n00by73

IT/Security Audit || AppSec || Cloud || RT=public_bookmark

[Florian Roth ⚡️ @cyb3rops]

We’re seeing a clear trend: attackers are bypassing the endpoint entirely. Not just avoiding traditional EDR-monitored systems by pivoting to embedded and edge devices, but now also operating purely in the cloud. No shell, no malware, no persistence on the endpoint. Just an OAuth token and full access to whatever’s in the victim’s Microsoft 365, Google Workspace, or AWS console.

It’s a complete inversion of how things used to be. The endpoint, once the weakest link, is now usually the most monitored, most policy-enforced part of the infrastructure. You’ve got EDRs, SIEM integration, automation, threat hunting - the full stack. But attackers don’t need to touch it anymore.

Instead, they go after the new soft spots:

- Cloud platforms, where logging is limited, expensive, or off by default
- Network devices and appliances, which are practically blind spots - obscure OSes, no EDRs, hard to monitor, hard to forensicate.
- Embedded systems and IoT junk that no one really knows how to secure, but that sit in critical network paths.

Cloud especially is a mess:

- Logging tiers cost extra and the good stuff is behind paywalls.
- Detection content is lacking, both from vendors and the community.
- You don’t get memory dumps or full control like you do on endpoints.
- You’re at the mercy of the provider when it comes to visibility and response.

And that’s the shift: attackers aren’t hacking computers anymore. They’re hacking trust relationships, identities, and APIs. The whole idea of detection and response needs to evolve with that. Otherwise, we’re securing the hell out of endpoints while attackers happily fish through mailboxes and cloud shares from halfway across the planet.

[Bash Bunny @_BashBunny_]

Ok, as I promise this is the repo for the DarkWeb links, enjoy!

I'll try to update it as much as possible.

https://t.co/hL5giRFonD

[Hillai Ben-Sasson @hillai]

I hacked into a @Bing CMS that allowed me to alter search results and take over millions of @Office365 accounts.
How did I do it? Well, it all started with a simple click in @Azure… 👀
This is the story of #BingBang 🧵⬇️

[n00by73 @0luwanifemi]

@theadusamuel You are wicked o 😂

[n00by73 @0luwanifemi]

@kuppylee 🤣😂🤣😂🤣😂

[n00by73 @0luwanifemi]

@theadusamuel Niiiice

[/r/netsec @_r_netsec]

New OSCP Reporting Tool (SysReptor) https://t.co/9s5Uc3f1LW

[n00by73 @0luwanifemi]

😂

[Laura Wendel @Lauramaywendel]

nothing like the smell of fresh thread in the morning

[Fardeen A. 🇮🇳 🇵🇸 @insecrez]

Cloud security Penetration Testing practice labs :-

- https://t.co/gUOkt5A63O
- https://t.co/VI2AuUVy5G
- https://t.co/FFjg4noSLZ
- https://t.co/ff6yCDshG7
- https://t.co/u5UQZpJqV3
- https://t.co/h0t7B5fCzG

#BugBounty #bugbountytips #CyberSecurity #CyberSec #Tweets #Security

[Pastor William F. Kumuyi @pastorwf_kumuyi]

Your dream is Valid!
The Lord God will make it happen in due season.

[Abhishek Meena 🏵️ @aacle_]

Practice Active Directory Attacks 👍
#bugbounty #oscp #infosec

☑ Tryhackme Rooms : 👇

[Nicolas Krassas @Dinosn]

A PoC that packages payloads into output containers to evade Mark-of-the-Web flag & demonstrate risks associated with container file formats. Supports: ZIP, 7zip, PDF, ISO, IMG, CAB, VHD, VHDX

https://t.co/bRQmNW2M1Z

[Omoiyanu || E.C.N @Akosua_nwen]

We triumph!

[COVEY @COVENANTOLAYIN1]

I am officially a graduate from the University of Ibadan. BSc in Industrial and Production Engineering.

I welcome myself to the 'real world' phase 🚀

[Nicolas Krassas @Dinosn]

squarephish: advanced phishing tool https://t.co/FwEacotX4E

[Daniel Kelley @danielmakelley]

30 cybersecurity search engines for researchers:

1. Dehashed—View leaked credentials.
2. SecurityTrails—Extensive DNS data.
3. DorkSearch—Really fast Google dorking.
4. ExploitDB—Archive of various exploits.
5. ZoomEye—Gather information about targets.

[Md Ismail Šojal 🕷️ @0x0SojalSec]

I finally got ffuf to output to a text file in a decent way for automation:

ffuf -w /tmp/wordlists.txt -u URL/FUZZ -r -ac -v &>> /tmp/output.txt ; sed -i 's/\:\: Progress.*Errors.*\:\://g' /tmp/output.txt ; sed -i 's/\x1B\[[0-9;]\{1,\}[A-Za-z]//g' /tmp/output.txt
#bugbountytips

[n00by73 @0luwanifemi]

@thecoderchef If I speak I’m in trouble 😅

[Nicolas Krassas @Dinosn]

AWS Enumeration – Part I (Where to start, Approaches and Tools) https://t.co/3fXHX8AXBE

[Ansh Bhawnani @techhacker98]

Test your shell scripting skills:
https://t.co/OYPlpYEyi6

#programming #computers #cybersecuritytips #infosec