In this blog, Raeez Abdullah our malware analyst talks about and demonstrate how 'pass-the-hash' attack works. 'pass-the-hash' attacks typically exploit the auth protocols and obtain hashes by scraping a system’s active memory. This technique allows attacker to laterally move in the network and gain access to more passwords and password hashes.

Web and Mobile application penetration testing is an interesting area to ponder. In spite of many tools, techniques and approaches around; there are few fundamental things we look in to in our penetration testing engagements, which are outlined here.