Open in app
Sign inGet started
NOC NOC. Who’s there? Your NMS is pwned.

NOC NOC. Who’s there? Your NMS is pwned.

By xerubus
Go to the profile of TSS
TSS
Penetration testing & window.opener — XSS vectors part 2

Penetration testing & window.opener — XSS vectors part 2

tldr; opener.location.* and the onhashchange event are XSS vectors. XSS exists in old versions of reveal.js.
Go to the profile of Josh Graham
Josh Graham
CTF Writeup — You Shall Not Pass

CTF Writeup — You Shall Not Pass

BSides Canberra 2019 — Reverse Engineering
Go to the profile of Tom
Tom
Under Cover of Darkness

Under Cover of Darkness

Practical considerations for (legally) breaking and entering.
Go to the profile of Tom
Tom
BloodHound.xpab — Applocker bypass

BloodHound.xpab — Applocker bypass

A few weeks ago I created a proof of concept XAML browser application (XBAP) that demonstrates Presentationhost.exe bypassing default…
Go to the profile of Josh Graham
Josh Graham
Cyberlympics 2018 — Finals

Cyberlympics 2018 — Finals

Wherein the team travels to Atlanta to open a padlock without touching it.
Go to the profile of Tom
Tom
Multiple Security Vulnerabilities in Dell EMC Avamar

Multiple Security Vulnerabilities in Dell EMC Avamar

In this post I’ll cover four different CVEs identified by myself and a colleague from TSS.
Go to the profile of Jarrod Farncomb
Jarrod Farncomb
Penetration testing & window.opener — XSS vectors part 1

Penetration testing & window.opener — XSS vectors part 1

This is the first part of a four part series discussing security concepts related to the JavaScript opener variable (almost all the…
Go to the profile of Josh Graham
Josh Graham
Cyberlympics 2018 — DNS covert channel

Cyberlympics 2018 — DNS covert channel

I was fortunate enough to participate in the Cyberlympics this year with the TSS CTF team. There was some tough competition and after…
Go to the profile of Josh Graham
Josh Graham
XSS in Dynamics 365

XSS in Dynamics 365

I recently tested an application hosted within Microsoft’s Dynamics 365 online services platform. During the test I discovered a…
Go to the profile of Tim Kent
Tim Kent
AppLocker Bypass — presentationhost.exe

AppLocker Bypass — presentationhost.exe

Presentationhost.exe appears on several AppLocker whitelist bypass lists (e.g. api0cradl and milkdevil) but I wasn’t able to find any good…
Go to the profile of Josh Graham
Josh Graham
Pentesting and .hta (bypassing PowerShell Constrained Language Mode)

Pentesting and .hta (bypassing PowerShell Constrained Language Mode)

When I’m on an engagement and I’m given a SOE and a domain account, I usually want to use a tool like PowerShell Empire to remotely…
Go to the profile of Josh Graham
Josh Graham
BlueHat 2018 CTF

BlueHat 2018 CTF

I had the chance to play Jonathan Bar Or’s BlueHat CTF this year. Because I didn’t know anyone, I asked to be allocated to a random team…
Go to the profile of Josh Graham
Josh Graham
Cyberlympics 2018

Cyberlympics 2018

Earlier in August, the remaining TSS team members who weren’t representing in Vegas for DEF CON competed in the Global Cyberlympics 2018…
Go to the profile of Jeremy Goldstein
Jeremy Goldstein
DEF CON 2018

DEF CON 2018

TSS will be representing in the Las Vegas area for #HackerSummerCamp this year, with a few of our team members speaking at the various…
Go to the profile of Glenn 'devalias' Grant
Glenn 'devalias' Grant
Adversary Mindset

Adversary Mindset

TSS' Inaugural Red Team Training
Go to the profile of Tom
Tom

The “billion silent laughs” attack — That time Incapsula was vulnerable to a DoS attack

By Joshua Graham (@JPG1nc)
Go to the profile of TSS
TSS
Ruxcon 11 [Pwnable 2] Write Up

Ruxcon 11 [Pwnable 2] Write Up

By Tom Ravenscroft- Small batch artisanal hax0r and security specialist
Go to the profile of TSS
TSS

Atlassian Confluence: Cross-Site Scripting (XSS) (CVE-2017–16856)

Earlier this year I spent some time delving into Atlassian Confluence to see if I could dig up any bugs that had slipped through the…
Go to the profile of Glenn 'devalias' Grant
Glenn 'devalias' Grant
About TSS - Trusted Security ServicesLatest StoriesArchiveAbout MediumTermsPrivacyTeams