Guía de Explotación: Buffer Overflow x32
Guía técnica y práctica para comprender y explotar desbordamientos de búfer en arquitecturas x86 (32 bits) en entornos Linux.
Sitemap
A list of all the posts and pages found on the site. For you robots out there is an XML version available for digesting as well.
Pages
Mi Experiencia con la CRTP - 2026
Mi camino, anécdotas, preparación y metodología para aprobar la certificación Certified Red Team Professional (CRTP) de Altered Security.
My Experience with the CRTP - 2026
My journey, preparation strategy, lab experiences, and tips for successfully passing the Altered Security Certified Red Team Professional (CRTP) exam.
Active Directory Domain Trust: Abusing Child-to-Parent Trust
Privilege escalation across Active Directory trust boundaries: abusing Child-to-Parent trusts within the same forest to compromise the root domain.
Active Directory Certificate Services: Abusing ADCS ESC8 (NTLM Relay)
Step-by-step walkthrough of ADCS ESC8 exploitation over HTTP Web Enrollment using NTLM Relay for full Active Directory domain escalation.
Active Directory Certificate Services: Abusing ADCS ESC11 (RPC Relay)
Exploitation of ADCS ESC11 through unencrypted RPC ICertPassage interfaces via NTLM relaying to compromise Active Directory environments.
Active Directory Certificate Services: Abusing ADCS ESC8 (Kerberos Relay)
Deep dive into exploiting ADCS ESC8 via Kerberos Relay using KrbRelay to obtain domain controller certificates and achieve domain takeover.
BloodHound MCP: Integrating Claude with BloodHound
Leveraging the Model Context Protocol (MCP) to connect Claude AI directly with BloodHound graph databases for automated Active Directory analysis.
Dumping LSASS Without Mimikatz: Native and Administrative Alternatives
Techniques and LOLBins for extracting LSASS process memory in Windows environments without triggering traditional Mimikatz signatures.
Mythic C2 MCP: Integrating AI with Command and Control Operations
Integrating Model Context Protocol (MCP) with Mythic C2 and OpenCode to enhance offensive operations and command-and-control workflows with AI.
Ligolo-NG: Pivoting Guide for CPTS
Comprehensive guide to multi-hop pivoting and network tunneling using Ligolo-NG, tailored for CPTS and practical pentesting environments.
Infiltrator — HackTheBox
Insane difficulty HackTheBox machine focused on Active Directory, reverse engineering with Ghidra, BitLocker recovery, GMSA abuse, and ADCS ESC4 exploitation.
ShadowGate — HackSmarter Pro Labs
ShadowGate writeup (HackSmarter Pro Labs): anonymous AD enumeration, AS-REP Roasting, Shadow Credentials with Certipy, ESC8 and DCSync.
Search — HackTheBox
Search writeup (HackTheBox): web credentials, Kerberoasting, password spraying, hidden Excel column, GMSA abuse and GenericAll to DC.
Credential Extraction with WinDbg + Mimikatz
How to extract credentials from a Windows memory dump using WinDbg with the Mimikatz kernel extension, working directly on the context of protected processes.
Page Not Found
Page not found. Your pixels are in another canvas.
Posts
Credential Extraction with WinDbg + Mimikatz
How to extract credentials from a Windows memory dump using WinDbg with the Mimikatz kernel extension, working directly on the context of protected processes.
Search — HackTheBox
Search writeup (HackTheBox): web credentials, Kerberoasting, password spraying, hidden Excel column, GMSA abuse and GenericAll to DC.
ShadowGate — HackSmarter Pro Labs
ShadowGate writeup (HackSmarter Pro Labs): anonymous AD enumeration, AS-REP Roasting, Shadow Credentials with Certipy, ESC8 and DCSync.
Infiltrator — HackTheBox
Insane difficulty HackTheBox machine focused on Active Directory, reverse engineering with Ghidra, BitLocker recovery, GMSA abuse, and ADCS ESC4 exploitation.
Ligolo-NG: Pivoting Guide for CPTS
Comprehensive guide to multi-hop pivoting and network tunneling using Ligolo-NG, tailored for CPTS and practical pentesting environments.
Mythic C2 MCP: Integrating AI with Command and Control Operations
Integrating Model Context Protocol (MCP) with Mythic C2 and OpenCode to enhance offensive operations and command-and-control workflows with AI.
Dumping LSASS Without Mimikatz: Native and Administrative Alternatives
Techniques and LOLBins for extracting LSASS process memory in Windows environments without triggering traditional Mimikatz signatures.
BloodHound MCP: Integrating Claude with BloodHound
Leveraging the Model Context Protocol (MCP) to connect Claude AI directly with BloodHound graph databases for automated Active Directory analysis.
Active Directory Certificate Services: Abusing ADCS ESC8 (Kerberos Relay)
Deep dive into exploiting ADCS ESC8 via Kerberos Relay using KrbRelay to obtain domain controller certificates and achieve domain takeover.
Active Directory Certificate Services: Abusing ADCS ESC11 (RPC Relay)
Exploitation of ADCS ESC11 through unencrypted RPC ICertPassage interfaces via NTLM relaying to compromise Active Directory environments.
Active Directory Certificate Services: Abusing ADCS ESC8 (NTLM Relay)
Step-by-step walkthrough of ADCS ESC8 exploitation over HTTP Web Enrollment using NTLM Relay for full Active Directory domain escalation.
Active Directory Domain Trust: Abusing Child-to-Parent Trust
Privilege escalation across Active Directory trust boundaries: abusing Child-to-Parent trusts within the same forest to compromise the root domain.
My Experience with the CRTP - 2026
My journey, preparation strategy, lab experiences, and tips for successfully passing the Altered Security Certified Red Team Professional (CRTP) exam.
Mi Experiencia con la CRTP - 2026
Mi camino, anécdotas, preparación y metodología para aprobar la certificación Certified Red Team Professional (CRTP) de Altered Security.
Guía de Explotación: Buffer Overflow x32
Guía técnica y práctica para comprender y explotar desbordamientos de búfer en arquitecturas x86 (32 bits) en entornos Linux.