This document summarizes a presentation about abusing symbolic links on Windows. It discusses how symbolic links are implemented for object manager objects, registry keys, and NTFS files. It outlines different classes of vulnerabilities like resource overwrite, information disclosure, and time-of-check/time-of-use issues. Examples are given of vulnerabilities in Internet Explorer and the Windows Task Scheduler. Exploitation techniques like using object manager symlinks, mount points, and OPLO...| Slideshare
ShadowMove (original paper by researchers Amirreza Niakanlahiji, Jinpeng Wei, Md Rabbi Alam, Qingyang Wang and Bei-Tseng Chu, go check it for full details) is a lateral movement technique that works by stealing (duplicating) an existing socket connected to a remote host, from a running process on a system an adversary has compromised.| www.ired.team
An insufficient certificate validation issue in the Palo Alto Networks GlobalProtect app enables attackers to connect the GlobalProtect app to arbitrary servers. This can enable a local non-administra...| security.paloaltonetworks.com
Reverse engineering VPN client software to hijack session cookies.| Medium