Extract Windows credentials directly from VM memory snapshots and virtual disks

https://github.com/nikaiw/VMkatz

#infosec #cybersecurity #redteam #pentest #windows #opensource

Default TLS Exclusions for Palo Alto Networks Firewalls

https://gist.github.com/UNC1739/cc175d87b8623569844efadf224bd6ad

#infosec #cybersecurity #redteam #pentest

This repo contains the design plan and runbook for using Claude Code to search for Java Deserialization Gadget chains.

https://github.com/atredispartners/llmchainhunter

#infosec #cybersecurity #redteam #pentest #ai #llm #opensource

A project that loads .NET assemblies into memory within an IIS environment running in full‑trust mode. It uses reflective loading techniques to inject inside the memory space of the w3wp.exe worker pool process

https://github.com/zux0x3a/Phantom

#infosec #cybersecurity #redteam #pentest #windows

A post that describe how PKG files can be used to gain initial access on macOS

https://blog.balliskit.com/macos-redteam-3-initial-access-with-darwinops-pkg-0a1d0160e662

#infosec #cybersecurity #redteam #pentest #macos #phishing

Rusty Armory - Beacon Object Files (BOFs) in Rust (Codename: Armory)

https://github.com/memN0ps/armory-rs

#infosec #cybersecurity #redteam #pentest #rust

It is possible as a low privileged user to parse the Windows event logs for any ASR exclusion

https://primusinterp.com/posts/WindowsASR/

#infosec #cybersecurity #redteam #pentest

This cheatsheet maps common impacket workflows to their modern alternatives

https://github.com/n00py/Outpacket

#infosec #cybersecurity #redteam #pentest

By altering the calling threads process ID and extending the exploitation window with file locks, an attacker can trick Seclogon into creating privileged LSASS handles for memory dumping

https://otter.gitbook.io/red-teaming/articles/windows-of-opportunity-exploiting-race-conditions-in-seclogon-to-dump-lsass

#infosec #cybersecurity #redteam #pentest #windows

Vulnerable and malicious Windows drivers database

https://loldb.xsec.fr

#infosec #cybersecurity #redteam #pentest #windows

The Live Terminal feature of Cortex XDR can be abused by attackers as a pre-installed, EDR-trusted C2 channel

https://labs.infoguard.ch/posts/abusing_cortex_xdr_live_response_as_c2

#infosec #cybersecurity #redteam #pentest

A collection of DPAPI hunting and parsing BOFs

https://github.com/toneillcodes/DPAPI-BOF

#infosec #cybersecurity #redteam #pentest #windows