Talks

Hacks

Bug Bounty

Cyberrange

Reported 5 critical bugs

Ranked #2 in the 2024 Standoff Bug Bounty leaderboard

Standoff Bug Bounty (2023)

Reported 100 bugs

Initial Access

Valid Accounts

Default Accounts

Domain Accounts

Local Accounts

Cloud Accounts

Replication Through Removable Media

External Remote Services

Drive-by Compromise

Exploit Public-Facing Application

Supply Chain Compromise

Compromise Software Dependencies and Development Tools

Compromise Software Supply Chain

Compromise Hardware Supply Chain

Trusted Relationship

Hardware Additions

Phishing

Spearphishing Attachment

Spearphishing Link

Spearphishing via Service

Spearphishing Voice

Content Injection

Execution

Windows Management Instrumentation

Scheduled Task/Job

Cron

Scheduled Task

Systemd Timers

Container Orchestration Job

Command and Scripting Interpreter

PowerShell

AppleScript

Windows Command Shell

Unix Shell

Visual Basic

Python

JavaScript

Network Device CLI

Cloud API

Software Deployment Tools

Native API

Shared Modules

Exploitation for Client Execution

User Execution

Malicious Link

Malicious File

Malicious Image

Inter-Process Communication

Component Object Model

Dynamic Data Exchange

XPC Services

System Services

Launchctl

Service Execution

Container Administration Command

Deploy Container

Serverless Execution

Cloud Administration Command

Persistence

Boot or Logon Initialization Scripts

Logon Script (Windows)

Login Hook

Network Logon Script

RC Scripts

Startup Items

Account Manipulation

Additional Cloud Credentials

Additional Email Delegate Permissions

Additional Cloud Roles

SSH Authorized Keys

Device Registration

Additional Container Cluster Roles

Create Account

Local Account

Domain Account

Cloud Account

Office Application Startup

Office Template Macros

Office Test

Outlook Forms

Outlook Home Page

Outlook Rules

Add-ins

Browser Extensions

BITS Jobs

Traffic Signaling

Port Knocking

Socket Filters

Server Software Component

SQL Stored Procedures

Transport Agent

Web Shell

IIS Components

Terminal Services DLL

Implant Internal Image

Pre-OS Boot

System Firmware

Component Firmware

Bootkit

ROMMONkit

TFTP Boot

Create or Modify System Process

Launch Agent

Systemd Service

Windows Service

Launch Daemon

Event Triggered Execution

Change Default File Association

Screensaver

Windows Management Instrumentation Event Subscription

Unix Shell Configuration Modification

Trap

LC_LOAD_DYLIB Addition

Netsh Helper DLL

Accessibility Features

AppCert DLLs

AppInit DLLs

Application Shimming

Image File Execution Options Injection

PowerShell Profile

Emond

Component Object Model Hijacking

Installer Packages

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Authentication Package

Time Providers

Winlogon Helper DLL

Security Support Provider

Kernel Modules and Extensions

Re-opened Applications

LSASS Driver

Shortcut Modification

Port Monitors

Print Processors

XDG Autostart Entries

Active Setup

Login Items

Compromise Client Software Binary

Modify Authentication Process

Domain Controller Authentication

Password Filter DLL

Pluggable Authentication Modules

Network Device Authentication

Reversible Encryption

Multi-Factor Authentication

Hybrid Identity

Network Provider DLL

Hijack Execution Flow

DLL Search Order Hijacking

DLL Side-Loading

Dylib Hijacking

Executable Installer File Permissions Weakness

Dynamic Linker Hijacking

Path Interception by PATH Environment Variable

Path Interception by Search Order Hijacking

Path Interception by Unquoted Path

Services File Permissions Weakness

Services Registry Permissions Weakness

COR_PROFILER

KernelCallbackTable

Power Settings

Privilege Escalation

Process Injection

Dynamic-link Library Injection

Portable Executable Injection

Thread Execution Hijacking

Asynchronous Procedure Call

Thread Local Storage

Ptrace System Calls

Proc Memory

Extra Window Memory Injection

Process Hollowing

Process Doppelgänging

VDSO Hijacking

ListPlanting

Exploitation for Privilege Escalation

Access Token Manipulation

Token Impersonation/Theft

Create Process with Token

Make and Impersonate Token

Parent PID Spoofing

SID-History Injection

Domain Policy Modification

Group Policy Modification

Domain Trust Modification

Abuse Elevation Control Mechanism

Setuid and Setgid

Bypass User Account Control

Sudo and Sudo Caching

Elevated Execution with Prompt

Temporary Elevated Cloud Access

Escape to Host

brain