Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Attacking MS Exchange Web Interfaces

swarm.ptsecurity.com | research | #pentesting | #vulnerability-research | #active-directory | #ldap | #ms-exchange | #autodiscover

Summary

Positive Technologies catalogs techniques for attacking MS Exchange web interfaces, from user enumeration via Autodiscover to a new tool that extracts arbitrary Active Directory (LDAP) records.
Published
Collected

original ↗

Related coverage

  1. NetSPI/AD-PathFinder: Attack path mapping for Active Directory, ADCS, SCCM, and MSSQL using BloodHound CE + OpenGraph data (github.com)
  2. Azure Active Directory vs. Active Directory Domain Services (semperis.com)
  3. Exploiting Arbitrary Object Instantiations in PHP without Custom Classes (swarm.ptsecurity.com)
  4. CVE-2026-3593 — ISC BIND 9 DNS-over-HTTPS HTTP/2 SETTINGS Use-After-Free (aretiq.ai)
  5. CVE-2026-8206 — Themeum Kirki WordPress Plugin Password Reset Email Redirect Privilege Escalation (aretiq.ai)
  6. CVE-2026-48866 — WordPress Gravity Forms Plugin File Upload Path Traversal Arbitrary File Deletion (aretiq.ai)

back