10 Places to Stick Your UNC Path

By switching a JSON request's Content-Type to application/xml, testers can sometimes reach an unanticipated XML parser on the server and trigger XXE, enabling file reads, UNC access, or SSRF.

Directory traversal and filename manipulation flaws in web apps can escalate into SMB attacks by supplying UNC paths, capturing hashes or reaching internal file shares.

PowerHuntShares 2.0 adds LLM-based fingerprinting, secrets extraction, risk scoring, and graph exploration to help defenders and pentesters find SMB shares with excessive privileges.

Introduces open-source PowerHuntShares for inventorying and exploiting SMB shares with excessive permissions in Active Directory, covering root causes, ransomware risk, remediation and detection.

Pentesters can host SMB shares on Azure file shares instead of on-prem boxes, using Microsoft-hosted storage to move tools in and data out while sidestepping outbound domain filters.

NetSPI shows why .NET SecureString still leaks passwords in memory via NetworkCredential, and demonstrates safer login handling using pinned mutable byte arrays instead of immutable strings.