tutorial and overview
  536. Twitter associated press hack stop blaming social media
  537. Android for penetration testers pwnpad goodness
  538. Java 7 update 21 applet security change analysis
  539. The social engineer toolkit set version 5 0 the wild west
  540. Trustedsec hires vice president of business development
  541. Trustedsecs founder on fox news business talking on spamhaus
  542. Threat agent a smart profiler for us penetration testers
  543. The debate on security education and awareness
  544. Social engineer toolkit set v4 7 codename headshot released
  545. New tool release rpc enum rid cycling attack
  546. New tool release conqr an open source conference qrcode system
  547. Artillery version 0 7 released
  548. Pentester news statefulftp on windows 7 and windows 8 breaks payloads
  549. The social engineer toolkit set v4 4 the goat released
  550. Random python code of the day
  551. Set artillery moving github
  552. The social engineer toolkit set v4 3 turbulence released
  553. The defensive security strategy what strategy
  554. The social engineer toolkit set v4 2 bagels bagels bagels released
  555. The social engineer toolkit set v4 1 gangnam style has been released
  556. Visualizing project artillery and attackers
  557. The most advanced version of the social engineer toolkit to date released
  558. Owning dell drac awesome hack
  559. The security pros guide to mdm mam mim and byod
  560. Getting galaxy s3 headset mic to work with cm10 nightlies
  561. The social engineer toolkit set v3 7 street cred has been released
  562. Defcon 20 video owning one to rule them all
  563. New tool pyinjector released python shellcode injection
  564. Project artillery artillery threat intelligence feed atif launched
  565. Trustedsec announced attack platform appliance for remote penetration testing
  566. Sony hoax
  567. Trustedsec founder interviewed on slashdot about the apple hack
  568. The day of goodies set v3 6 new tools and new presentations released
  569. The social engineer toolkit set v3 5 1 has been released
  570. The social engineer toolkit set v3 5 creepy karl has been released
  571. Focusing on people vs technology in infosec
  572. Yahoo voice website breached 400000 compromised
  573. Inside and out of set at blackhat 2012
  574. Egress buster reverse bypassav
  575. Fixing the retina chrome canary flash fullscreen issue
  576. Trustedsec opens the doors 2
  577. Remote root authentication bypass for f5 big ip
  578. Massive mysql authentication bypass exploit
  579. The social engineer toolkit set 3 3 codename derbycon 2 0 edition has been released
  580. The social engineer toolkit set v3 3 codename derbycon 2 0 edition
  581. The social engineer toolkit v3 2 codename freehugs has been released
  582. Building a native http shell with aes in python
  583. New tool release egress buster find outbound ports
  584. Artillery 0 4 alpha has been released
  585. The social engineer toolkit 3 1 codename user awareness has been released
  586. The social engineer toolkit set 3 0 wethrowbaseballs has been released
  587. Blackhat training on the social engineer toolkit
  588. Disabling local administrators through gpo on server 2008
  589. Hiding from security vendors
  590. Artillery 0 3 alpha released
  591. Jailbreaking your iphone 4s or ipad2 5 0 1
  592. The social engineer toolkit set v2 5 3 has been released
  593. Artillery 0 2 alpha has been released
  594. The social engineer toolkit set v2 5 rippin and tearin has been released
  595. Healthcare most breached industry in 2011
  596. The social engineer toolkit set v2 4 renegade has been released
  597. The social engineer toolkit set v2 3 eclipse has been released
  598. The social engineer toolkit v2 2 codename son of flynn has been released
  599. Release of 0 1 1 alpha artillery
  600. New tool release artillery for linux protection
  601. Derbycon wrapup
  602. The social engineer toolkit set v2 1 rebirth has been released
  603. The social engineer toolkit set v2 1 being released at derbycon
  604. Installing vmware tools in backtrack 5 r1
  605. Arduino hacking for the big boys
  606. Fixing weird osx teensy keyboard issues
  607. New irc channel launches for the social engineer toolkit set
  608. Woot metasploit a penetration testers guide coming in july
  609. The social engineer toolkit set v1 5 convergence edition has been released
  610. Creating a 13 line backdoor worry free of av
  611. The social engineer toolkit set v 1 4 2 has been released
  612. The social engineer toolkit set v1 4 yay derbycon edition has been released
  613. Backtrack 5 on motorola xoom in 10 minutes or less
  614. The social engineer toolkit v1 3 artillery edition released
  615. Thursday 800pm est isdpodcast live set v1 3 being released
  616. The penetration testing execution standard ptes alpha released
  617. Set v1 3 interactive command shell new addition
  618. Building the ultimate bad arse cuda cracking server
  619. The social engineer toolkit v1 2 shakawkaw released
  620. The social engineer toolkit v1 2 coming soon
  621. Windows uac bypass now in metasploit
  622. Derbycon teaser video and website launch date announced
  623. Bypass windows uac
  624. Large social engineer toolkit update adds unc path attacks
  625. Set v1 1 codename happy holidays released
  626. Social engineering the art of human hacking
  627. Messing with droid x
  628. Set update gives significantly better av avoidance for msf payloads
  629. Getting foca to work in windows 7 x64
  630. The social engineer toolkit v1 0 devolution release
  631. The social engineer toolkit set v1 0 release date announced
  632. The long tail of information security
  633. Traditional penetration testing is dead bsides atlanta
  634. Secmaniac com website redesign
  635. Social engineer toolkit 0 7 1 minor update
  636. Set v0 7 swagger wagon released with updated tutorials
  637. Social engineer toolkit 0 7 codename swagger wagon and online tutorials
  638. Social engineer toolkit set updates on 0 6 1
  639. Social engineer toolkit v0 6 1 tutorial
  640. Set v0 6 1 metasploit dll hijack demo
  641. Social engineer toolkit v0 6 1 teensy usb hid attack vector
  642. Social engineer toolkit set v0 6 1 released
  643. Blackhat and defcon poc code released
  644. Thomas werth java applet open sourced
  645. Vegas and so it begins
  646. Anti virus evasion through javascript obfuscation
  647. Set v0 6 coming soon
  648. Fixing xorg conf with cuda machine on upgrade to ubuntu 10 04
  649. Social engineering your audience at notacon
  650. Omfg set v0 5 teaser
  651. Generate an ntlm hash in 3 lines of python
  652. Droid 2 1 from start to finish
  653. Building a badarse cuda cracking server
  654. Set v0 4 1 rise of the pink pirate
  655. Set v0 4 utilizing the aurora attack
  656. Shmoocon 2010 the aftermath
  657. Set v0 4 gets osx support
  658. Secmaniac com woot