SMB Attacks Through Directory Traversal

Catalogs ten injection points for UNC paths that force SMB authentication back to an attacker, including XXE, broken IMG tags, traversals, database queries, and SharePoint.

As an organization that performs a large volume of code reviews and penetration tests, NetSPI is frequently asked which type of application assessment is the best option.

PowerHuntShares 2.0 adds LLM-based fingerprinting, secrets extraction, risk scoring, and graph exploration to help defenders and pentesters find SMB shares with excessive privileges.

Introduces open-source PowerHuntShares for inventorying and exploiting SMB shares with excessive permissions in Active Directory, covering root causes, ransomware risk, remediation and detection.

Pentesters can host SMB shares on Azure file shares instead of on-prem boxes, using Microsoft-hosted storage to move tools in and data out while sidestepping outbound domain filters.

Shows how directory traversal and local file inclusion bugs can read the Linux proc file system to reveal running processes, mounts, network connections, ARP tables, and kernel versions.