XPN Infosec Blog

This article looks at the Jev model and how it performs with offensive security tasks, including real-time OPSEC evaluation and hunting for sensitive files.

This post explores how effective LLM's are at reverse engineering EDR and AV engines.

In this post I walk through each major milestone that has been taken in my quest to explore building LLM-generated Mythic agents from prompt to deployment.

One of the things that has been winding me up about working with LLMs is how unmeasurable prompt modifications can be.

This article demonstrates how to jailbreak local models using constrained decoding.

In this article, we're going to look at how we benchmark the performance of our agent, and improve this capability with the macOS 27 Evaluations framework.

This article shows the power of macOS 27's new foundation model and OCR model for extracting credentials.

Dev Tunnels aren’t “just port forwarding”.

A deep dive into discovering CVE-2025-64755, a vulnerability in Claude Code v2.0.25.

Microsoft will be introducing Administrator Protection into Windows 11, so I wanted to have an understanding of how this technology works and how it interacts with existing offensive tooling.

In this post we look at the new Prompt Guard 2 model from Meta, and introduce a concept I've been calling "Tokenization Confusion" which aims to confuse Unigram tokenization into generating tokens which will result in the misclassification of malicious pr…

One of the things that I love about my role at SpecterOps is getting to dig into various technologies and seeing the resulting research being used in real-time.

In this post we’re going to focus on some ADFS internals.

Originally presented at SOCON-2024, and continuing the series into post-exploitation techniques against Identity Providers, in this blog post we'll look at Ping, OneLogin and Entra ID.

While looking for avenues of injecting code into platform binaries back in macOS Monterey, I was able to identify a vulnerability which allowed the hijacking of Apple application entitlements.

In this blog post, I'll discuss some of the post-exploitation techniques that I've found to be useful against Okta.

This year, LAPS 2.0 was released by Microsoft, and thankfully it now comes built-in to Windows.

Steganography is experiencing a revival as a wrapper for delivering payloads.

In this blog we'll look at what it takes to construct an in-memory loader for Mach-O bundles within MacOS Ventura without using dyld.

Up until recently, we've enjoyed in-memory loading of Mach-O bundles courtesy of dyld and its NSCreateObjectFileImageFromMemory/NSLinkModule API methods.

This post looks at the recent trend of pulling Azure tokens from Office process memory and tries to identify just how these tokens were loaded, how Office handles a Microsoft Account (MSA), and how we can recover cached credentials from the Token Broker C…

In this post we'll explore just how SCCM uses its HTTP API to initialise a client, take a look at how Network Access Accounts are retrieved from SCCM, and see how we can decrypt these credentials without having to go anywhere near DPAPI.

With the leaking of code signing certificates and exploits for vulnerable drivers becoming common occurrences, adversaries are adopting the kernel as their new playground.

In this post, we'll dig into just how SMB over QUIC works, answer some of the immediate questions around which attacks are feasible, and show how we can repurpose some existing tooling to capture NTLM handshakes.

In this post we are going to look at one such technique that I thought was cool while playing around with the Windows Object Manager, and which should allow us to load an arbitrary DLL of our creation into a Windows process during initial execution, somet…

Recently I've been looking at the .NET CLR internals and wanted to understand what further techniques may be available for executing unmanaged code from the managed runtime.

In this post, we are going to look at the Application Proxy protocol, how it works, and show how we can recreate enough functionality to allow us to create a custom inbound proxy into a client environment for our C2 traffic.

We've all been there, you've completed your initial recon, sent in your emails to gather those leaked HTTP headers, spent an age configuring your malleable profile to be just right, set up your CDNs and spun up your redirectors.

For a while I've wanted to explore the concept of leveraging a virtual machine on target during an engagement.

While working on some tooling recently I revisited the topic of .NET unmanaged exports and wanted to know just why this works in the way that it does.

If you've never heard of MACL on MacOS, you're not alone.

In this post, we are going to take a look at a couple of interesting methods of leveraging third-party technologies to achieve our code injection goals.

.NET for post-exploitation is here to stay.

It turns out that there is a method of disabling ETW in .NET, strangely exposed by setting an environment variable of COMPlus_ETWEnabled=0.

In this post we will walk you through the technology used to create and deploy the ActiveBreach Adversary Simulation Lab, and look at the hurdles we jumped through to get things running smoothly.

In this post we will focus on Event Threading for Windows (ETW), how it is used to surface events on .NET assemblies, and how we can evade this kind of detection.

In this post we will be looking at AWS Lambda, how we can deploy code using the Serverless framework, and how we can use this technology as a redirector for Cobalt Strike

As RedTeaming has grown with the industry, so has our need to build dependable environments.

Last year I posted a few tricks to help when targeting MacOS users, and included a technique useful for spoofing file extensions with the aim of taking advantage of Finder's removal of the .app extension from certain filenames.

In Cobalt Strike, blockdlls was introduced to allow protection of spawned processes from non-Microsoft signed DLL's.

Encountering Apple devices during RedTeam engagements is becoming increasingly common, so it's useful to have a few techniques available when navigating around whatever privacy or security changes are introduced with each version of MacOS.

In this blog post we will look at a somewhat familiar, but extremely limited window of opportunity which may come in handy when reviewing a fresh Active Directory forest deployment.

Hunting for new lateral movement techniques or interesting ways to execute code can be a nice way to sink some free time.

In a recent update to Sysmon, a new feature was introduced allowing the ability to log DNS events.

If you haven't had a chance to check it out, take a look here.

We’ve packed it, we’ve wrapped it, we’ve injected it and powershell’d it, and now we've settled on feeding it a memory dump, and still Mimikatz remains the tool of choice when extracting credentials from lsass on Windows systems.

In this blog post we will explore some of our findings that might assist red teamers operating in environments where CylancePROTECT is in place and briefly touch on CylanceOPTICS, a complementary solution that provides rule based detection to the endpoint.

In this post I will be showing how to build a Azure DevOps pipeline for .NET projects, and hopefully show some techniques which I have found useful to modify build artifacts to make them a bit different, and in some cases, to increase the time it takes to…

With clients increasingly relying on cloud services from Azure, one of the technologies that has been my radar for a while is Azure AD.

In Cobalt Strike 3.13, the argue command was introduced as a way of taking advantage of argument spoofing.