Top all-time · #5414
NetSPI
Company blog · blog.netspi.comsecurity
NetSPI is the company blog at blog.netspi.com, writing about security. Since 2015, 15 different Hacker News readers have linked it 18 times, most often “Stealing unencrypted SSH-agent keys from memory (2014)”. It is still writing: the last post was on 2026-10-26, and you can follow it by feed.
Too few sampled comments (5) to say how often HN recommends it.?
Why HN links it
HN readers link NetSPI posts as background references on mobile certificate pinning, extracting SSH keys from the Windows ssh-agent, and bypassing PowerShell execution policy.
Summarised by Claude from a sample of 5 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Explore the latest in vulnerability and testing from NetSPI's technical experts. Read our insights now!
Most-linked posts?
- Stealing unencrypted SSH-agent keys from memory (2014)2 people · 3 mentions · first linked 2018-12-11
- /15-ways-to-bypass-the-powershell-execution-policy/2 people · 2 mentions · first linked 2015-07-02
What Hacker News says?
HPKP is what the article you posted to is referring to, and probably will go away completely. However, profiling the public key of the site a mobile app connects to and erroring out if it is compromised to prevent MitM attacks is called 'certificate pinning' for mobile apps but is not related to the HPKP pinning of browsers. A reference for certificate pinning: https://blog.netspi.com/certificate-pinning-in-a-mobile…
Comment linking /certificate-pinning-in-a-mobile-application/
on “How Airlines don’t care about privacy: Case Study Emirates.com”Submitted Stealing unencrypted SSH-agent keys from memory (2014) as a story · 20 points
HN discussionUseful reading: https://blog.netspi.com/stealing-unencrypted-ssh-agent-keys-... https://blog.ropnop.com/extracting-ssh-private-keys-from-win...
Comment linking /stealing-unencrypted-ssh-agent-keys-from-memory/
on “Windows Server 2019 Includes OpenSSH”Submitted Decrypting WebLogic Passwords as a story · 16 points
HN discussionOriginally, Powershell did NOT have execution policy. And even in versions that do, it's also at the mercy of the invoking process, as I recall. Which is why he specifically said "powershell embeds without any security warning", I suspect. :| https://blog.netspi.com/15-ways-to-bypass-the-powershell-exe...
Comment linking /15-ways-to-bypass-the-powershell-execution-policy/
on “Microsoft Office – OLE Packager allows code execution in all Office versions”Submitted CVE-2020-17049: Kerberos Bronze Bit Attack as a story · 2 points
HN discussionIf it really needs that, https://blog.netspi.com/15-ways-to-bypass-the-powershell-exe...
Comment linking /15-ways-to-bypass-the-powershell-execution-policy/
on “The increased use of PowerShell in attacks [pdf]”Submitted Four Ways to Bypass Android SSL Verification and Certificate Pinning as a story · 2 points
HN discussionI would argue that the key element is extracting a useful key which appears to have been made possible by an earlier blog from another source (referenced by this blog entry): https://blog.netspi.com/stealing-unencrypted-ssh-agent-keys-...
Comment linking /stealing-unencrypted-ssh-agent-keys-from-memory/
on “Extracting SSH Private Keys From Windows 10 SSH-agent (2018)”Submitted Beyond LLMNR/NBNS Spoofing as a story · 2 points
HN discussionSubmitted Attacking SSO: Common SAML Vulnerabilities and Ways to Find Them as a story · 2 points
HN discussionSubmitted PowerUpSQL: A PowerShell Toolkit for Attacking SQL Server as a story · 2 points
HN discussionSubmitted Microsoft LAPS – Storing Cleartext Passwords in LDAP as a story · 2 points
HN discussionSubmitted Playing with Content-Type – XXE on JSON Endpoints as a story · 2 points
HN discussionSubmitted Dumping Git Data from Misconfigured Web Servers as a story · 2 points
HN discussionSubmitted Decrypting MSSQL Credential Passwords as a story · 2 points
HN discussionSubmitted Tokenvator: A Tool to Elevate Privilege Using Windows Tokens as a story · 1 points
HN discussionSubmitted iOS Tutorial – Dumping the Application Memory Part 2 as a story · 1 points
HN discussion
