Attack Security

Are you ready for an Attack? We are security professionals specializing in penetration testing, cybersecurity assessments, and social engineering training.

[Nicolas Krassas @Dinosn]

Unpatched NTLM Leakage in Windows search: URI Handler, Same Bug, No CVE, No Fix https://t.co/16QmKjbFHH

[Attack Security @AttkSec]

Useful to have in the toolkit.

[Nicolas Krassas @Dinosn]

Offensive security toolkit for Claude Code covering red team, exploit dev, AD attacks, EDR bypass, mobile pentest https://t.co/BkwoSBEFew

[Bert-Jan 🛡️ @BertJanCyber]

Just noticed this change in the @MITREattack Enterprise Matrix V19. Defense Evasion has been split into the tactics Stealth and Defense Impairment.

https://t.co/o47n7dy6er

[Co11ateral @co11ateral]

Gaining Initial Access and Outsmarting SmartScreen

.zip email attachment that includes a VHDX (Hard Disk Image File) + Mark of the Web and SmartScreen bypass using Trusted Executable Reputation and DLL Sideloading

https://t.co/xuqCpxjWkA

#dfir #blueteam #redteam #pentesting #ThreatHunting

[Logisek @logisekict]

If you’re doing #cloud #security penetration testing and Azure is in scope, AZexec should already be in your toolkit!

AZexec brings a NetExec-style workflow to Azure & Entra ID, finally giving cloud pentesters the same speed, clarity, and offensive ergonomics we’re used to on-prem.

What makes it a must-have:

- Unauthenticated & guest-based enumeration (yes, the Azure “null session” problem is very real)
- Two-phase password spraying using Microsoft’s own APIs (stealthy, lockout-safe, MFA-aware)
- Deep Entra ID & ARM reconnaissance: users, roles, apps, Key Vaults, storage, networks, VMs
- Remote command execution across Azure VMs, Arc, MDE, and Intune
- Credential extraction & token abuse tailored for cloud-native environments
- NetExec-style output + reporting (CSV / JSON / HTML) for clean ops and clean reports

If you know CrackMapExec / NetExec, AZexec will feel instantly familiar, just adapted for how Azure actually works.

Cloud attacks deserve cloud-native tooling.

🔗 GitHub: https://t.co/pn75EvMlKO

#CloudSecurity #Azure #EntraID #Pentesting #RedTeam #OffensiveSecurity #AzureAD #NetExec #AZexec #Logisek

[Graham Helton (too much for zblock) @GrahamHelton3]

Excited to disclose my research allowing RCE in Kubernetes

It allows running arbitrary commands in EVERY pod in a cluster using a commonly granted "read only" RBAC permission. This is not logged and and allows for trivial Pod breakout.

Unfortunately, this will NOT be patched.

[Attack Security @AttkSec]

Impressive work from team at @burpsuite

[Burp Suite @Burp_Suite]

Burp AI 👉 SQLmap… all in seconds.

We found an SQL injection vulnerability. Instead of rebuilding the request, Burp AI generated the exact SQLmap command with every header included. 🤯

Watch!

[Burp Suite @Burp_Suite]

3 words 👉 Reduce false positives. 😌

Burp AI can automatically audit broken access control vulnerabilities to reduce false positives.

[Burp Suite @Burp_Suite]

24 million websites compromised. 🧵

PortSwigger's Director of Research, James Kettle (@albinowax), & AppSec expert John Hammond (@_JohnHammond) reveal the fatal flaws in HTTP/1.1 that attackers are abusing right now.

#HTTP1MustDie

[Attack Security @AttkSec]

Need to keep under the radar:

[Daily CyberSecurity @the_yellow_fall]

NativeDump: Stealthy LSASS Dumping Tool Bypasses EDRs Using Only NTAPIs
NativeDump allows to dump the lsass process using only NTAPIs generating a Minidump file with only the streams needed to be parsed by tools like Mimikatz or Pypykatz.

https://t.co/jpyuUScCuD

[Daily CyberSecurity @the_yellow_fall]

RemoteMonologue is a new Windows technique that uses DCOM to coerce NTLM authentications, enabling remote credential harvesting and privilege escalation for attackers.

#RemoteMonologue #CredentialHarvesting #WindowsSecurity #NTLM #Cybersecurity
https://t.co/6NG6PZZzJl

[d4d @zakfedotkin]

Active Scan++ just got sharper - we’ve added new checks for OS command injection, powered by our latest ASCII Control Characters research. Install via Extensions -> BApp Store

[Kuba Gretzky @mrgretzky]

‼️ Evilginx Pro 4.1 - Google Safe Browsing evasion 🛡️

I've just uploaded a short demo video demonstrating how Evilginx Pro is able to evade Enhanced protection in Google Chrome browser.

The update is coming soon!

🔗 https://t.co/WtJb00SBrS

[Attack Security @AttkSec]

Need another route to Active Directory? Check out SharpADWS, it has the ability to extract or modify Active Directory data without communicating directly with the LDAP server.

https://t.co/rDMekwfOse

[Smukx.E @5mukx]

Building a custom Mimikatz binary by @ShitSecure

https://t.co/KYWoIkHr1k

[Attack Security @AttkSec]

Source details: https://t.co/3Gld602uLp

[Nicolas Krassas @Dinosn]

Privilege Escalation in Active Directory Domain Services: CVE-2025-21293 Exploit Revealed with PoC Code https://t.co/Pa6sgy5j0N

[Attack Security @AttkSec]

Need some cleartext password from TGT or NTLM hash? Always useful on internal penetration testing. Nice work @malcrove their blog post - https://t.co/vZuN0aw0Tb

[Nicolas Krassas @Dinosn]

SeamlessPass: Leveraging Kerberos tickets to get Microsoft 365 access tokens https://t.co/XItPFoSzuL

[Attack Security @AttkSec]

Always useful to have a few tricks like this #betterpentesting #attacksecurity

[Daily CyberSecurity @the_yellow_fall]

Weaponizing Windows Defender: New Attack Bypasses EDR

Krueger is a Proof of Concept .NET post-exploitation tool for remotely killing Endpoint Detection and Response (EDR)
https://t.co/T5km9tFFx7

[0xor0ne @0xor0ne]

Great series on Linux privilege escalations

https://t.co/LGcq4cNFwm

Credits @tbhaxor

#infosec #Linux

[Yehuda Smirnov @yudasm_]

Excited to share a tool I've been working on - ShadowHound.
ShadowHound is a PowerShell alternative to SharpHound for Active Directory enumeration, using native PowerShell or ADModule (ADWS). As a bonus I also talk about some MDI detections and how to avoid them