Playing with HTTP/3 QUIC (Quick UDP Internet Connections) and HTTP/3 represent the next step in the evolution of Internet protocols. Their development is driven by the need for faster, more reliable, and more secure online communications. While traditional web traffic has relied on the TCP protocol, which is reliable but can introduce
GIF Steganography from First Principles Inspiration Adam's blog on PNG steganography inspired me to start a project in a similar vein but focused on GIF files instead. Although I have previously written several .NET-based steganography tools previously, I have typically relied on existing libraries for the steganography part without delving into the fundamentals. It was
Cobalt Strike DNS Direct Egress Not That Far Away Cobalt Strike 4.3 added a bunch of useful new DNS beacon features which allow the behaviour to be tweaked more than before. Prior to this release the configuration was fairly limited for most mature client use cases. I look forward to trying out some of the new features. One
Code execution via the Windows Update client (wuauclt) Its been a few months since my last post about uploading and downloading data with certreq.exe as a potential alternative to certutil.exe in LOLBIN land. I've been having a blast starting my new role in the MDSec ActiveBreach team. Today I wanted to share something a little more
Upload and download small files with CertReq.exe I stumbled on another lesser known LOLBAS (https://lolbas-project.github.io/) for upload and downloading (small) files. CertReq.exe is present on Windows and its intended use to to assist with the creation and installation of certificates. You can use it as follows: Upload a file via HTTP POST Upload
Exploring search connectors and library files in Windows Introduction This short post explores the file formats .searchConnector-ms and .library-ms. Both of these file formats have default file associations on most Windows versions. They integrate with Windows to show content from a arbitrary location which can also be a remote location by specifying a WebDAV share. As seen in
Sorry you have missed a package In Windows 10 there’s a handy way for administrators to provision systems by way of something known as a “Provisioning Package”. This blog explores these files which carry a .ppkg extension. We look at some of the features and what happens if you interact with one. Particularly focusing on
The origin of command and control traffic When chatting through the DNS over HTTPS based command and control technique with defenders, something which came up in a blue teams arsenal caught my attention. This was JA3 which is an open source project from Salesforce which has been integrated into a lots of security software and appliances which
Playing with DNS over HTTPS (DoH) It has been nearly a month since I spoke at Mitre ATT&CKcon and shared some research into DNS over HTTPS (DoH) from a red team perspective. After releasing the tool DoHC2 there has been quite a few people using it and talking about DoH which is awesome! There's also
DNS over HTTPS (DoH) Servers I recently conducted some research into DNS over HTTPS (DoH) that is documented here [https://www.trustwave.com/Resources/SpiderLabs-Blog/DOH!-DNS-Over-HTTPS-Poses-Possible-Risks-to-Enterprises/] . When it came to identifying any publically available DoH servers available on the Internet I found the best resource to be the curl wiki page [https://github.com/
