Sandro Affentranger

Swiss Penetration Tester & Red Teamer, Password Cracker, Team HashMob

[solst/ICE of Astarte @IceSolst]

I "ported" @hashcat to the GBA, the ultimate password cracking rig ever (my dumbest project yet).

The monstrously powerful 16.78 MHz ARM7TDMI chip does an astronomical 727 SHA256 hashes per second!! which is about thirty million times slower than a modern cracking rig. 350 days of continuous cracking on this bad boy could be done in about 1 second with a modern GPU-accelerated cracking rig.

[Lakiw @[email protected] @lakiw]

Wrote up a new blog entry on improving the OMEN password cracking algorithm. The changes have also been included in the new version of the PCFG password cracking toolset. Link: https://t.co/eLdORRdoBQ

[hashcat @hashcat]

Team Hashcat took first place in the Jabbercracky contest at #DEFCON33! Thanks to HashMob for putting up a great fight and congrats on 2nd place! We're looking forward to your write-up! Huge thanks to Jabbercracky, @Stealthsploit, and @PasswordVillage for organizing!

[hashcat @hashcat]

hashcat v7.0.0 released!

After nearly 3 years of development and over 900,000 lines of code changed, this is easily the largest release we have ever had.

Detailed writeup is available here: https://t.co/fxAIXNXsEr

[Chick3nman 🐔 @Chick3nman512]

Complete @hashcat benchmarks on the @NVIDIAGeForce RTX 5090 FE! Running nice and cool so far with solid improvements across the board. Most hash modes got at least a 20% uplift over the RTX 4090 and some modes boasting quite a bit more!

Full Benchmark: https://t.co/aJ9zI1HjGM

[Sandro Affentranger @0xAF5A]

@MessageToBears Yes!

[Greg Linares (Laughing Mantis) @Laughing_Mantis]

Ever want to test systems & see if your password is ever stored/sent in plaintext?

Make it: X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

I am on the phone with a vendor right now because my test account is in an inoperable state.

🧐

[David Bisset @dimensionmedia]

Usage Share of Internet Browsers 1996 - 2019 (via @reddit https://t.co/D8MD1oQJuu)

[Project Zero Bugs @ProjectZeroBugs]

A very deep dive into iOS Exploit chains found in the wild https://t.co/7YxbxkKIOO

[Oneconsult AG @OneconsultAG]

Lesen Sie in unserer Serie zu Passwörtern, woraus Sie bei der Passwortvorgabe für ihre Mitarbeiter achten sollen und welches überraschende Resultat ein Password Quality Audit lieferte.
https://t.co/zbQERhHsV3

[Troy Hunt @troyhunt]

You know what I love about the infosec industry? Job security!

[m3ch @M3chSec]

@CharlesDardaman @TinkerSec Here is an initial benchmark on just NTLM.

[Oneconsult AG @OneconsultAG]

Oneconsult ist am 30. Oktober 2018 im Kursaal in Bern am SWISS CYBER STORM präsent.
Bis dann - an unserem Stand :-)
https://t.co/D3qB6Ll788

[Oneconsult AG @OneconsultAG]

https://t.co/xnn4dYrVo2
Die Gefahr durch Domänenadministrator-Konten wird oft unterschätzt. Artikel dazu von Marco Wohler, CISO bei Oneconsult

[Oneconsult AG @OneconsultAG]

Oneconsult's Pen Tester's Diary: "PowerShell II - Bösartiger Einsatz" ("Malicious use"), article in German: https://t.co/GmIflTaf2X

[Sandro Affentranger @0xAF5A]

@cyon Wie siehts mit der Unterstützung von CAA Records aus?

[Oneconsult AG @OneconsultAG]

Was das OSSTMM alles kann - https://t.co/2woYPtFYGC OSSTMM - Ihre Vorteile beim Verwenden eines De-Facto Standards für IT-Security Asses...

[Troy Hunt @troyhunt]

It's been a huge piece of work, but it's done: here's more than half a billion passwords for you to download for free and use to help protect your systems. Or use the online k-Anonymity API developed in conjunction with @Cloudflare. It rocks! https://t.co/QHW3msXyo7

[Jordan Eldredge @captbaritone]

Holy moly. You can write a key logger in pure CSS. I wonder if @reddit custom themes would be vulnerable. https://t.co/yfxrLLhOvT