Posts in "red-teaming" Category

Introduction In this post I show a simple method to detect Avast’s CyberCapture sandbox. We begin by examining the exports of snxhk.dll, the DLL Avast uses to install its user-mode hooks.

Introduction In this post, we’ll explore a technique to detect whether an executable is running inside Avast’s CyberCapture sandbox. By detecting the sandbox environment, a payload can alter its behavior to evade analysis and trick the antivirus into classifying the binary as ...

This post details a Linux-specific technique that abuses Chromium’s automatic download of non-renderable files to extract local browser profile databases (Cookies, Login Data, History, etc.) while remaining under the radar of most AV/EDR products.

This post details a cross-platform technique that abuses Chromium’s development protocol (CDP) to extract local browser profile databases (Cookies, Login Data, History, etc.) while remaining under the radar of most AV/EDR products. We launch a Chromium-based browser (Chrome, E...

This post details a Windows-specific technique that abuses Chromium’s automatic download of non-renderable files to extract local browser profile databases (Cookies, Login Data, History, etc.) while remaining under the radar of most AV/EDR products. We launch a Chromium-based ...

In the previous post we built the build.py script that orchestrates the build process of profile-stealer.

In the previous post we established the core architecture of profile-stealer: a set of interchangeable backends selected at build time so the final binary contains only the code we actually need.

Disclaimer: This series is published strictly for educational and research purposes. The author does not condone or encourage the use of any techniques described here for unauthorized access, data theft, or any other illegal activity. Using these methods against systems you do...

In this blog post, I will showcase a method for creating fake Windows 11 credential popups only using a Chromium browser and a basic TCP listener. Attackers can utilize this technique to phish credentials from compromised victim computers.

In this blog post, I’ll walk through post-compromise enumeration techniques to extract valuable information from verbose Chrome logs, including: Cloud Device ID and Device Management Token — which can be used to dump full Enterprise Chrome OS / Browser cloud policies Anti...