news · 7 min
Markdown exfil moves out of the forum and into serious advisories. MSI Gaming leaks Intel Boot Guard signing keys. QueueJumper in MSMQ. Anthropic opens the Claude API. Meanwhile, Cl0p keeps adding victims.
· Manuel López Pérez
ai-security · 6 min
A chatbot that renders markdown turns any `` into an automatic GET to that URL. If an attacker can inject markdown via indirect prompt injection, they exfiltrate the entire context. Reproducible PoC.
· Manuel López Pérez
news · 4 min
Outlook NTLM zero-click patched after a year of APT28 exploitation, 3CX supply-chain compromise with Lazarus DLL sideloading, GPT-4 released and broken within 24 hours. March closes Q1 with two long stories.
· Manuel López Pérez
tutorials · 8 min
CVE-2023-23397 lets Outlook send the user NTLMv2 hash to an attacker SMB server just by processing an email. No click, no preview. Exploited as zero-day by APT28 since April 2022. Reproducible PoC with Outlook COM, Wireshark capture of the handshake and offline crack with hashcat.
· Manuel López Pérez
news · 5 min
Sydney leaked, Greshake formalises indirect prompt injection, Cl0p turns GoAnywhere into a global campaign, and ESXiArgs sweeps unpatched VMware ESXi. February opens two fronts at once.
· Manuel López Pérez
ai-security · 8 min
On 8 February Kevin Liu pulled the system prompt out of Bing Chat with an "ignore previous instructions". On 23 February Greshake published the paper that defines the next wave: instructions embedded inside the content the LLM reads.
· Manuel López Pérez
news · 6 min
BOLDMOVE on FortiOS attributed to a China-nexus actor, ALPC zero-day in Patch Tuesday, MFA seeds stolen from GoTo, NIS2 enters into force, and the first generation of ChatGPT jailbreaks. What moved in January, ranked by real impact.
· Manuel López Pérez
ai-security · 8 min
A prompt tells ChatGPT to play a character with no rules, and the model goes along with it. Why the role-play attack works, what changes between versions, and what it says about RLHF alignment.
· Manuel López Pérez
hackthebox · 5 min
Cascade write-up (HackTheBox): Windows media machine that exploits LDAP to enumerate users and hidden attributes, obtains VNC credentials from log, reverses .NET binary for AES key, and recovers admin password from deleted objects in Active Directory Recycle Bin.
· Manuel López Pérez
news · 1 min
Critical analysis of RustScan, the tool that promised to scan ports much faster than Nmap. Is it truly revolutionary or just an aggressive wrapper? Real comparison with advanced Nmap configurations that achieve more accurate and faster results.
· Manuel López Pérez
hackthebox · 4 min
First web challenge in the HackTheBox series completed. We learn how to bypass a hardcoded login in JavaScript, discover a secret area with a list of emails, and use Intruder (ZAP or Burp) to find the special address that reveals the flag.
· Manuel López Pérez
writeups · 5 min
Vault write-up (HackTheBox): average Linux machine that exploits file upload with filter bypass to obtain initial shell, pivots through OpenVPN and internal networks to escalate privileges and obtain root.
· Manuel López Pérez
