CDP-Enable-BOF: Post-Exploitation Tool for CDP Activation
CDP-Enable-BOF is a Beacon Object File (BOF) developed by SpecterOps that activates the Chrome DevTools Protocol inside an already running Chrome or…
Tag: post-exploitation
CDP-Toolkit: Browser Interaction Suite
CDP-Toolkit is a tool by SpecterOps that interacts with browsers via the Chrome DevTools Protocol. It supports cookie collection, browser data extraction,…
Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers
Cybersecurity researchers at SpecterOps have detailed a post-exploitation technique that enables the Chrome DevTools Protocol (CDP) inside a running Google Chrome or…
SpecterOps: Adversary-Focused Security Research
SpecterOps is a security company that conducted research on a post-exploitation technique enabling Chrome DevTools Protocol activation inside running Chrome or Edge…
Attackers Compile khunt Inside Oracle to Turn SQL Injection Into Windows SYSTEM Access
Attackers breached an organization's Oracle database via a SQL injection flaw in a public-facing web application, then installed a post-exploitation toolkit named…
khunt: Oracle Post-Exploitation Toolkit
khunt is a post-exploitation toolkit that runs inside Oracle databases by compiling Java source code into stored schema objects. It enables command…
Hacker Deploys Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry
An attacker installed the open-source Hermes AI assistant on a rented server, disabled its permission-requesting YOLO mode, and directed it at Thailand's…
Suo5: Open-Source HTTP Proxy Used in Post-Exploitation
Suo5 is an open-source HTTP proxy tool used by attackers to establish covert communication channels after exploiting SonicWall SMA 1000 vulnerabilities. It…
XEOX: Remote Monitoring and Management Tool Used for Persistence
XEOX is a remote monitoring and management (RMM) tool deployed by phishing operators for persistence on compromised systems, often installed at C:Program…
GraphSpy: Post-Exploitation Tool for Microsoft 365 and Entra
GraphSpy is a tool used for post-exploitation of Microsoft 365 and Entra environments, often integrated into PhaaS platforms like DEBULL. It enables…