15 Ways to Download a File

SQL Server stores credential passwords reversibly encrypted in master.sys.sysobjvalues, so sysadmin attackers can decrypt them. NetSPI updates its PowerShell script for post-exploitation recovery.

MSSQL linked server credentials are reversibly encrypted, letting sysadmin-level attackers recover cleartext passwords via a new PowerShell script. Defensive advice on database links included.

A pentest shows Claude refuses to build an LSASS dumper, but local DeepSeek and uncensored Qwen models produce a working XOR-encrypted minidumper, making AI-assisted EDR evasion nearly effortless.

The first Linux case study targets insecure Rsync servers: enumerating shares on port 873, grabbing sensitive files, and creating a privileged user via shadow edits when the daemon runs as root.

NetSPI shows why .NET SecureString still leaks passwords in memory via NetworkCredential, and demonstrates safer login handling using pinned mutable byte arrays instead of immutable strings.

NetSPI releases Tokenvator 2, a .NET token manipulation tool adding token display, privilege disabling and removal, named pipe tokens, and minifilter manipulation for Windows privilege escalation.