Introduction to Windows Dictionary Attacks

NetSPI built a GPU cracking rig with four Radeon HD 7950 cards running oclHashcat, hitting about 25 billion NTLM guesses per second, and shares hardware, cooling, and cabling lessons.

When you are conducting internal penetration tests in large environments, prioritizing attacks can be a challenging task, because of the number of systems and vulnerabilities.

A pentest shows Claude refuses to build an LSASS dumper, but local DeepSeek and uncensored Qwen models produce a working XOR-encrypted minidumper, making AI-assisted EDR evasion nearly effortless.

Syncing Domain Admins into Entra ID lets attackers pivot from compromised on-prem AD to the cloud, and back via password writeback. CIS and Microsoft advise keeping privileged admin accounts cloud-only.

This post focuses on obtaining domain administrative privileges from a local administrator or domain user account. Once the initial steps have been taken to obtain local administrative access on a Windows operating system, the natural next steps are to gain domain user and domain administrative privileges.

This Linux case study covers finding SSH servers, running dictionary attacks against weak passwords, then abusing overly permissive sudo rules on sh, vi, python, and nmap to escape to a root shell.