BadOption.eu

Sometimes you just need to … “桳睯猠浯扥摯⁹⁡畱捩整浲湩污愠摮琠敨潣瑮湩敵” Details … <!

Webbrowsers are a complex piece of software and there might break some things if you do stupid stuff.

Github has some holes in their basic security which allow some tampering and spoofing.

Sometimes in a network far away, which is most of the time not yours, you might encounter ZIP files protected with passwords.

In 2024 NetNTLM leaking is still a thing!

It is trivially possible to disable the Cortex EDR as a non-admin user by triggering a repair function.

Public cloudstorage has a lot of crazy stuff in it.

Teams external participant splash screen bypass #2 Finally after several months and a “very smooth communication”, meaning 4 month of nothing from Microsoft, they patched the External Participant Bypass via Meeting invitations.

Phishing mobile devices, with DeviceCode phishing and QR codes As protections for endpoints (Laptops, Virtual-Desktops, …) are getting better and sometimes really tough to bypass, it might be time to move along.

A redirect chain for initial access Some programs still do not apply Mark-of-the-Web (MotW), so we can build an, for the victim quite annoying chain involving custom protocol header, Windows search, WebDAV and Java or some other techniques for the final k…