Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Adaptive DLL Hijacking

netspi.com | blog | #windows | #red-team | #dll-hijacking | #tooling | #code-execution | #koppeling

Summary

Details advanced DLL hijacking beyond the trivial LoadLibrary example, covering export table cloning, dynamic IAT patching, and runtime table reconstruction to keep processes stable (Koppeling).
Published
Collected

original ↗

Related coverage

blog · netspi.com
7 Ways to Execute Command on Azure Virtual Machines & Virtual Machine Scale Sets
NetSPI's DCT team demonstrates seven code execution vectors on Azure VMs and Virtual Machine Scale Sets via Azure CLI, PowerShell, and REST APIs, with detection guidance for each.
blog · netspi.com
Hijacking Azure Machine Learning Notebooks (via Storage Accounts)
Azure Machine Learning stores Jupyter notebooks in Storage Accounts; attackers with write access can modify them to gain code execution without interaction. NetSPI also released a credential dumper.
blog · netspi.com
Automating Managed Identity Token Extraction in Azure Container Registries
NetSPI shows how malicious Azure Container Registry tasks can generate and export tokens for attached Managed Identities, releasing a MicroBurst tool, Invoke-AzACRTokenGenerator, to automate it.
blog · netspi.com
Burp Suite Extension: AWS Signer 2.0 Release
AWS Signer 2.0 for Burp Suite signs or re-signs AWS API requests with SigV4 as they pass through the proxy, adding a new UI, profile management, and multi-source profile import for pentesters.
blog · netspi.com
NetblockTool: The Easy Way to Find IP Addresses Owned by a Company
NetblockTool is a Python tool that automates netblock discovery, scraping Google dorks, ARIN, and IPinfo to build a confidence-ranked list of IP ranges owned by a company and its subsidiaries.
blog · netspi.com
AutoDirbuster – Automatically Run and Save DirBuster Scans for Multiple IPs
AutoDirbuster wraps OWASP DirBuster in Python to run directory brute-forcing across multiple IP:port targets automatically, accepting Nmap gnmap files and saving per-target reports.
back