Posts By SpecterOps Team Members

Posts from SpecterOps team members on various topics relating information security

Editors
Will Schroeder

Researcher @SpecterOps . Coding towards chaotic good while living on the decision boundary.

David McGuire

CEO of SpecterOps

Matt Nelson

Red Teamer | Security Researcher | Enjoys abusing features | Tweets are my own | http://github.com/enigma0x3

Andy Robbins

BloodHound Product Architect

Rohan Vazarkar

Penetration Tester and BloodHound Developer

Andrew Chiles

Director @ SpecterOps

Christopher Maddalena

A maker and a hacker

Steven F

Adsim at SpecterOps

hotnops

software engineer / optimist / tiki drink enthusiast

Justin Kohler

Product Director at SpecterOps

Latest Posts

Manual LDAP Querying: Part 2

This post is a follow-up to my previous post on manual LDAP querying. I would highly recommend reading that post prior to reading this one…

ADCS Attack Paths in BloodHound — Part 2

In this blog post, we will cover how we have incorporated the Golden Certificates and the ADCS ESC3 abuse technique in BloodHound.

Nemesis 1.0.0

In August of last year, @tifkin_, @0xdab0, and I released Nemesis, our offensive data enrichment platform. After lots of feedback…

LSA Whisperer

Thank you to SpecterOps for supporting this research, to Elad for helping draft this blog, and to Sarah, Daniel, and Adam for proofreading…

Rooting out Risky SCCM Configs with Misconfiguration Manager

tl;dr: I wrote a script to identify every TAKEOVER and ELEVATE attack in Misconfiguration Manager.

Ghostwriter v4.1: The Custom Fields Update

Introducing the awesome changes in the latest Ghostwriter

Getting Intune with Bugs and Tokens: A Journey Through EPM

Written by Zach Stein & Duane Michael

Pwned by the Mail Carrier

How MS Exchange on-premises compromises Active Directory and what organizations can do to prevent that

Summoning RAGnarok With Your Nemesis

With the explosion of large language model (LLM) use, everyone is rushing to apply LLMs to their specific industry and it’s the same for…

Browserless Entra Device Code Flow

Did you know that it is possible to perform every step in Entra’s OAuth 2.0 Device Code flow — including the user authentication steps —…

Reviews

No reviews, submit yours below.
Add review

Login to submit your review.