😈 [ DirectoryRanger, DirectoryRanger ]

Good series on AD sec by @Bhaskarpal__
(1) https://t.co/LT3oD9bqDU
(2) https://t.co/CCkeWe3Nuy
(3) https://t.co/B4egj79cUg
(4) https://t.co/zN0GkXlZfS
(5) https://t.co/kgKlIxla0I

🔗 https://0xstarlight.github.io/posts/Active-Directory-Introduction/
🔗 https://0xstarlight.github.io/posts/Offensive-PowerShell/
🔗 https://0xstarlight.github.io/posts/Active-Directory-Local-Privilege-Escalation/
🔗 https://0xstarlight.github.io/posts/Active-Directory-Lateral-Movement/
🔗 https://0xstarlight.github.io/posts/Active-Directory-Domain-Persistence/

🐥 [ tweet ]

😈 [ ghostlulz1337, ghostlulz ]

Cool blog on abusing callback functions to execute shellcode. There are so many windows APIs that can be leveraged to execute your shellcode. Really cool stuff!

https://t.co/D1WJT80ehW

#redteam #infosec

🔗 http://ropgadget.com/posts/abusing_win_functions.html

🐥 [ tweet ]

😈 [ al3x_m3rcer, m3rcer ]

Here's the official release of Chisel-Strike: A .NET XOR encrypted Cobalt Strike Aggressor implementation for chisel to utilize faster proxy and advanced socks5 capabilities.

https://t.co/1wlwABP71E

#RedTeaming #CobaltStrike #Pentesting

🔗 https://github.com/m3rcer/Chisel-Strike

🐥 [ tweet ]

😈 [ C5pider, 5pider ]

Perform HTTP/s requests using WinHTTP and optional get response.
https://t.co/HAwhep2Pyv

🔗 https://gist.github.com/Cracked5pider/4f784ad7405eeda45a13a2b2638b85ec

🐥 [ tweet ]

😈 [ _dirkjan, Dirk-jan ]

New blog: "Abusing forgotten permissions on computer objects in Active Directory".
The post is a dive into permissions that are set when you pre-create computer accounts the wrong way, why BloodHound missed those and how to abuse, fix, or monitor for this. https://t.co/T8WmiIoL53

🔗 https://dirkjanm.io/abusing-forgotten-permissions-on-precreated-computer-objects-in-active-directory/

🐥 [ tweet ]

😈 [ m3g9tr0n, Spiros Fraganastasis ]

P2P Remote Desktop - Portable, No Configuration or Installation Needed https://t.co/taaggUyfC0

🔗 https://github.com/miroslavpejic85/p2p

🐥 [ tweet ]

😈 [ m3g9tr0n, Spiros Fraganastasis ]

tokenduplicator: can also be used to access disconnected sessions, without knowing the password of the victim user https://t.co/VMeIQdwMdg

🔗 https://github.com/magnusstubman/tokenduplicator

🐥 [ tweet ]

😈 [ M4yFly, Mayfly ]

GOAD pwning part4 - poison and relay
https://t.co/g4seCCWrif

🔗 https://mayfly277.github.io/posts/GOADv2-pwning-part4/

🐥 [ tweet ]

😈 [ mikeloss, l0ss ]

Hey kids, you ever wanted to use Snaffler or Group3r via inlineExecuteAssembly or whatever, but couldn't because it used Environment.Exit() and that would kill your beacon? Well, I fixed that, so now it's not a problem any more. https://t.co/Ts8WFVojcY and https://t.co/QePyTfNcbm

🔗 http://github.com/SnaffCon/Snaffler
🔗 http://github.com/Group3r/Group3r

🐥 [ tweet ]

😈 [ 0gtweet, Grzegorz Tworek ]

As a fan of non-obvious persistence mechanisms I had to try to collect (and categorize!) them all. It has just started, first 10 entries appeared, and more is coming each day.
I am happy to share it. Enjoy, contribute, use freely - https://t.co/PWb2ofSZjQ

🔗 https://persistence-info.github.io/

🐥 [ tweet ]

😈 [ SkelSec, SkelSec ]

YOU👏DON'T👏NEED👏A👏REDTEAM👏
The security consultants identified that the domain controller XXX uses an outdated Apache server running as “NT/SYSTEM” which uses the default “cgi-bin” folder to host the application logic. This folder was found to be writable by any domain user..

🐥 [ tweet ]

😈 [ podalirius_, Podalirius ]

Want to play around with @Microsoft #RPC? I'm releasing a few #tools that I use in my lab 👌

Today I'm releasing a tool that lists all open #SMB #pipes remotely in live mode. With this you can easily see which pipes will open when starting services. 🥳

https://t.co/PWNQFkGDag

🔗 https://github.com/p0dalirius/microsoft-rpc-fuzzing-tools

🐥 [ tweet ]

😈 [ mariuszbit, mgeeky | Mariusz Banach ]

- "... and then he said to sign my malware.exe with faked Microsoft cert to evade AVs/EDRs. Would you believe?"

(￣y▽￣)╭ Ohohoho.....

Sign-Artifact.ps1 - based on @mattifestation research & implementation shamelessly borrowed here:

https://t.co/6LAVgCrOVN

🔗 https://github.com/mgeeky/Penetration-Testing-Tools/tree/master/red-teaming/Self-Signed%20Threat

🐥 [ tweet ]

😈 [ an0n_r0, an0n ]

another episode of my Sliver C2 testing. off-the-shelf bypass techniques like the unhook-bof in the official Armory seems to be useful and performs well against some modern EDR/AV products. seems like it is less painful than with Cobalt Strike. :)

🐥 [ tweet ]

😈 [ harmj0y, Will Schroeder ]

After an awesome back and forth with @cnotin and @SteveSyfuhs on the effects of "TokenLeakDetectDelaySecs" and "Protected Users" for mitigating token theft, I've updated the Koh README to reflect this (and updated the post to point to the README as well) https://t.co/AGViEV0stq

🔗 https://github.com/GhostPack/Koh/blob/main/README.md#mitigations

🐥 [ tweet ]

😈 [ ptswarm, PT SWARM ]

💥 New attack! Our researcher Arseniy Sharoglazov discovered a PHP's Arbitrary Object Instantiation with no user-defined classes. It was turned to RCE!

Read the research: https://t.co/PJZHLRM8xq

🔗 https://swarm.ptsecurity.com/exploiting-arbitrary-object-instantiations/

🐥 [ tweet ]

😈 [ 404death, sailay(valen) ]

I just recently found out the way
XSS <a> tag without user action
<a/autofocus/onfocus=alert(0) href>valen</a>
<a/href="#"/autofocus/onfocus=alert`valen`>you don't need user action on a tag</a>

Tested on:
https://t.co/RkGdfpNWli
https://t.co/bPvMeBlba1

🔗 https://xss-game.appspot.com/level1/frame
🔗 http://testphp.vulnweb.com/search.php?test=query

🐥 [ tweet ]