Decrypting IIS Passwords to Break Out of the DMZ: Part 1

Application pool and virtual directory credentials in IIS's applicationHost.config can be decrypted with appcmd.exe or Get-ApplicationHost.ps1, letting attackers pivot from a DMZ web server inward.

Misconfigured SQL Server linked servers let attackers traverse database link networks, access unauthorized data, and deploy shells. The post covers enumerating links via the sysservers table.

This blog will provide some examples that illustrate how the OSQL utility can be used to gain unauthorized access to systems, databases, and sensitive information.

Building on Cookieless DuoDrop (CVE-2023-36899/36560), the author shows how cookieless sessions in IIS/ASP.NET enable WAF bypass and source code disclosure affecting many .NET web applications.

NetSPI security experts share key insights from DEF CON 33's "Access Everywhere" theme, from networking with hackers to expanding security expertise through sessions and workshops.

Part one on pivoting across AWS Organizations: account boundaries, the 'easy win' of attacker-created member accounts, and abuse of trusted access, delegated administration and IAM Access Analyzer.