Windows exposes several COM objects that can perform privileged operations through the User Account Control (UAC) elevation mechanism. One such component is CMSTPLUA, implemented in cmlua.dll, whic...
This is a continuation of the Part 1, Where we dissected the PE file Starting from the DOS header and stopping right before we could explore the Optional Header in full, if you have not read that y...
Most browser attacks don’t need browser exploits. They rely on controlling a delivery path the browser already trusts. Modern web apps assume that if traffic arrives over HTTPS, then it is safe. T...
Email spoofing is not new. What is less discussed is how shared mail infrastructure can unintentionally enable authenticated spoofing across tenant boundaries even when SPF, DKIM, and DMARC all app...
The goal of this research/blog post is to understand, at a low level, what a PE file actually is, piece by piece. This is Part 1, focused on the PE headers and loader-relevant structures, stopping ...
First post after a year of setting this up. I’m officially committing to publishing my red-team journey over the next months, lab-only writeups on tool developments, OS internals, APT simulation