SpecterOps Blog

Escaping the Confines of Port 445

TL;DR NTLM relay attacks on SMB restrict lateral movement to port 445/TCP capabilities. To extend beyond, leverage the Service Control…

Research & Tradecraft

I’d Like to Speak to Your Manager: Stealing Secrets with Management Point Relays

TL;DR Network Access Account, Task Sequence, and Collection Settings policies can be recovered from SCCM by relaying a remote management…

BloodHound

LudusHound: Raising BloodHound Attack Paths to Life

TL;DR LudusHound is a tool for red and blue teams that transforms BloodHound data into a fully functional, Active Directory…

Research & Tradecraft

Machine Learning Series Chapter 1

MICROGRAD FOR MORTALS TL;DR Let’s use Micrograd to explain core ML concepts like supervised learning, regression, classification, loss functions, and…

Research & Tradecraft

Administrator Protection Review

TL;DR Microsoft will be introducing Administrator Protection into Windows 11, so I wanted to have an understanding of how this…

Research & Tradecraft

OneLogin, Many Issues: How I Pivoted from a Trial Tenant to Compromising Customer Signing Keys

TL;DR OneLogin was found to have security vulnerabilities in its AD Connector service that exposed authentication credentials and enabled account…

BloodHound

Chatting with Your Attack Paths: An MCP for BloodHound

TL;DR In an effort to learn about Model Context Protocol servers, I created a MCP server that allows Claude Desktop…

Research & Tradecraft

Tokenization Confusion

TL;DR Tokenization Confusion: We look at the new Prompt Guard 2 model from Meta, how “confusing” Unigram tokenization can lead…

Industry Insights

Getting the Most Value Out of the OSCP: After the Exam

TL;DR In the final post of this series, I’ll discuss what to do after your latest exam attempt to get…