parzival

i hack computers and play osrs

[eversinc33 🤍🔪⋆｡˚ ⋆ @eversinc33]

By popular demand (I actually got some DMs), heres the QSS: https://t.co/4ejgXWDjWu

[SpecterOps @SpecterOps]

Credential Guard was supposed to end credential dumping. It didn't.

@bytewreck just dropped a new blog post detailing techniques for extracting credentials on fully patched Windows 11 & Server 2025 with modern protections enabled.

Read for more ⤵️ https://t.co/mYPHg1mTKj

[André Baptista @0xacb]

Found an XSS but got blocked by the CSP?

https://t.co/0aA3GyIOVz has a compiled list of ways to bypass the Content-Security Policy. Check out the video below 👇

[Brave @brave]

The security vulnerability we found in Perplexity’s Comet browser this summer is not an isolated issue.

Indirect prompt injections are a systemic problem facing Comet and other AI-powered browsers.

Today we’re publishing details on more security vulnerabilities we uncovered.

[vx-underground @vxunderground]

https://t.co/YyFGIv4wnh

[parzival @FreeZeroDays]

@willowitcher puff

[parzival @FreeZeroDays]

@DoomsdayGoth AYYY! I hope you continue to get more shells too! 🐚🐚

[parzival @FreeZeroDays]

@willowitcher @Octopimp DUUUUUUDE?

[kmkz @kmkz_security]

Goexec is a new take on some of the methods used to gain remote execution on Windows devices. Goexec implements a number of largely unrealized execution methods and provides significant OPSEC improvements overall
https://t.co/djN3yL4FfY
Github repo:
https://t.co/me3WItpsIm

[UwU Underground @uwu_underground]

Red team Ye has entered the chat

[Orange Cyberdefense's SensePost Team @sensepost]

Attacks against AD CS are de rigueur these days, but sometimes a working attack doesn’t work somewhere else, and the inscrutable error messages are no help. Jacques replicated the most infuriating and explains what’s happening under the hood in this post https://t.co/eF5nhHfPuS

[JS0N Haddix @Jhaddix]

Great video with @xssdoctor and @ctbbpodcast on modern XSS chains.

Bounty programs should start rating XSS in classes by how many gadgets the hunter had to use. Higher payouts for more gadgets.

https://t.co/gnavPtFOWK

[TrustedSec @TrustedSec]

Are you interested in incorporating Large Language Models (LLMs) into app tests yet lack the tooling to get you there? In our new #blog, App Security Practice Lead Geoff Walton walks through how to start using effective #LLM attacks today. Read it now! https://t.co/7j1mODob8w

[parzival @FreeZeroDays]

@neonplaidpants hail the Queen

[RedTeam Pentesting @RedTeamPT]

The LLMNR response name spoofing pioneered by @tiraniddo and @Synacktiv does not seem to work with mDNS & NetBIOS 😢
But guess what! It works with DNS😯

🥳 Here's the new pretender release supporting Kerberos relaying via DHCPv6-DNS-Takeover: 🎉
https://t.co/2zhJlpBRvn

#infosec

[Wiz @wiz_io]

BREAKING: Internal #DeepSeek database publicly exposed 🚨

Wiz Research has discovered "DeepLeak" - a publicly accessible ClickHouse database belonging to DeepSeek, exposing highly sensitive information, including secret keys, plain-text chat messages, backend details, and logs.

[parzival @FreeZeroDays]

@willowitcher this is literally you and Puff

[parzival @FreeZeroDays]

@willowitcher edit rocks