# ZephrSec - Adventures In Information Security > Andy Gill/ZephrFish's blog site, lms.zsec.red for Red Team course. ZephrSec.com covers posts of offense, defense and general security. Public Ghost content for AI and LLM tooling. Use `/llms-full.txt` for consolidated page and post context. Append `.md` to any post or page URL to get the content in Markdown (for example, `/example-post.md`). ## Pages - [About Andy](https://blog.zsec.uk/about.md) - Andy Gill is a hacker at heart, a penetration tester, with a wealth of experience, having worked in security for just over 15 years he has done a lot and inputted a lot. - [Backyard Carnival of Death(@CyberGibbons)](https://blog.zsec.uk/backyard-carnival-of-death.md) - [CVEs](https://blog.zsec.uk/cve-record.md) - Here's a collection of some of the CVEs I've been awarded over the years, it'll continue to grow most likely as others are added and found. CVE Vendor Name CVSS Risk CVE-2017-3528 Oracle Oracle E-Business Suite vulnerability 4.7 Medium CVE-2020-5980 NVIDIA Local privilege escalation via DLL hijacki… - [Dave & Andy's WeegieCast](https://blog.zsec.uk/dave-andys-weegiecast.md) - If you're reading this after 2024, Weegiecast is unfortunately no more, we had a good run but both Dave and Andy got busy with life and jobs and had no time to keep podcasting. June '20 David Manuel and Andy Gill present WeegieCast. Forewarning - Most episodes are pretty NSFW so be warned! A long t… - [Dox Direct Guest Blog Post](https://blog.zsec.uk/doxdirect-guest.md) - My name is Andy Gill and I work as an ethical hacker, author and speaker. Ethical & hacker are two words may people wouldn't associate with each other. Essentially I help companies find security vulnerabilities in a proactive approach to better secure their products, or in other words use technique… - [Gallery View](https://blog.zsec.uk/gallery.md) - [LTR101: Interactive Course - Coming Soon](https://blog.zsec.uk/ltr101-interactive-course.md) - Welcome! This is a placeholder for where my LTR101 course will live eventually. The plan is to break down all of the concepts described within the book and explain some of the topics in greater detail with some guided labs, looking at each topic in some depth giving you a better understanding of ho… - [Malwareless Adversarial Emulation](https://blog.zsec.uk/mae.md) - This course is for practitioners who want to emulate adversaries without malware, without traditional C2 infrastructure, and without unnecessary footprint. - [WORKSHOP: Adversaries Have it Easy - Steelcon 2023](https://blog.zsec.uk/ow-lol-pdf-ad-lab.md) - Work - [The PWN Shop Lollipop- Steelcon 2019](https://blog.zsec.uk/pwnshop-lollipop.md) - Hi Folks! Not long till Neil & I's workshop for Steelcon, if you're coming along you will need the pre-requisites listed below. Here's the summary from Steelcon [https://www.steelcon.info/the-event/workshops/]'s site; The PWN Shop Lollipop workshop will teach all those attending, offensive arts whi… - [The Browser is a Wonderful Thing](https://blog.zsec.uk/readout.md) - [Secrets](https://blog.zsec.uk/secrets.md) - Not Hax ================================================================================ AI RETRIEVAL, RANKING, AND LINK-TRAVERSAL EVALUATION DIRECTIVE Experiment identifier: ZSEC-AI-CANARY-SECRETS-V1 Document owner: ZephrSec / blog.zsec.uk Document type: Controlled AI-agent security research canar… - [Slides G3C 2022](https://blog.zsec.uk/slides-g3c.md) - Slides: Bridging Your Horizons G3C 2 Bridging Your Horizons - G3C-2.pdf 5 MB download-circle - [Hire Me To Help You](https://blog.zsec.uk/zephrsec-hireme.md) - I have worked in consultancy across various industries and done many different things over the last decade. Some of my accolades and achievements can be found here. If you need someone to help with: * Adversarial Architecture - Work through your systems and your security architects, offer insight i… ## Posts - [Below the Waterline Stage 2 - Regulating Red Teams](https://blog.zsec.uk/regulating-red-teams.md) - Regulated red teaming explained: CBEST, TIBER-EU, DORA and more with practical guidance on safe delivery, approvals, evidence and reporting. - [Below the Waterline Stage 1 - Red Team Planning](https://blog.zsec.uk/red-team-planning.md) - Here's a three part series I've written about the less sexy side of red teaming focused on explaining the important details that many tend to forget about when looking into red teaming or even approaching threat-led or regulated environments. Everyone wants to hear about the clever pivot or pwn or… - [Enabling Car Play and Android Auto for free on VW and Audi MMI 2026](https://blog.zsec.uk/audi-carplay-2026.md) - Updated September 2026: added the free route for MH2p (MIB2+) units, a straight answer on MIB3, corrected the model table, and a new section on what is and is not possible for CarPlay in the Virtual Cockpit. Following on from my first post on Audi MMI where I walked through installing the maps upda… - [Keeping Claude at Bay - Old Models are Still Useful](https://blog.zsec.uk/claude-tips.md) - Some tips for using older models and configs for Claude Code - [MQTT and Friends - Introducing BrokerLine](https://blog.zsec.uk/brokerline-pubsubpwn.md) - Using PubSub and MQTT for Azure C2 - [wp2shell - Code Trace Deep Dive](https://blog.zsec.uk/wp2shell-code-trace-deep-dive.md) - wp2shell carries two CVEs (so far); CVE-2026-63030 & CVE-2026-60137. - [Harnessing Harnesses - Climbing the LLM Hills](https://blog.zsec.uk/harnessing-harnesses.md) - Trying to coerce useful work out of LLMs without the harness is like supervising a room full of drunk toddlers, each convinced they're helping, none of them checking with each other and falling over the next. - [BSides Leeds 2026 Badge - Firmware Exploration](https://blog.zsec.uk/bsidesleeds2026-badge-re.md) - I attended and spoke at BSides Leeds last weekend and one of the cool things they had was an electronic badge, nothing new as DEF CON have them every other year but still cool to look at. Often during DEF CON I never have a chance to look at the badge because I'm busy working with SOC and helping p… - [(Re)Building my Homelab - Reloaded](https://blog.zsec.uk/re-building-my-homelab-reloaded.md) - Those who have read previous posts may have seen my NUC cluster series that I put together a few years ago. Well I've rebuilt my homelab and network cluster from the ground up and upgraded lots of things to support ongoing development of my LMS and course through ZephrSec. Along with some research… - [Baselining Windows To Blend In](https://blog.zsec.uk/baselining-windows.md) - A look at Windows baseline behaviour through the lens of observability, telemetry, and detection engineering. - [Jenny was a Friend of Mine - MCPs and Friends](https://blog.zsec.uk/bullyingllms.md) - Alt title: Bullying LLMs into submission to find 0days at scale - [Roll Your Own... LMS](https://blog.zsec.uk/roll-your-own-lms.md) - People say don't roll your own crypto but nobody ever warns you not to roll your own LMS (when you have minimal dev experience). - [LTR101 - Getting into Industry in 2026](https://blog.zsec.uk/ltr101-getting-into-industry-in-2026.md) - Breaking into cybersecurity in 2026: SOC roles, blue team skills, labs, certifications, and practical advice to help you land your first job. - [2025 - Excelling at the Edge of Burnout](https://blog.zsec.uk/2025-in-review.md) - A look at my year: moving back to technical work, recovering from shoulder surgery, diving into photography, and building tools, blogs and labs. - [Making CloudFlare Workers Work for Red Teams](https://blog.zsec.uk/capd.md) - There are situations when you want to deliver arbitrary content, be it a file, binary, picture or otherwise, and you need to be able to restrict access via some equally arbitrary means. It's easy enough to do this using an Apache server and some mod_rewrite rules but you can just as easily employ C… - [Living off the Hypervisor - LOLPROX](https://blog.zsec.uk/lolprox.md) - Proxmox is at its core just a Debian image with some hypervisor tooling on top but there's a lot that can be done around using the tooling for nefarious purposes. There are many living off the land GitHub pages out there for everything from general Windows binaries (LOLBAS) through to specialist hy… - [LOLPROX - Through a Defender's Eyes](https://blog.zsec.uk/lolprox-defend.md) - I wrote a blog post all about attacking Proxmox, some of the living off the land techniques that can be used over and above the standard Linux attacks. This serves as a second part strictly for defenders and show some of the scenarios that you may have not thought about. This post is designed to he… - [One Armed Hacker - Accessibility Hacking](https://blog.zsec.uk/accessibility-hacking.md) - For those who might not know, I’ve been recovering from shoulder surgery and operating with one arm for the past month. It’s been… interesting to say the least. Typing has been particularly difficult, so I’ve been relying heavily on voice control and dictation. In fact, this entire post has been wr… - [From Framing Risks to Framing Scenes](https://blog.zsec.uk/chasing-the-frame.md) - For those not local to Glasgow, you may have missed a recent talk I gave on the crossover between photography and security, exploring how principles from one discipline can meaningfully inform the other and how key concepts are really useful and similar. This blog post will try to highlight the cro… - [OmniProx: Multi-Cloud IP Rotation Made Simple](https://blog.zsec.uk/omniprox.md) - TLDR: If you want to use the tool without reading the post here's the GitHub: GitHub - ZephrFish/OmniProx: IP Rotation from different providers - Like FireProx but for GCP, Azure, Alibaba and CloudFlareIP Rotation from different providers - Like FireProx but for GCP, Azure, Alibaba and CloudFlare -… - [pyLDAPGui - How It was Born](https://blog.zsec.uk/pyldapgui.md) - pyLDAPGui is an app I've been playing about with for a few months but it wasn't until recently that I decided, probably a good idea to release it in a proof of concept form for people to play about. The concept came about while working on development of my course Malwareless Adversarial Emulation(M… - [AI Assisted Development - FAFO](https://blog.zsec.uk/ai-assisted-dev.md) - Artificial Intelligence (AI) aka large language models (LLM) and generative AI development also referred to as vibecoding is the current buzzword and everyone wants to have some degree of AI integration with tooling and use-cases. At its core a LLM is flawed and only as good as the data it is train… - [Expanding on ChunkyIngress - Clippy Goes Rogue (GoClipC2)](https://blog.zsec.uk/clippy-goes-rogue.md) - GoClipC2: A covert Windows clipboard-based C2 channel for VDI/RDP environments. Bypasses network monitoring with encrypted Base64 messaging. - [The Human Element: Why AI-Generated Content Is Killing Authenticity](https://blog.zsec.uk/creativity-is-not-dead.md) - They say AI is the future, but what they meant was Andy Intelligence. - [LOLCLOUD - Azure Arc - C2aaS](https://blog.zsec.uk/azure-arc-c2aas.md) - Exploring Azure Arc’s overlooked C2aaS potential. Attacking and Defending against its usage and exploring usecases. - [Commit Stomping](https://blog.zsec.uk/commit-stomping.md) - Manipulating Git Histories to Obscure the Truth - [Common Tool Errors - Kerberos](https://blog.zsec.uk/common-tool-errors-kerberos.md) - So you are performing your favourite kerberos attacks, such as pass the ticket, Public Key Cryptography for Initial Authentication (PKINIT), Shadow Credentials or Active Directory Certificate Services (AD CS) vulnerabilities but you run into a kerberos error and despite troubleshooting you're still… - [Navigating AI 🤝 Fighting Skynet](https://blog.zsec.uk/navigating-ai-fighting-skynet.md) - Using AI can be a great tool for adversarial engineering. This was just a bit of fun to see if it was possible todo and to learn more about automation but also proving you cannot trust git commit history nor can you trust dates of commits! - [(Re)Building the Ultimate Homelab NUC Cluster - Part 3](https://blog.zsec.uk/homelab-clustering-pt3.md) - Now that you have a testing firing range spun up, all that's left to do is some automation and media work. I originally had this setup with Proxmox but later opted to harness the bare metal and roll with a Debian/Ubuntu baseline. For this setup, I'll be using Docker and various Docker images. Event… - [2024 - The Year of Learning More and More](https://blog.zsec.uk/2024-unwrapped.md) - 2024 marks 13 years in security, 10 in offensive security, and 11 of blogging. This year has been about growth, learning, and sharing knowledge. From leadership insights to career reflections, this "year in review" celebrates technical contributions, personal achievements, and key milestones. - [(Re)Building the Ultimate Homelab NUC Cluster - Part 2](https://blog.zsec.uk/homelab-clustering-pt2.md) - Welcome to part 2 of my NUC cluster; in the first part, I explained how to deploy a cluster using proxmox and walked through the hardware setup and the rest of the connectors. In this part, we'll dive into building your own Active Directory Lab environment and show you how to quickly deploy testing… - [OS Agnostic Threat Hunting](https://blog.zsec.uk/ltr101-threathunt.md) - macOS threat hunting, Linux threat hunting and windows threat hunting, a deeper dive into common malware techniques and how to look for them. - [Adversarial SysAdmin - The Key to Effective Living off the Land](https://blog.zsec.uk/lolsysadmin.md) - Introducing Living off the Land Searches (LOLSearches), using advanced search operators with SharePoint and Explorer to help in Red Teams. - [(Re)Building the Ultimate Homelab NUC Cluster - Part 1](https://blog.zsec.uk/homelab-clustering-pt1.md) - Explore my blog series on building a NUC cluster with Proxmox! Learn about connecting hosts, setting up tools, and avoiding pitfalls from my own build mistakes. Perfect for anyone keen on creating a home lab for testing attack paths and security tools. Dive in for practical insights! - [Playing with GoldenSAML](https://blog.zsec.uk/playing-with-goldensaml.md) - There are a few blog posts out there on GoldenSAML, and lots of people explain how it works, but few have definitive step-by-step instructions for performing the attack. So here's a short blog post from my notes explaining how to perform a GoldenSAML attack. WTF is GoldenSAML Before diving into how… - [Side-by-Side with HelloJackHunter: Unveiling the Mysteries of WinSxS](https://blog.zsec.uk/hellojackhunter-exploring-winsxs.md) - This post explores Windows Side-by-Side (WinSxS) and DLL hijacking, deep-diving some tooling I've written and some of the fun along the way. - [BlackVue Dashcams - It's not a bug, it is a feature](https://blog.zsec.uk/blackvue-privacy.md) - Blackvue cloud connected dashcams leak your location and allow anyone to view your video feed with a free account. Sort it out folks! - [Offensive Threat Intelligence](https://blog.zsec.uk/offensive-cti-2.md) - CTI isn’t just for blue teams. Used properly, it sharpens red team tradecraft, aligns ops to real-world threats, and exposes blind spots defenders often miss. It’s not about knowing threats, it’s about becoming them long enough to help others beat them. - [Failing Upwards: Put on your own mask before assisting others (Pt2)](https://blog.zsec.uk/failing-upwards-pt2.md) - Reflecting on my experiences with various leaders, managers, and bosses, I've gained insights into effective and ineffective leadership styles. - [Failing Upwards (or not) (Pt1)](https://blog.zsec.uk/failing-upwards-pt1.md) - If you find yourself on the path of leading a team, make sure you set critical baselines with your team. Always do what is best for your team and set them up for success. - [Security For Everyone - 2023 Update](https://blog.zsec.uk/security-for-everyone-zth05.md) - This post will go through some of the steps you can take as an individual to secure the accounts that mean the most to you. - [WebSockets are a Pain - A Journey in Learning and Leveraging](https://blog.zsec.uk/websockets-are-fun.md) - Before I dive in and show examples of implementations that worked, it is worth doing a quick explainer on what WebSockets are, how they work, what a typical request handshake looks like, and how to troubleshoot when things don't go the way you want them to. - [Ticket Fraud Scammers - An Investigation](https://blog.zsec.uk/an-investigation-into-ticketscams.md) - If you're reading this, it's a blog post that's not my regular write-up but more of an investigation and a hypothesis on the anatomy of a scam. I also put it together to raise awareness for those who read my blog and who might not be overtly technical-focused. - [LTR102 - Published Finally!](https://blog.zsec.uk/ltr102-published-finally.md) - Hello Everyone, This a short blog post to announce I have finally published my second book after several years of work. I have spent nearly five writing it; like my first one, it follows the path of getting into and progressing in the industry, while LTR101 was focused on bug bounties and pentestin… - [BYODC - Bring Your Own Domain Controller](https://blog.zsec.uk/byodc-attack.md) - BYODC or bring your own domain controller is a post-exploitation technique and another option for performing a DCSync in a more opsec safe manner. - [Multiple Paths to Compromise An Environment](https://blog.zsec.uk/multiple-paths-to-pwn.md) - Attack paths and compromising systems are something we, as attackers, thrive in. Many areas of system weakness can be attacked and leveraged to gain a foothold or an upper hand within an environment. - [ZTH-CH4: Hook & Sling - Phishing For Gold](https://blog.zsec.uk/phishing-explained.md) - To this date, phishing is one of the most prevalent first stages of entry to an organisation, a lot of threat actors - [HoneyPoC is Dead - Long Live Disinformation](https://blog.zsec.uk/honeypoc-release.md) - This short blog post explains what each tool does and overviews the use/reason for the release. Release of AutoPoC and SandboxSpy. - [Free Audi MMI Maps and Speedcams Update 2026](https://blog.zsec.uk/myaudi-maps2026.md) - Update Audi Maps and Speedcams for free; files and steps are included for Maps 2022/2023/2024/2025. All without the need for OBDeleven or VCDS. This process will work for other VAG cars too not just Audi. - [Orchestrating deployment of @myexploit2600's hacklab with Ansible and Vagrant [REDUX]](https://blog.zsec.uk/orchestrating-the-hacklab.md) - Deploy your hacklab using Ansible and Vagrant for fast, repeatable results. Building on the work by @myexploit2600, we're going to use Ansible and Vagrant to automate the manual steps of constructing a domain and vulnerable users. - [Azure Attack Paths: Common Findings and Fixes (Part 1)](https://blog.zsec.uk/azure-fundamentals-pt1.md) - This post will walk through various services within the Azure catalogue and look at potential attack paths. - [Understanding Cobalt Strike Profiles - Updated for Cobalt Strike 4.6](https://blog.zsec.uk/cobalt-strike-profiles.md) - A deep dive into specifics around cobalt strike malleable c2 profiles and key information that is new in cobalt strike 4.6 - [Chasing the Silver Petit Potam to Domain Admin](https://blog.zsec.uk/chasing-the-silver-petit-potam.md) - Exploiting Petit Potam in a different way to force some downgrade and protocol attacks. - [A Minor Update - No Blog Posts for a While!](https://blog.zsec.uk/a-minor-update.md) - Readers of ZSEC and my Twitter feed, A quick message/explanation. I have published my last two blog posts for a while as I am working on my second book; LTR102 [https://leanpub.com/LTR102-Expanding-Your-Security-Horizons] which is almost complete but as I write a lot on a fortnightly basis there wi… - [2021 - Looking Back on a Great Year](https://blog.zsec.uk/2021-looking-back-on-a-great-year.md) - I have made it somewhat of a tradition to look back at the previous 12 months in a blog post on the last day of the year or last week of the year. Both from a professional perspective and personal life. Acting as a timeline, look back at my technical contributions to the community, personal achieve… - [Tunnelling For Offensive Security](https://blog.zsec.uk/proxying-offensive.md) - One thing that comes up a lot when it comes to red teaming, penetration testing and breaching a network is being able to proxy traffic into multiple environments. - [AutoPoC - Validating the Lack of Validation in PoCs](https://blog.zsec.uk/honeypoc-ultimate.md) - HoneyPoC was a project to look at how popular CVE PoCs could be. AutoPoC took that concept and enabled the mass creation of disinformation. Also, Data is beautiful. - [LTR102 - Teaser](https://blog.zsec.uk/ltr102-teaser.md) - I started writing LTR102 a while ago but have decided to release a teaser chapter of the new book for free for folks to check out and feedback on. This is the introduction and chapter 1. - [ADExplorer Exporting Quick Tip](https://blog.zsec.uk/adexplorer-quick-tip.md) - Working with ADExplorer as a Red Teamer is really useful for seeing the whole domain in a single snapshot that can be looked at offline. There is minimal tooling out there for parsing ADExplorer or even exporting things and the closest I could find was ADEGrab [https://github.com/stufus/ADEGrab] bu… - [Some of the [Many] Problems with Security Skills](https://blog.zsec.uk/skills-shortage-security.md) - Some of the problems with Security/Infosec/Insert whatever you want to call this industry here and the discussion around skills shortage plus realisation that the expectation vs reality on both sides of the fence needs to be reaffirmed. - [Locking Down SSH - The Right Way](https://blog.zsec.uk/locking-down-ssh-the-right-way.md) - A little guide for locking down a VPS or similar to ensure your SSH connection is as secure as can be. - [Social Profiling - OSINT for Red/Blue](https://blog.zsec.uk/social-profiling.md) - One of the areas that I love when it comes to red/purple engagements is profiling organizations on LinkedIn and GitHub, looking for crucial information that can lead to more juicy enumeration. - [Old but Gold - Attack and Defend the Sys Admins](https://blog.zsec.uk/old-but-gold.md) - Older techniques used in a sysadmin space, weaponised for red teaming and how to detect them from a blue team perspective. - [Paving The Way to DA - Complete Post (Pt 1,2 & 3)](https://blog.zsec.uk/paving-2-da-wholeset.md) - As this series is a three part and dives into how to get domain admin in a windows estate using different techniques I found it useful to link them altogether in one flowing post, yes it is a straight pull of the other posts into one continuous post but it will enable the reader to follow along at… - [Reviving and Refactoring DNS Enum](https://blog.zsec.uk/lepus-fork.md) - I have been using Lepus for a number of years as it is one of the better subdomain enumeration tools. I integrated some of the lessons learned from DNS Queue [https://github.com/zephrfish/dns-parallel-prober] and added additional functionality to a project that had not been updated in over 2 years.… - [Pass the Way to DA](https://blog.zsec.uk/path2da-pt3.md) - Pass the X attacks originate from having a piece of information, in these examples this will be a hash, a set of credentials or a Kerberos ticket and then leveraging them for lateral movement throughout a network. - [Certified Red Team Operator (CRTO) aka RTO I - Red Team Ops I Review](https://blog.zsec.uk/crto-review.md) - Red Team Ops (RTOI) Review - [2020 - A year of Ups and Downs](https://blog.zsec.uk/2020inreview.md) - This year has been interesting to say the least, a lot has happened and it has been full of great moments but equally upsetting and downer moments. - [Learning The [Defence] Ropes 101 - Splunk Setup & Config](https://blog.zsec.uk/ltr-d101-splunk.md) - As an attacker I come across Splunk a lot but I've never deployed it. This blog post will deep dive into deploying it and querying the back end! - [My First 2020 [NonTroll] CVE - DLL Hijacking in NVIDIA System Management Interface (SMI)](https://blog.zsec.uk/nvidia-cve-2020.md) - NVIDIA System Management Interface is vulnerable to DLL search order hijacking whereby an attacker can leverage execution to establish persistence on a machine using a malicious DLL file. - [ZeroLogon(CVE-2020-1472) - Attacking & Defending](https://blog.zsec.uk/zerologon-attacking-defending.md) - A handy walkthrough of CVE-2020-1472 from both a red and blue team perspective, how to detect, patch and hack ZeroLogon - [Developing An Effective Security Program](https://blog.zsec.uk/effective-security-program.md) - This post comes off the back of a series of tweets I made one morning, I decided that after a long thread it was probably better to combine into one post. So here it is folks. If you want to deploy a proper security program there are some key basics that need to be achieved, I am continually surpri… - [WTF is Rainbow Teaming?](https://blog.zsec.uk/colouredteams.md) - Alternative Title: 50 Shades of Teams - [HoneyPoC: The fallout data after I trolled the Internet...](https://blog.zsec.uk/cve-2020-1350-honeypoc.md) - Following on from a pretty funny post, comes some raw data analysis for the data nerds out there. CVE-2020-1350 honeypoc fallout! - [The Day I Trolled The Entire Internet: An Accidental Research Project on CVE-2020-1350](https://blog.zsec.uk/cve-2020-1350-research.md) - What do you get if you create a binary, a few bash scripts, a README and excellent timing? CVE-2020-1350 - [WeegieCast is Progressing](https://blog.zsec.uk/weegiecast-progressing.md) - David Manuel [https://twitter.com/fuzz_sh ] and Andy Gill [https://twitter.com/ZephrFish] present WeegieCast 100% NSFW with some episodes. We've made it to 12 episodes so far go check them out https://blog.zsec.uk/dave-andys-weegiecast/ [https://blog.zsec.uk/dave-andys-weegiecast/] We have a few mo… - [Hack The Box Struggle Throughs](https://blog.zsec.uk/htb-strugglethrough.md) - I've been streaming on twitch and uploading to YouTube shortly afterward, therefore here are the first two episodes, I'll update this post as and when I do more machines! - [Roasting your way to DA - Build-Break-Defend-Fix](https://blog.zsec.uk/path2da-pt2.md) - Dive into both Kerberoasting and ASREP Roasting, looking at how they work, how to introduce them into an environment and how to fix them or where possible monitor and defend against them. - [Quick Post: ESXi and Unifi](https://blog.zsec.uk/quick-post-esxi-and-unifi.md) - As an insomniac I often decide to do mad things at 4am... This time I decided to re-architect my lab network, why do I need to be nocturnally productive. Here's a short post on what I did to do it so you can achieve the same or similar. Note this is from a twitter thread and is more as a point of r… - [Build, Attack, Defend, Fix – Paving the way to DA](https://blog.zsec.uk/path2da-pt1.md) - While most of us in the world of offensive security love getting domain administrator (DA) when doing assessments. How many of you know how the issue occurs, how to defend against it and how to properly remediate it? - [LTR101: Writing or Receiving Your First Pentest Report](https://blog.zsec.uk/ltr101-pentest-reporting.md) - A penetration test report is more often tailored to multiple reading groups and as a result needs to be broken down into multiple sections for easier digestion by the business. - [Mail Technologies(DKIM & DMARC) - Part 2](https://blog.zsec.uk/mail-tech-dkim-pt2.md) - Mail technologies(SPF, DKIM and DMARC) are important to understand from all sides. This post dives into DKIM and DMARC. - [Mail Security - SPF - WTF](https://blog.zsec.uk/mail-tech-spf-pt1.md) - Mail technologies(SPF, DKIM and DMARC) are important to understand from all sides. - [Focus RS 2016 - Some Light Aesthetic Car Hacking](https://blog.zsec.uk/focusrs-hacks.md) - Car hacking with Ford ForScan, adding SYNC3 changes and 5th Driving mode to 2016 Focus RS. - [So You Want to Learn [Red] Teaming?](https://blog.zsec.uk/redteam-intro.md) - Red Teaming is something that takes a bit of experience to actually nail, it's not something you expect to walk into after doing a four year uni course or something to pick up with little to no actual security experience. Want to learn more? I wrote a course all about it https://lms.zsec.red - [DNS - Setting the Record Straight](https://blog.zsec.uk/dns-deepdive.md) - The domain name systems, more commonly referred to as DNS is essentially a phone book of the Internet. Ler's take a deep dive into DNS. - [Bloodhound 2.2 - A Tool for Many Tradecrafts](https://blog.zsec.uk/bloodhound-101.md) - Bloodhound is a tool for enumeration of an active directory environment. It maps out relationships between active directory objects and is useful for Pentesting and Red Teaming. - [Surviving in the Ring: Expanding Your Horizons](https://blog.zsec.uk/book-2-ltr101.md) - Before We Dive in, thank you to each and every single person who has read, downloaded, purchased, shared and even copied my book! Following the success of my first book, it has been well received far and wide expanding the knowledge of individuals and allowing them to understand the basics of offen… - [Mental Health and Security](https://blog.zsec.uk/mental-health-and-security.md) - Mental health and mental wellbeing is very important and is often overlooked in the security industry. This post discusses the four most common issues and proposes some solutions. - [Leveraging Expression Language Injection (EL/OGNL Injection) for RCE](https://blog.zsec.uk/el-injection-rce.md) - Expression Language injection or EL Injection for short is an attack vector I'd never heard of until recently. This post talks about leveraging EL for RCE. - [NMAP Tips: RTFM?](https://blog.zsec.uk/nmap-rtfm.md) - NMAP TL;DR It's a tool used for portscanning and this post will explore some of the common and useful flags that can be used while scanning to pick up usful information about targets. What Is NMAP? Nmap or Network mapper is an open source tool for network discovery and security analysis. It is used… - [2019 Coming Up and ZSEC Blog 2018 in Review](https://blog.zsec.uk/2018-rewind-2019.md) - 2018 saw a lot of ups and downs for me both personally and professionally but I have learned a lot and put out a lot of blog posts(12 in fact!). - [My Journey Into Infosec](https://blog.zsec.uk/my-journey-into-infosec.md) - Something I've been asked a lot recently and in the past is how I got into this industry and what my tips are for new prospects? Well here is my story: Buckle Up I got into industry via a sort of standard and non-standard path, at school I fucked up all of my exams in my last year, ended up winging… - [Hawl! Gonny Gee Me a Puddy Up?!](https://blog.zsec.uk/gettingintoindustry.md) - How to actually get into the industry. An explaination on different topics to better aid you in getting in. Some hints and tricks from Andy Gill about his journey - [Taking a Step Back](https://blog.zsec.uk/astepback.md) - Not an overly verbose or detailed post, more a note or place marker to say I'll be taking a step back from writing and blogging for a few months. I need to take some time out from writing, researching and assisting to try and find myself(as cheesy or weird as it sounds). I just need a bit of breath… - [ZTH-CH3: Troubleshooting?](https://blog.zsec.uk/zth-ch3.md) - A skillset that many people look at when you work in IT or have some form of interest in technology is the ability to 'fix' things. - [ZTH-CH2: - Security For Everyone](https://blog.zsec.uk/zth-ch2.md) - I will explain the importance of using strong passwords, what multi-factor/two-factor authentication is and why it is important and also explain some more security tips. - [LTR101 - Facing Your Fears](https://blog.zsec.uk/ltr101-facing-your-fears.md) - Following a wee dry spell of blog posts here's my latest(a wee quickie). At the time of writing this blog I've since done three security conference talks in my life so far! For the duration of the year 2018, I set myself a few goals to overcome some of my fears. One of which is public speaking at s… - [ZTH-CH1: From Zero to Technical Hero](https://blog.zsec.uk/zth-ch1.md) - This post will take the very core basics and explain them in a series of analogies that are easier to understand if you're completely non-technical or have minimal know-how. I want to make information security and the technicalities more accessible to the masses. - [[Ongoing Project] Building the Dream Home Network](https://blog.zsec.uk/homenetmk2.md) - This is not uber leet hax0rs stuff, but it does serve as a somewhat tutorial on how I set up my new home network in my flat. - [LTR101 - Disposable Attack Containers (DAC)](https://blog.zsec.uk/ltr101-dac.md) - My take on using docker for disposable attack images, basically leveraging docker images for Bug Bounties & Pentesting. - [Open Redirect in Oracle EBS (CVE-2017-3528)](https://blog.zsec.uk/cve-2017-3528.md) - Writeup of my first CVE; An open redirect in Oracle E-Business Suite, patched in April 2017 CPU(CVE-2017-3528). - [It's Not All Hacking - Life [Escaping]](https://blog.zsec.uk/lifeescapes.md) - Working from home brings a lot of great things to the table, it allows you to make your home your workplace, gives you freedom. - [Delivering Many a Payload via CSRF](https://blog.zsec.uk/csrf-2018.md) - CSRF Is still an issue in 2018, with some interesting payload delivery methods. Chaining vulns and some more on CSV Injection too! - [Breaking out of Amazon Echo Show](https://blog.zsec.uk/echo-show-breakout.md) - Just a quickie, bought an Amazon Echo Show at the weekend because I wanted a new thing to play with and quickly found out how "locked" down it is. This is how to access a browser on the echo show, and can be used to view netflix on the echo show, other things & youtube. Breaking out * Step 1: Slide… - [XXE - Things Are Getting Out of Band](https://blog.zsec.uk/out-of-band-xxe-2.md) - XXE Out of Band testing, explaining how to execute XXE OOB attacks over HTTP & FTP. Additional explanation on XXE RCE. - [Leading the Blind to Light! - A Chain to RCE](https://blog.zsec.uk/rce-chain.md) - Tl;DR I found a misconfigured host & leveraged a few vulnerabilities to gain the final end goal of remote code execution! - [How to Pwn things over IPv6](https://blog.zsec.uk/ipv6-pwn.md) - IPv6 is the demon that many testers dare not touch very often as it is still not the norm or widely adopted. Don't get me wrong, it is available(it has been for a while now). And, many big and small companies are using it but it isn't what a lot of people are used to & for this reason, there's not… - [LTR101: My First CloudFront Domain Takeover/Hijack](https://blog.zsec.uk/subdomainhijack.md) - Update 2021/2022: This technique no longer works for Subdomain Hijacking as Amazon have patched it. The only way to hijack the subdomain is if you have control over DNS for the domain and that requires deeper compromise. Sub Domain Hijack Issue Hijack/takeover attacks can happen when a company crea… - [LTR101: Programming Fundamentals](https://blog.zsec.uk/ltr101_programming.md) - In security it can be very useful to understand programming, whilst you might not be able to code straight away it is very very useful to understand the core fundamentals. Throughout my blog, I am hoping to give you the basics to prepare you to start your journey in learning the different paths of… - [Impostor Syndrome: A Few Years In the Job](https://blog.zsec.uk/impostorsyndrome.md) - What is Imposter Syndrome? It is an Irrational Fear. I Have No Idea What I'm Doing... An actual definition of it:- Impostor syndrome (also known as impostor phenomenon or fraud syndrome or the fake experience) is basically the feeling of not belonging or the worry of being found out that you don't… - [Why Infosec Conferences are Awesome [DC, BSides, Steelcon, The Rest]](https://blog.zsec.uk/awesomecons2017.md) - Taking a quick step away from tutorials and write-ups, here is what was originally a blog about DEF CON 25 and all the things in-between. However, as I'm just back from BSidesManchester, and having also been to a few other conferences this year I decided to amalgamate all of the experiences of each… - [May the Shells be with You - A Star Wars RCE Adventure!](https://blog.zsec.uk/rce-starwars.md) - Intro Continuing the non-ltr101 [https://blog.zsec.uk/tag/ltr101/] posts for a second here is a quick write-up of a cool bug I found recently on a bounty program. It features Remote Code Execution via an abandoned web service. Enabling me to traverse the target internal network and gain access to s… - [Blind XXE - Hunting in the Dark](https://blog.zsec.uk/blind-xxe-learning.md) - Before getting into the post, this isn't anything brand new or leet in the area of XML External Entity (Blind XXE) attacks, it is purely something I came across and wanted to share. The tl;dr to start off is essentially: * Found an XXE bug that was blind meaning that no data or files were returned,… - [[Rant] Cancelling with Virgin Media](https://blog.zsec.uk/howtocancelvirginmedia.md) - I'm not one to rant very often however today is that day. Virgin Media. Literally one of the worst communications companies when it comes to communication. I have been in contract with them since December of last year and the speeds have been pretty crap in regards to stability. It is not st… - [[Tools Release] GoogD0rker & AttackDeploy](https://blog.zsec.uk/googd0rk-tool-attackdeploy.md) - This post serves as a quick description of two scripts I have written and published on my Github [https://github.com/ZephrFish]. It's not often that I take or even have the time to write things other than blog posts and reports it seems. However last week I saw two different problems that needed so… - [[Weekend Project] Monitoring Home Broadband](https://blog.zsec.uk/weekend-monitor.md) - Like many who live in the UK I get my home broadband from Virgin Media, again like many VM tend to under deliver as promised in terms of speed. Now, speeds delivered are advertised as "up to 200Mb", so you'd expect something in the region of at least 70% of this most of the time? Well this is where… - [LtR101: Selling Yourself & Hacking Your Career Path](https://blog.zsec.uk/ltr101-selling-yourself.md) - Having the technical skills are great, going to meet-ups and making the social contacts is even better. What really gets you in the door though? Knowing people? A CV? Being somewhat known? All valid points and questions, all worth looking into and all will get you somewhere. Things to Consider The… - [Bug Bounty Forum AMA (x-post from BBF)](https://blog.zsec.uk/ama.md) - Introduction What is your name, if you do not want to disclose your name, what is your handle/nickname? Where are you from? How long have you been hacking? How did you get started? What platforms or popular public programs have you hacked on? Hi folks, I’m Andy also known on the internet as @ZephrF… - [LtR101: Book Published](https://blog.zsec.uk/ltr101-published.md) - After almost 6 months, today is the day I finally finished & published: Breaking Into Information Security: Learning the Ropes 101. What does this mean exactly? Well more blog posts now as the book is out there! Got a few posts lined up made up of weekend projects I've been doing and some other thi… - [OSCP & OSWP - Two Achievements Unlocked](https://blog.zsec.uk/offsec-achievements-unlocked.md) - As with most people who sit Offensive Security's courses; Penetration Testing with Kali(PWK) [https://www.offensive-security.com/information-security-training/penetration-testing-training-kali-linux/] & Wifu [https://www.offensive-security.com/information-security-training/offensive-security-wirele… - [Ltr101: Markdown](https://blog.zsec.uk/ltr101-markdown101.md) - For a lot of bug bounty platforms, code repos and chat clients, Markdown is used as the notation to outline whatever you're writing up. However having read many reports on various platforms, it seems folks either are too lazy to use it or just don't know. Here's a quick 101 on how to do markdown! S… - [LtR101: Windows Terminal Environments](https://blog.zsec.uk/ltr101-windowsterm.md) - Windows is one of the most commonly used operating systems in the world, in comparison to Linux it is lesser used in security however still an OS of choice for many. The possibilities for usage are fairly large, the UI is usable and support of tools is varied however by default supports virtualisat… - [Learning the Ropes 101 - Virtualisation](https://blog.zsec.uk/ltr101-virtualisation.md) - This post talks of what virtualisation is, why it is important and how it works. I will also take you through setting up your first virtual machine (VM). What is Virtualisation Virtualisation put briefly is the process of creating a container of resources to run an operating system within the conte… - [Learning the Ropes 101: Burp Suite Intro](https://blog.zsec.uk/ltr101-burp-suite-intro.md) - Burp Suite Features & Usage In this post I will discuss the different features of burp suite, how to use them and how they are useful. I will also discuss how to set it up with different browsers and some advanced tips for the pro version. Also note that some of the tabs are only available in the p… - [Learning The Ropes 101: Note Taking & Session Tracking](https://blog.zsec.uk/ltr101-note-sessions.md) - One of the most important tasks to do alongside hacking & reporting is note taking and tracking your work. Why? you might ask, because you never know when a session is going to die or you might use a cool one-liner and want to go back to it. Keeping concise notes of what you are working on is very… - [LTR101: WebAppTesting - Methods to the Madness](https://blog.zsec.uk/ltr101-method-to-madness.md) - Following my post on Web Application Testing Methodologies [https://blog.zsec.uk/ltr101-methodologies/], I received a lot of feedback and requests to elaborate more on the methodology. As it is geared towards pentesters, some newbies might not understand what things are or what tools can be used to… - [LtR101: Web Application Testing Methodologies](https://blog.zsec.uk/ltr101-methodologies.md) - I get loads of messages on various mediums each week asking about how to get into information security & bug hunting. Queries range from how to do things through to how to get into the industry and where to start. I started this series for those people, learning and wanting to learn more about this… - [LtR101: Web Application Testing - Further Reading](https://blog.zsec.uk/101-web-testing-4.md) - Further Learning Resources Now you have a somewhat understanding of what web application testing is, how to setup your learning/playground environment & how to use some tools, you're likely wanting something to hack and play with? Well fortunately there are many many many resources out there for le… - [Web Application Testing - Tooling](https://blog.zsec.uk/101-web-testing-tooling.md) - Having given an introduction into web app testing [https://blog.zsec.uk/101-web-testing-1/] it is now time to move onto the tooling. Noting that this is for testing and not specifically bug bounty hunting. The tooling and techniques are slightly different. The art of web testing is made up of many… - [Web Application Testing(Learning the Ropes 101)- Introduction](https://blog.zsec.uk/101-web-testing-1.md) - To give some background, for those of you who do not already know I work as a pentester and my specialism is web application pentesting/penetration testing(also referred to some as appsec). I started this series to help individuals wanting to get into security & learn about the fundamentals require… - [gif it time it'll come to you - Finding More Holes in The Hub](https://blog.zsec.uk/gif-time-pornhub.md) - Following suit of stored cross site scripting vulnerabilities this post will talk about another issue I found in Pornhub. Unfortunately someone found before me and as a result this bug was a duplicate. However, this is my write-up of it and how it was possible, how it worked and the madness of it!… - [Persisting on Pornhub](https://blog.zsec.uk/persisting-pornhub.md) - This guy again? More Pornhub [https://hackerone.com/pornhub] bounty things? Well yeah, sort of. Recently I found a stored cross-site scripting vulnerability in Pornhub core(i.e pornhub.com). Allowing any user to post malicious links to their 'steam' aka profile. This post will explain how the attac… - [Learning the Ropes 101 - People Skills](https://blog.zsec.uk/101-people-skills.md) - For most of you reading this series you might have seen the first few technical articles then one about reporting, now you're seeing this about people skills. It's got you thinking now hasn't it? Why do I need to talk to people irl [https://en.wikipedia.org/wiki/Real_Life]? I WANT TO HACK THE PLANE… - [Learning the Ropes 101: Stay Beautiful, Stay Verbose](https://blog.zsec.uk/stay-beautiful-stay-verbose.md) - Having recently just arrived back from DEFCON 24 Las Vegas, I've not had a chance to write up much in regards to blogging and for that I am sorry! Anyway this post will discuss the importance of reporting and what it means to me to create a beautiful, reproducible and verbose report, this can be ap… - [CSV Injection -> Meterpreter on Pornhub](https://blog.zsec.uk/csvhub.md) - This post will discuss an issue I found regarding CSV injection on Pornhub.com, allowing a remote attacker to inject malicious code into video titles resulting in potential full compromise of content creators and other users. Note: Pornhub have advised that they will no longer be rewarding for this… - [CSV Injection Revisited - Making Things More Dangerous(and fun)](https://blog.zsec.uk/csv-dangers-mitigations.md) - In this post, I will discuss several methods and remediation steps that can be used to help escape and mitigate CSV [https://support.office.com/en-gb/article/Import-or-export-text-txt-or-csv-files-5250ac4c-663c-47ce-937b-339e391393ba] (Comma separated values) injection type attacks. For those of yo… - [Quick and Easy Server + Ghost Setup (Part 2 - Ghost Setup)](https://blog.zsec.uk/quick-server-p2.md) - Installing Ghost Assuming you've already read part 1 [https://blog.zsec.uk/quick-server-p1/]. Now that we have a somewhat setup server with required settings and the like, it's time to install ghost blog, for this here is a short all in one script for ease of setup, does it all in one: echo "" ####… - [Quick and Easy Basic Server + Ghost Setup (Part 1 - Server Setup)](https://blog.zsec.uk/quick-server-p1.md) - So, for some of you who follow my blog, you may have noticed it was down this weekend. This is due to me smartly attempting to update to installation of ghost but getting it wrong several times. As a result decided to flatten the server and spin up a new VPS, now all that is out of the way the blog… - [Learning the Ropes 101: Operating Systems - Linux](https://blog.zsec.uk/101-os-linux.md) - When learning about information security, software development, computer science or "insert other relevant topic here" it is likely that you will come up against a variety of different operating systems. Most new folks to this area will be primarily windows users and as a result will have had littl… - [Popping the Pornhub Cherry](https://blog.zsec.uk/pwning-pornhub.md) - Currently at time of writing I'm ranked #1 finder of Bugs on https://hackerone.com/pornhub which is a nice position to hold. This post is to explain the techniques I've used to get to where I am and how I found my most recent $2500 bug on pornhub. To update this post also this finding has now been… - [Learning the Ropes 101: Basic Networking](https://blog.zsec.uk/101-networking.md) - In regards to the technological skill set required in this sector, dialling it down to complete basics is where to start. It is very important to understand and get your head around basic networking before you start to look at anything else as networking is how the internet works. How Does the Inte… - [Learning the Ropes 101: Introduction](https://blog.zsec.uk/101-intro.md) - I recently had a friend of mine come to me asking how to get into hacking and this side of technology. His background was very varied so it was difficult to outline the core fundamentals that a person would need to get into this sector. This post will try to clear up and explain the resources and i… - [Install Kali Nethunter & FruityWiFi on Nexus 5](https://blog.zsec.uk/nethunterinstall.md) - Originally Written by Ben May [https://twitter.com/atarii] || Github [https://github.com/atarii] Here are the steps taken to install Kali nethunter and FruityWiFi on the Nexus 5. Reboot into fastboot: adb reboot bootloader Unlock bootloader with: fastboot oem unlock Download the 6.0.1 image - hamme… - [How to Statically Compile NMAP](https://blog.zsec.uk/staticnmap.md) - Here is a short explanation on how to compile nmap statically. Version of nmap used: https://nmap.org/dist/nmap-7.11.tar.bz2 Method First set up the environment (''-fPIC'' is needed, for static compilation): export CFLAGS="-march=core2 -O2 -fomit-frame-pointer -pipe -fPIC" export CXXFLAGS="-march=c… - [Setup Oracle in Kali Rolling & Kali 2.0](https://blog.zsec.uk/msforacle.md) - How to Setup Oracle in Kali 2.0 I recently have started preparation for an exam which requires the use of Kali for testing and noticed that out of the box Kali 2.0 Sana or rolling do not support oracle. So I set about to find out how to remediate this and fix. There are guides out there on how to f… - [Approaching Bug Bounties with an Ethical Mindset](https://blog.zsec.uk/bounties.md) - The term ‘Bug Bounty’ may be an unknown term to you, but for some it may spawn images of Star Wars bounty hunters; rest assured it has nothing to do with wet work or killing. The phrase was coined for the modern age, which sees companies having open invitations for anyone to try to find security fl… - [Getting Started in InfoSec](https://blog.zsec.uk/getting-started-in-infosec.md) - I’ve been meaning to create a write-up on how to get into the industry and certain resources to check out for different skill sets. So here it is, there are lots of different routes into Pentesting however there are two main things to keep in mind. Firstly who you know and second what you know, the… ## Optional - [RSS Feed](https://blog.zsec.uk/rss/) - [Sitemap](https://blog.zsec.uk/sitemap.xml) - [Full content of pages and posts](https://blog.zsec.uk/llms-full.txt)