NetSPI Blog
blog.netspi.com · Company blog · on HN since 2015
NetSPI's security consultants publish penetration testing techniques for SSH, PowerShell, SQL Server, SAML, and Android.
What HN saysHN links it as a reference for specific attacks, like stealing SSH-agent keys from memory and bypassing the PowerShell execution policy.
15HN people shared it
5linked it in comments
13stories submitted
56story points
6 years agolast shared
2015people per year2026
Most-shared posts
- 1Stealing unencrypted SSH-agent keys from memory (2014)2 people · 20 points · first shared 2018 · 7 comments on HN
- 215 ways to bypass the powershell execution policy2 people · first shared 2015
- 3Decrypting WebLogic Passwords1 people · 16 points · first shared 2015 · 6 comments on HN
- 4Beyond LLMNR/NBNS Spoofing1 people · 2 points · first shared 2018 · discussion on HN
- 5PowerUpSQL: A PowerShell Toolkit for Attacking SQL Server1 people · 2 points · first shared 2016 · discussion on HN
- 6Microsoft LAPS – Storing Cleartext Passwords in LDAP1 people · 2 points · first shared 2015 · discussion on HN
- 7Playing with Content-Type – XXE on JSON Endpoints1 people · 2 points · first shared 2015 · discussion on HN
- 8Dumping Git Data from Misconfigured Web Servers1 people · 2 points · first shared 2015 · discussion on HN
- 9Attacking SSO: Common SAML Vulnerabilities and Ways to Find Them1 people · 2 points · first shared 2018 · discussion on HN
- 10Decrypting MSSQL Credential Passwords1 people · 2 points · first shared 2015 · discussion on HN
- 11CVE-2020-17049: Kerberos Bronze Bit Attack1 people · 2 points · first shared 2020 · discussion on HN
- 12Four Ways to Bypass Android SSL Verification and Certificate Pinning1 people · 2 points · first shared 2019 · discussion on HN
- 13Tokenvator: A Tool to Elevate Privilege Using Windows Tokens1 people · 1 points · first shared 2018 · discussion on HN
- 14iOS Tutorial – Dumping the Application Memory Part 21 people · 1 points · first shared 2015 · discussion on HN
- 15Certificate pinning in a mobile application1 people · first shared 2018
What HN people wrote when they linked it
kencausey · 2020-10-13
I would argue that the key element is extracting a useful key which appears to have been made possible by an earlier blog from another source (referenced by this blog entry): https://blog.netspi.com/stealing-unencrypted-ssh-agent-keys-from-memor…
ericseppanen · 2018-12-11
seanmcelroy · 2018-03-05
HPKP is what the article you posted to is referring to, and probably will go away completely.
However, profiling the public key of the site a mobile app connects to and erroring out if it is compromised to prevent MitM attacks is called 'certificate pinning' for mobile apps but is not related to the HPKP pinning of browsers. A reference for certificate pinning: https://blog.netspi.com/certificate-pinning-in-a-mobile-application/
hobs · 2017-06-03
If it really needs that, https://blog.netspi.com/15-ways-to-bypass-the-powershell-execution-pol…
scott_karana · 2015-07-02
Originally, Powershell did NOT have execution policy. And even in versions that do, it's also at the mercy of the invoking process, as I recall.
Which is why he specifically said "powershell embeds without any security warning", I suspect. :|
https://blog.netspi.com/15-ways-to-bypass-the-powershell-execution-pol…