@chriselgee Sorry I missed! I don't twitter anymore, I went to the other place 😅
'Ema' they are small wooden tablets that you put a name and prayer on and hang up at a shrine or temple, typically also has a horse depiction in lieu of an actual horse
🚨 Make sure you're checking @CISAgov GitHub repo to track software affected by the #OpenSSL 3.0.x vuln, as well as any IOCs related to exploitation activity. As you may still remember from 2014's #Heartbleed, timely discovery & remediation are critical
https://t.co/sVuw7lNljh
1\ #DFIR: Chrome Forensics - How to Recover CLEARED History
If a user just cleared their browser history, you can still recover everything they were just looking at from the session files:
%appdata%\Local\Google\Chrome\User Data\Default\Sessions
https://t.co/FaDbeJwhQC
We are excited to begin our planning for BSidesCharm 2023! We will be returning next spring for an awesome weekend of talks, villages, and job recruiting!
Set your calendars for the weekend of 29-30 April 2023.
More details to come!
https://t.co/YtWc4ddpk4
Take note and mark your calendars folks
To their credit, this is the first Crit in Openssl since 2016, that's a pretty good record given how many places it's used
30 cybersecurity search engines for researchers:
1. Dehashed—View leaked credentials.
2. SecurityTrails—Extensive DNS data.
3. DorkSearch—Really fast Google dorking.
4. ExploitDB—Archive of various exploits.
5. ZoomEye—Gather information about targets.
If 41 lines of code can bypass the authentication process on the administrative interface of FortiGate firewalls, FortiProxy web proxies, and FortiSwitch Manager (FSWM) on-premise management instances, then something is very wrong.
This is not acceptable @Fortinet
This will be a thread discussing a real world breach involving a drone delivered exploit system that occurred this summer
Some details I am not able to discuss, however for the blue teams & red teams out there I hope this provides a good measure of capability.
🧵🚁 🎮🖥️🦠
To celebrate my new #AADInternals blog, I also published an online OSINT tool at https://t.co/uHQ0tKteuU
It allows to get tenant information using:
* Tenant ID
* Domain name
* Email/UPN
The domain list includes links to ease the gathering of further information. Enjoy!
Fox-IT just open sourced their enterprise forensics tooling dissect. This is a big project that some of the smartest people I know have worked on. It supports many filesystems and file formats, all as Python libraries. Docs: https://t.co/M6YAygmW3E / code: https://t.co/HKT4eYIm1a
I don't know what to do with this knowledge, but today I learned that curl has a handler for LDAP URIs.
curl --user $CREDS "ldaps://ldap.foo.com/DC=ads,DC=foo,DC=com?memberOf?sub?(&(sAMAccountName=$USER)(memberOf=CN=$GROUP,OU=Distribution,OU=Groups,DC=ads,DC=foo,DC=com))"