WinGet can be more than a package manager. We show how .๐ ๐๐๐๐๐ configs + a self-referencing LNK become a viable initial access payload when Microsoft Store is enabled. Includes detection queries & mitigation tips.
blog.compass-security.com/2026/03/wing...
#RedTeam #Windows #LOLBins #InitialAccess
John Ostrowski (Compass Security) and Manuel Kiesel (Cyllective AG) worked together on CVE-2025-13154, a Lenovo Vantage LPE. Even after Microsoft closed a known primitive, collaboration led to a working PoC.
blog.compass-security.com/2026/02/from...
#Windows #CVE #SecurityResearch #PrivEsc
People know I am all crazy about electricity and electronics. So, I am specially excited about this one and I must admit I am very tempted to get hands on European chargers. Unfortunately, there is no vacation in sight yet ๐คช.
21.01.2026 06:40 โ ๐ 0 ๐ 0 ๐ฌ 0 ๐ 0โฆ. forgot to ask: Where can I get the nice screensaver for my Alpine infotainment? ๐
21.01.2026 06:35 โ ๐ 1 ๐ 0 ๐ฌ 0 ๐ 0Congratz for the nice find! I am very impressed and would love to see Alpine fix one or the other issue eventuallyโฆ sometimeโฆ any soon?
21.01.2026 06:33 โ ๐ 1 ๐ 0 ๐ฌ 0 ๐ 0
The schedule is out! ๐๏ธ Weโre hitting the stage on January 21st at 12:30 JST (4:30 CET) and at 14:00 JST (6:00 CET). Time to see if all the work in the lab pays off. Wish us luck! #Pwn2Own
www.zerodayinitiative.com/blog/2026/1/...
๐ค fingers crossed you guys get drawn for the pole position and get away without collisions.
๐จ๐ญ#BringEnHei
There will beโฆ Switzerland's highest max. bounty EVER
18.12.2025 12:59 โ ๐ 0 ๐ 0 ๐ฌ 0 ๐ 0
In a new video, Nicolรฒ @rationalpsyche.bsky.social walks through how to fuzz with AFL++, how to pick targets, avoid common pitfalls, and boost effectiveness. Find performance tips, fuzzing theory, and AFL++ internals.
Watch here: youtu.be/L5Tin7m5sbE?...
#security #fuzzing #AFLplusplus #appsec
NTLM relay works against HTTPS if channel binding is missing. Our new blog post explains why, shows how tooling evolved, and highlights defensive measures.
blog.compass-security.com/2025/11/ntlm...
๐งญ Navigation complete! The team from Compass Security just charted a course straight into @home_assistant Green at #Pwn2Own. They head off to the disclosure room to spill how they did it. #P2OIreland
21.10.2025 15:28 โ ๐ 5 ๐ 3 ๐ฌ 0 ๐ 0
#Pentest of gRPC-Web apps is tricky due to the binary format. We are releasing bRPC-Web, a @portswigger.net @burpsuite.bsky.social extension developed by our @muukong.bsky.social that helps manipulate #gRPC-Web traffic, even in absence of #protobuf schemas. blog.compass-security.com/2025/10/brpc...
21.10.2025 11:38 โ ๐ 7 ๐ 3 ๐ฌ 0 ๐ 0
@thezdi.bsky.social #Pwn2own schedule is out. Compass folks have been drawn 3rd to exploit the @home-assistant.io Green for $40,000. ๐คfor a #bounty today Tuesday Oct 21st, 5pm (Swiss time). #ethicalhacking
Schedule www.zerodayinitiative.com/blog/2025/20...
The final episode of our Kerberos deep dive is live!
RBCD opens new attack paths in Kerberos. Learn how misconfigs enable privilege escalation and how to defend.
youtu.be/l97RDnzdrXY?...
#Kerberos #ActiveDirectory
Episode 5 of our Kerberos deep dive is live. Constrained delegation isnโt bulletproof. See how attackers exploit it, and how to defend with monitoring & best practices.
youtu.be/rnhr02eKU0I?...
#Kerberos #ActiveDirectory
Episode 4 of our Kerberos deep dive is live. Unconstrained delegation can expose critical credentials. Learn how attackers abuse it. And how to lock down your systems.
youtu.be/_6FYZRTJQ-s?...
#Kerberos #ActiveDirectory
Episode 3 of our Kerberos deep dive is live. AS-REP Roasting abuses accounts without pre-auth. Learn the risks, how attackers exploit it, and how to defend.
youtu.be/56BjmyOTN5o?...
#Kerberos #ActiveDirectory
We use @jameskettle.com Burp extension Collaborator Everywhere daily. Now our upgrades are in v2: customizable payloads, storage, visibility. Perfect for OOB bugs like SSRF.
Find out more here: blog.compass-security.com/2025/09/coll...
#AppSec #BurpSuite #Pentesting
Episode 2 of our Kerberos deep dive is live.
Kerberoasting lets attackers steal AD service account credentials. See how it works and how to protect your systems: youtu.be/PhNspeJ0r-4?...
#Kerberos #ActiveDirectory
Kerberos powers auth in Windows and hides big security risks. Weโre launching a 6-part deep dive: from protocol basics to attacks plus how to stop them.
Starts today โ blog.compass-security.com/2025/09/tami... โ Subscribe to our channel!
#Kerberos #ActiveDirectory
Calling all bug hunters! schulNetz by Centerboard AG is now in scope! Help protect over 100k users in schools. Are you ready to make the grade and earn bounties? Program: bugbounty.compass-security.com/bug-bounties... #bugbounty #cybersecurity #ethicalhacking
01.09.2025 07:47 โ ๐ 3 ๐ 2 ๐ฌ 0 ๐ 0
Passwords are dead, long live passkeys! ๐
In our latest blog, we go hands-on: real-life setups, plus tips for recovery and avoiding pitfalls.
blog.compass-security.com/2025/08/into...
#Passkeys #CyberSecurity #Authentication
Burp collaborator just got a bunch a new features. Credits go to our @compass-security.com Basel team member, Andreas ๐
15.07.2025 06:29 โ ๐ 6 ๐ 1 ๐ฌ 0 ๐ 0
LLM-based vuln hunting just leveled up with xvulnhuntr - a fork of vulnhuntr with support for: C#, Java, Go. Read @rationalpsyche.bsky.social's blog post and go grab the project on GitHub.
blog.compass-security.com/2025/07/xvul...
Excited to talk today at @reconmtl.bsky.social with @droethlisberger.bsky.social about a 2017 iOS persistence exploit used by NSO's Pegasus (and, interestingly, other threat actors too)! 10:00AM in the Grand Salon cfp.recon.cx/recon-2025/t...
29.06.2025 13:45 โ ๐ 11 ๐ 5 ๐ฌ 0 ๐ 0
Exploiting the @ubiquiti.bsky.social AI Bullet camera for #Pwn2Own made us sweat more than once.
But persistence paid off. Our detailed blog post is now live: blog.compass-security.com/2025/06/pwn2...
#penetrationtest #pentest #iot #embedded #cybersecurity
www.compass-security.com/en/services/...
High-resolution photo of Compass Securityโs IoT and industrial penetration-testing workspace: on a light wooden workbench a large-lens, black surveillance camera sits half-disassembled beside its white Synologyยฎ housing, revealing the internal printed-circuit board, image sensor and ribbon connectors targeted during firmware extraction and vulnerability analysis. A chaotic web of multicolored diagnostic leads, Ethernet patch cables, alligator clips, UART/serial breakout wires and power adapters snakes across the table, illustrating real-world hardware hacking, fault-injection and secure-boot bypass techniques used in red-team assessments of networked CCTV, smart-factory and critical OT devices. The blue pentagonal TROOPERS25 shield logo occupies the upper-right corner, signalling that this lab scene supports Compass Securityโs conference presentation on Pwn2Own-grade research into surveillance-camera exploits, remote-code-execution vectors and zero-day discovery. The image underscores expert penetration-testing methodologyโthreat modeling, reverse engineering, embedded Linux analysis, secure-element probing and API fuzzing.
Thrilled for #TROOPERS25 Thursday! Emanuele & @yvesbieri.bsky.social share #Pwn2Own wins on #surveillance cams. Method, #exploit, lessons. Drop in, trade war-stories!
Talk: troopers.de/troopers25/t...
Compass pentest: www.compass-security.com/en/services/... #cybersecurity #iot #hw #fw #ot
Primate traits run deep at Teleboy smart, curious, and always evolving. If that sounds like you, challenge the boundaries of their infra and secure streaming, internet, and phone experience of 400'000+ users. #bugbounty #ethicalhacking #cybersecurity bugbounty.compass-security.com/bug-bounties...
02.06.2025 07:41 โ ๐ 2 ๐ 1 ๐ฌ 0 ๐ 0
Many CI/CD tools promise to keep your dependencies up to date - but if misconfigured, they can expose your organization. From token leaks to MR hijacks, Jan's latest blog post shows how bad configuration can turn a security tool into an attack vector. ๐ ๏ธ๐ฃ
blog.compass-security.com/2025/05/reno...
Tired of sifting through Entra ID manually? EntraFalcon is a PowerShell tool that flags risky objects configs & privileged role assignments with โก Scoring model ๐ HTML reports ๐ No Graph API consent hassle. Get it now: blog.compass-security.com/2025/04/intr...
#EntraID #IAM
