A good bit has been written about using high-level languages to obtain code execution and persistence within an environment. This post refines these techniques a bit further, discussing how PYTHONPYCACHEPREFIX can be used to obtain even more covert execution.

PacketHuffer is a tool to help wireless operators make sense of their recon data obtained from Kismet. It deduplicate information across multiple captures, and allows you to identify interesting networks, and run custom queries on the data.

External pentests and red teams often need reliable techniques for identifying and validating target users. Traditional methods like TeamsEnum and onedrive_user_enum are useful, but can be false positive-prone or require further authentication. The PowerBI API exposes an unauthenticated endpoint that returns a definitive {“accountExists”:true} or a 404/500, which can be used to enumerate valid email addresses for a given organization.

The AWS iam:PassRole permission is one of the most foundational permissions in all IAM. It grants a principal the ability to assign roles to services. Unlike other privileged IAM permissions, which tend to allow for direct escalation paths, PassRole abuse is more nuanced and therefore it’s harder to assess the impact of PassRole assignments for principals. In this post, we will explore different methods of assessing risks associated with PassRole.

SRA identified and disclosed several vulnerabilities in Milner ImageDirector Capture. This post explains the technical details for each of the five CVEs.