In my previous post I outlined how to set up an open source uncensored/abliterated LLM in the cloud. My next action was to set up an OSS Android app which can talk to that environment. My Android phon
It has long been accepted in the infosec community that open source exploits do more to help defenders than to hurt. If only malicious actors have exploits and tooling then vulnerabilities cannot be d
I've been playing with mangling various public LLM jailbreaks to see if any of them still work. In general, I'd say the landscape has improved significantly as of late and classic jailbreaks are no lo
In this post I show how a malicious redirect can be performed on a trusted website if the trusted site contains an unsandboxed iframe pointing to an untrusted site. Consider this scenario: A website which the victim is likely to trust allows other s...
During penetration tests or Red Team engagements often I will come across an orphaned .ost (Offline Outlook Data File) sitting on a network share, etc. Getting these files connected to an Outlook profile which they were not originally connected to is...
I've been using fireprox to defeat rate limiting with great success. This tool sets up a pass-through-proxy in AWS API Gateway which is mapped to a specific target URL. It allows an attacker to rotate their egress IP address between hundreds of egres...
In this blog post, I'll share two low-tech methods I've used for defeating antivirus, EDR, MDR, XDR and whatever else the kids on my lawn are calling it these days. The first is a method I've been using for years that has yielded many wins for me dur...
After breaching a network perimeter, I often end up with access to a domain-joined remote virtual desktop that is quite locked down. VMware Horizon, Citrix, or Azure Virtual Desktop are some examples. In these situations, it's great to have establish...
In my quest to expand my knowledge of HTTP smuggling attacks, I recently stumbled on a hackerone report from @niubl who disclosed a security flaw in Node.js. This report resulted in CVE-2020-8287, and I decided to see if I could reproduce it on my ow...
