Re-Animating ActivitySurrogateSelector

Traces the evolution of offensive PowerShell invocation from powershell.exe command lines to in-memory .NET loading with UnmanagedPowerShell, evading process creation monitoring.

Covers assembly protections like ASLR, DEP, SafeSEH, and Authenticode signing, shows how PESecurity flags unsigned binaries, and explains decompiling .NET assemblies to review code.

Evil SQL Client (ESC) is a .NET console for SQL Server discovery, access, and data exfiltration, runnable via a plain exe, MSBuild inline tasks, or PowerShell reflection for stealthy red team work.

NetSPI releases BetaFast and Beta Bank, two deliberately vulnerable C# thick clients for practice, with flaws from SQL injection and hardcoded credentials to unencrypted database connections.

NetSPI shows why .NET SecureString still leaks passwords in memory via NetworkCredential, and demonstrates safer login handling using pinned mutable byte arrays instead of immutable strings.

NetSPI releases Tokenvator 2, a .NET token manipulation tool adding token display, privilege disabling and removal, named pipe tokens, and minifilter manipulation for Windows privilege escalation.