How to Access RDP over a Reverse SSH Tunnel

Introduces Penetration Testing as a Service (PTaaS), shipping the Resolve platform on every engagement to correlate and deliver findings in real time, starting with program management dashboards.

A follow-up to managed identity research showing how to collect Azure OAuth bearer tokens from the portal, CLI, managed identities, Automation RunAs, and Cloud Shell, with new MicroBurst scripts.

This Linux case study covers finding SSH servers, running dictionary attacks against weak passwords, then abusing overly permissive sudo rules on sh, vi, python, and nmap to escape to a root shell.

Walks through attacking insecure phpMyAdmin installs: finding exposed instances, dictionary-attacking weak passwords, uploading webshells, then pivoting to world-writable cron scripts for escalation.

Attacks misconfigured NFS exports: enumerating and mounting shares, spoofing UIDs to read protected files, and hunting setuid binaries to reach root, with a note on root squashing.

The first Linux case study targets insecure Rsync servers: enumerating shares on port 873, grabbing sensitive files, and creating a privileged user via shadow edits when the daemon runs as root.