Adrian Furtuna

Founder of Ethical hacker.

[spencer @techspence]

OWASP has released their Autonomous Penetration Testing Standard.

I have not read it yet. Anyone else look at this?

https://t.co/MewKPc1syG

[Adrian Furtuna @AdrianFurtuna]

0-click RCE in FuelCMS. Kudos to
@pentesttoolscom Offensive Security Reseach Team!
https://t.co/Ih0zBdq6Uf

[Wietze @Wietze]

🆕Recent additions to https://t.co/c2bs1AaVPZ:

• iscsicpl.exe for DLL exec+UAC bypass
• eudcedit.exe for UAC bypass
• reset.exe/change.exe/query.exe for proxy exec
• pixtool.exe/applauncher.exe/mpiexec.exe for dev tool proxy exec

⭐Nearly 8,000 GitHub stars - thank you all!

[Orange Tsai 🍊 @orange_8361]

Turns out my #PHRACK article is live! 🔥

> The Art of PHP — My CTF Journey and Untold Stories!

Kinda a love letter to those CTF players & PHP nerds! Hope all the credit goes to the right ppl. Also huge thanks to @0xdea for not forgetting me, @guitmz for the edits, and the @Phrack crew for keeping it real! 🎉

https://t.co/BMCLlHti7q

[Andy Piazza @klrgrz]

We’re excited to share how we do attribution within @Unit42_Intel and I’m extremely proud of the team for putting in the work behind the scenes to make this happen.

https://t.co/THLNcUnazI

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft’s Digital Crimes Unit (DCU) shares the insider story of the successful global takedown of Lumma Stealer—a stealthy, customizable malware that quietly infected nearly 400,000 Windows devices worldwide, stealing passwords and sensitive data. https://t.co/OvmXwgpLTG

[Florian Roth ⚡️ @cyb3rops]

In the past, you had to:
phish a user, drop malware, escalate privileges, pivot to servers, evade EDR, dump creds, move laterally, exfiltrate quietly, clean up, leave a backdoor.

Today, you just:
phish a user, steal an OAuth token, access everything from anywhere.

Cloud breaches aren’t hacks. They’re logins.

[JS0N Haddix @Jhaddix]

Introducing MSFTrecon -

MSFTRecon is a reconnaissance tool designed for red teamers and security professionals to map Microsoft 365 and Azure tenant infrastructure. It performs enumeration without requiring authentication, helping identify potential security misconfigurations and attack vectors.

https://t.co/LYXjnOGIoF

[PortSwigger Research @PortSwiggerRes]

The results are in! We're proud to announce the Top ten web hacking techniques of 2024! https://t.co/XHPEeqPQLR

[Binni Shah @binitamshah]

Exposed DeepSeek database leaking sensitive information, including chat history : https://t.co/RxOpwTOP9G credits @galnagli

[Will @BushidoToken]

🧵 My Key Takeaways from counter-ransomware activities in 2024 🔍

Read the blog for more details:
https://t.co/Fl9sQ3Rzu2
#cybercrime #ransomware #lockbit

[Pentest-Tools.com @pentesttoolscom]

👀 DefCamp 2024 felt like scanning a whole range of IPs - each moment unique, some wide open, others hidden, all worth exploring.
▶️ Hit play and dive into the moods we scanned at DefCamp - every bit as rich and powerful as the tools we create.

#ethicalhacking

[Stephen Sims @Steph3nSims]

The slides @alisaesage created for this past Saturday's @offby1security stream on fuzzing are now available. The link is in the video description here: https://t.co/tl77pinbdd

[JS0N Haddix @Jhaddix]

Lots of people are talking about the new tool "Lemma" by @defparam, but fewer are discussing why.

➡️ https://t.co/UPrk3J07RT

Lemma lets you "proxy" tools through Lambda, allowing you to distribute tool workloads. This enables you to:

1⃣ Bypass CDN WAFs via the Lambda IP ranges
2⃣ Distribute tool runs to make them faster by dividing wordlists and executing them in parallel

It's a ShadowClone substitute and also has a browser interface 🙀 Great for all offsec peeps; red team, bounty, pentest.

[Pentest-Tools.com @pentesttoolscom]

What's up with #RegreSSHion?

David, one of our security researchers, rounded up all the key details:

https://t.co/abU2XWVcj6

Plus, we've added detection for CVE-2024-6387 to our Network Scanner (see a sample finding in the next tweet):

[CVETrends @CVEShield]

Top 5 Trending CVEs:
1 - CVE-2024-5806
2 - CVE-2024-34102
3 - CVE-2024-23958
4 - CVE-2024-37032
5 - CVE-2024-21338

#cve #cvetrends #cveshield #cybersecurity
https://t.co/4Fua3CAN6W

[Pentest-Tools.com @pentesttoolscom]

Looking for a *highly accurate* web app scanner?

We're lifting the hood on our Website Scanner to show you:
💪why it's a powerful DAST tool
✅its 3 running options
🕷️available Spidering approaches
🎯how to scan behind login pages & lots more:

https://t.co/oeapCssAAc

[offensivecon @offensive_con]

#OffensiveCon24 videos are now up! https://t.co/y6Gh83WwNI

[James Kettle @albinowax]

XSS in PDF.js! I think this is going to cause some chaos both client-side and server-side... really nice finding by @CodeanIO
https://t.co/OytEvLGzVr

[Zero Day Engineering @zerodayalpha]

⚡️0-Day Insights: Google Chrome "actively exploited" bug chain on Viz & v8-wasm (May 2024) https://t.co/2Tsf1zBgXK (by @alisaesage)