Attacks Against Windows PXE Boot Images

A Project Zero write-up showing how a local network attacker can abuse Windows 10 WPAD/PAC proxy files, executed as JavaScript by jscript.dll, to achieve remote code execution.

NetSPI security experts share key insights from DEF CON 33's "Access Everywhere" theme, from networking with hackers to expanding security expertise through sessions and workshops.

Part one on pivoting across AWS Organizations: account boundaries, the 'easy win' of attacker-created member accounts, and abuse of trusted access, delegated administration and IAM Access Analyzer.

NetblockTool is a Python tool that automates netblock discovery, scraping Google dorks, ARIN, and IPinfo to build a confidence-ranked list of IP ranges owned by a company and its subsidiaries.

AutoDirbuster wraps OWASP DirBuster in Python to run directory brute-forcing across multiple IP:port targets automatically, accepting Nmap gnmap files and saving per-target reports.

From command execution on an Azure App Services host, attackers can inspect the environment, reach storage and Azure SQL, and abuse Managed Identity tokens to access Key Vaults and escalate.