SpecterOps Blog

Research & Tradecraft

Ghostwriter: 2020 Feature Update

We introduced Ghostwriter in July 2019 when we felt it was a good v1.0, but active development never slowed. If you missed…

Research & Tradecraft

Move faster, Stay longer

Research & Tradecraft

Revisiting Remote Desktop Lateral Movement

It’s no secret that attackers are looking for new techniques to execute lateral movement. However, there are only a handful…

Research & Tradecraft

Satellite: A Payload and Proxy Service for Red Team Operations

Research & Tradecraft

War Never Changes: Attacks Against WPA3’s Enhanced Open — Part 2: Understanding OWE

In early 2019, myself and fellow Denver-based researcher Steve Darracott (@theDarracott) set out to answer the question — “is Opportunistic Wireless…

Research & Tradecraft

War Never Changes: Attacks Against WPA3’s “Enhanced Open” — Part 1: How We Got Here

In early 2019, myself and fellow Denver-based researcher Steve Darracott (@theDarracott) set out to answer the question — “is Opportunistic Wireless…

Research & Tradecraft

Attacking FreeIPA — Part II Enumeration

In Part I of this series, we reviewed some of the background and underlying technologies utilized by FreeIPA. We also…

Research & Tradecraft

Attacking FreeIPA — Part I Authentication

Recently I had the opportunity to operate inside of an environment managed by FreeIPA. I wanted to take the time…

Research & Tradecraft

Modern Wireless Tradecraft Pt IV — Tradecraft and Defensive Strategy

We’ve gone over a lot of information in the last three sections of this writeup. In case you missed them,…