A new Kerberos delegation abuse path: combine Reflective RBCD, U2U, and an Impacket S4U2Proxy extension to exploit constrained delegation without an SPN.
Resources
Blog
Research
Keep up to date with the latest offensive security news, knowledge, and resources.
Discover how a self-propagating XSS worm exploits multi-tenant widget frameworks to autonomously spread across enterprise applications using legitimate API calls, bypassing CSP, evading audit trails, and surviving password changes.
MFA doesn't stop session cookie replay. Endpoint detection doesn't catch fileless malware without behavioral analysis. Here's the full post-phishing kill chain and what actually stops it.
The Axios supply chain attack exposed why dependency scanning fails against credential compromise. Learn how attackers backdoor popular packages and what your penetration tests are missing.
Four botnets. Three million devices. The same IoT vulnerabilities security teams have deprioritized for years. What defenders keep getting wrong.
LLM behavior isn't governed by a rulebook — it emerges from context, shaped by a stack of training, fine-tuning, and runtime instructions. Understanding this explains why the same model gives radically different responses to functionally identical requests.
