blacklanternsecurity
@blacklanternsecurity Organization
Public Skills
command-injection
by blacklanternsecurity
Guide OS command injection exploitation during authorized penetration testing.
cors-misconfiguration
by blacklanternsecurity
Exploit CORS (Cross-Origin Resource Sharing) misconfigurations during authorized penetration testing.
ad-persistence
by blacklanternsecurity
Establishes persistent access in Active Directory environments after domain compromise. Covers DCShadow (rogue DC attribute modification), Skeleton Key (LSASS master password), custom SSP injection (credential logging via mimilib/memssp), security descriptor backdoors (WMI/WinRM/ DCOM/registry ACL modification), ADFS Golden SAML (DKM key extraction and forged SAML tokens), SID history persistence (DA SID in regular user), and certificate-based persistence (golden certificate, renewal, enrollment agent).
lfi
by blacklanternsecurity
Guide Local File Inclusion (LFI) and Remote File Inclusion (RFI) exploitation during authorized penetration testing.
container-escapes
by blacklanternsecurity
Container escape, Docker breakout, and Kubernetes exploitation.
smb-exploitation
by blacklanternsecurity
Exploit remote SMB vulnerabilities for unauthenticated code execution on Windows hosts.
windows-token-impersonation
by blacklanternsecurity
Exploit Windows token privileges for local privilege escalation to SYSTEM.
ajp-ghostcat
by blacklanternsecurity
Exploit Apache JServ Protocol (AJP) misconfigurations and Ghostcat (CVE-2020-1938) for file read and remote code execution on Apache Tomcat. Use when port 8009 is open or AJP connector is exposed.
windows-uac-bypass
by blacklanternsecurity
Bypass Windows User Account Control to escalate from medium to high integrity.
windows-service-dll-abuse
by blacklanternsecurity
Exploit Windows service misconfigurations and DLL hijacking for local privilege escalation.
ldap-injection
by blacklanternsecurity
Exploit LDAP injection vulnerabilities during authorized penetration testing.
kerberos-ticket-forging
by blacklanternsecurity
Forges Kerberos tickets for domain persistence and privilege escalation. Covers Golden Ticket (krbtgt hash → forged TGT), Silver Ticket (service hash → forged TGS), Diamond Ticket (decrypt/modify/re-encrypt legitimate TGT for stealth), Sapphire Ticket (U2U PAC swap), and Pass-the-Ticket injection.
deserialization-java
by blacklanternsecurity
Exploit Java deserialization vulnerabilities during authorized penetration testing.
windows-kernel-exploits
by blacklanternsecurity
Exploit Windows kernel vulnerabilities, vulnerable drivers, and privileged file operations for local privilege escalation to SYSTEM.
deserialization-dotnet
by blacklanternsecurity
Exploit .NET deserialization vulnerabilities during authorized penetration testing.
adcs-access-and-relay
by blacklanternsecurity
Exploits ADCS through ACL abuse on templates/CA objects and NTLM relay to enrollment endpoints. Covers ESC4 (template ACL → modify to ESC1), ESC5 (PKI object ACLs), ESC7 (ManageCA/ManageCertificates abuse), ESC8 (NTLM relay to HTTP enrollment), ESC11 (NTLM relay to ICPR RPC).
kerberos-roasting
by blacklanternsecurity
Extracts and cracks Kerberos service tickets (Kerberoasting) and AS-REP hashes (AS-REP Roasting) for offline password recovery.
idor
by blacklanternsecurity
Exploit Insecure Direct Object Reference (IDOR) and broken access control vulnerabilities during authorized penetration testing.
auth-coercion-relay
by blacklanternsecurity
Forces remote systems to authenticate back to attacker-controlled listeners and relays captured authentication to escalate privileges or move laterally. Covers authentication coercion (PetitPotam, PrinterBug, DFSCoerce, ShadowCoerce, CheeseOunce), NTLM relay (ntlmrelayx to LDAP/SMB/AD CS/MSSQL), Kerberos relay (krbrelayx, mitm6), and name resolution poisoning (LLMNR/NBNS/WPAD via Responder).
linux-kernel-exploits
by blacklanternsecurity
Exploit Linux kernel vulnerabilities and escape restricted shells for privilege escalation.
adcs-template-abuse
by blacklanternsecurity
Exploits misconfigured AD CS certificate templates to impersonate any domain user via SAN manipulation or enrollment agent abuse. Covers ESC1 (enrollee supplies subject), ESC2 (any-purpose/no EKU), ESC3 (enrollment agent), ESC6 (EDITF_ATTRIBUTESUBJECTALTNAME2 CA flag).
kerberos-delegation
by blacklanternsecurity
Exploits Kerberos delegation misconfigurations for privilege escalation and lateral movement in Active Directory. Covers Unconstrained Delegation (TGT harvesting via coercion), Constrained Delegation (S4U2Self + S4U2Proxy with SPN swapping), and Resource-Based Constrained Delegation (RBCD via writable machine accounts).
csrf
by blacklanternsecurity
Exploit Cross-Site Request Forgery (CSRF) vulnerabilities during authorized penetration testing.
linux-file-path-abuse
by blacklanternsecurity
Exploit writable critical files, NFS misconfigurations, shared library hijacking, and privileged group membership (docker, lxd, disk, adm, video, staff) for Linux privilege escalation. Use when a user belongs to a privileged group or has write access to sensitive files or paths.