InSnowflake Builders Blog: Data Engineers, App Developers, AI, & Data SciencebyJustin Bui·Feb 14, 2024MacOS CI/CD with TartHow Snowflake’s Red Team uses Tart and AWS EC2 for macOS CI/CD and development
Justin Bui·Jul 16, 2023Debugging Cookie Dumping Failures with Chromium’s Remote DebuggerChromium updated and broke our ability to dump cookies using the remote debugger?A response icon1A response icon1
Justin Bui·Apr 12, 2022Understanding and Defending Against Reflective Code Loading on macOSThis blogpost will describe the concept of loading executables in-memory on macOS and how to detect it.A response icon1A response icon1
Justin Bui·Mar 8, 2022Extended Attributes and TCC on macOSThis blogpost will describe how Transparency, Consent, and Control (TCC) affects extended attributes on macOS
Justin Bui·Dec 1, 2021Where in the World is Carmen Sandiego: Abusing Location Services on macOSA dive into macOS, TCC, and Location ServicesA response icon2A response icon2
InPosts By SpecterOps Team MembersbyJustin Bui·Dec 17, 2020Hands in the Cookie Jar: Dumping Cookies with Chromium’s Remote Debugger PortA dive into stealing Chromium cookies with a remote debugger portA response icon1A response icon1
InPosts By SpecterOps Team MembersbyJustin Bui·Jun 30, 2020Automating DLL Hijack DiscoveryA dive into Windows DLLs, DLL hijacking, automation, WinAPI, and finding the root cause of shared DLL hijacks.A response icon2A response icon2
InPosts By SpecterOps Team MembersbyJustin Bui·Oct 1, 2019Understanding and Defending Against Access Token Theft: Finding Alternatives to winlogon.exeA dive into Windows processes, access tokens, SACLs, WinAPI and access token manipulation.
InPosts By SpecterOps Team MembersbyJustin Bui·Apr 16, 2019Revisiting TTPs: TimeStomperIn this post, I will cover how to manipulate file times on the Windows OS with a proof-of-concept tool and show examples of detection.
