https://blog.blindsecurity.gr/ Recent content on Blind Security Hugo -- gohugo.io en Sat, 15 Aug 2026 00:00:00 +0000 https://blog.blindsecurity.gr/posts/azure-app-services-c2-network-filtering-evasion/ Sat, 16 Aug 2025 00:00:00 +0000 https://blog.blindsecurity.gr/posts/azure-app-services-c2-network-filtering-evasion/ Turning an Azure App Service into a reverse proxy and payload host to punch a C2 channel through egress filtering. https://blog.blindsecurity.gr/posts/hash-relaying-the-path-to-domain-admin/ Mon, 16 Jun 2025 00:00:00 +0000 https://blog.blindsecurity.gr/posts/hash-relaying-the-path-to-domain-admin/ Four NTLM relay scenarios from a real engagement, chaining SMB share access up to SYSTEM execution and Domain Admin. https://blog.blindsecurity.gr/writeups/bmdyy-tudo/ Fri, 16 Aug 2024 00:00:00 +0000 https://blog.blindsecurity.gr/writeups/bmdyy-tudo/ An OSWE-style source code review of the tudo web app, ending in a single all-in-one exploit script. https://blog.blindsecurity.gr/writeups/ssti-in-erpnext-12/ Tue, 02 Jan 2024 00:00:00 +0000 https://blog.blindsecurity.gr/writeups/ssti-in-erpnext-12/ Server-side template injection in ERPNext 12 leading to RCE. https://blog.blindsecurity.gr/writeups/atutor-account-take-over-using-type-juggling/ Mon, 01 Jan 2024 00:00:00 +0000 https://blog.blindsecurity.gr/writeups/atutor-account-take-over-using-type-juggling/ Abusing PHP loose comparison in ATutor’s password reset flow to take over an arbitrary account. https://blog.blindsecurity.gr/writeups/htb-clicker/ Sat, 16 Sep 2023 00:00:00 +0000 https://blog.blindsecurity.gr/writeups/htb-clicker/ Hack The Box: Clicker, from NFS share to root. https://blog.blindsecurity.gr/posts/dinvoke-process-hollowing-bypass-av-and-firewall/ Sat, 09 Sep 2023 00:00:00 +0000 https://blog.blindsecurity.gr/posts/dinvoke-process-hollowing-bypass-av-and-firewall/ Combining DInvoke with process hollowing to defeat both the AV and the interactive firewall of Avira Internet Security. https://blog.blindsecurity.gr/posts/bypass-interactive-firewalls-using-dll-injection/ Sat, 26 Aug 2023 00:00:00 +0000 https://blog.blindsecurity.gr/posts/bypass-interactive-firewalls-using-dll-injection/ Injecting into an already-trusted process so the interactive firewall never raises a prompt. https://blog.blindsecurity.gr/posts/process-hollowing-explained/ Tue, 01 Aug 2023 00:00:00 +0000 https://blog.blindsecurity.gr/posts/process-hollowing-explained/ A step-by-step walkthrough of how process hollowing actually works. https://blog.blindsecurity.gr/posts/dinvoke-two-stage-payload-and-rc4-in-meterpreter/ Sat, 29 Jul 2023 00:00:00 +0000 https://blog.blindsecurity.gr/posts/dinvoke-two-stage-payload-and-rc4-in-meterpreter/ A Python staging server plus a C# DInvoke dropper that pulls an RC4-encrypted second stage and lands an undetected session. https://blog.blindsecurity.gr/writeups/sync-breeze-enterprise-10-0-28-rop-chain/ Sun, 01 Jan 2023 00:00:00 +0000 https://blog.blindsecurity.gr/writeups/sync-breeze-enterprise-10-0-28-rop-chain/ Building a ROP chain for Sync Breeze that does not depend on hardcoded addresses, so it survives across Windows versions. https://blog.blindsecurity.gr/search/ Mon, 01 Jan 0001 00:00:00 +0000 https://blog.blindsecurity.gr/search/ search