HTTP418

Breaking stuff and writing about it

[HTTP418 @HTTP418InfoSec]

For the last few weeks I’ve been trying to build a usable AI Vishing model as cheaply as possible, hopefully my post may help others who are considering doing something similar!

https://t.co/0oGPNq1DNV

[HTTP418 @HTTP418InfoSec]

Some thoughts on how to test against Scattered Spider TTPs and a quick summary on the current available TI. https://t.co/QiEFkh6N8W

[HTTP418 @HTTP418InfoSec]

@theluemmel @pfiatde @lampnout There’s PowerBi as well..

[Chris Thompson @_Mayyhem]

I wrote a script to identify every TAKEOVER and ELEVATE attack in Misconfiguration Manager that can be run with Read-only Analyst privileges or higher in SCCM. Please share with your IT admins, defenders, clients, assessors, and friends in infosec!
https://t.co/lHoC8Q8eH9

[Cybersecurity and Infrastructure Security Agency @CISAgov]

Today the Cyber Safety Review Board released its independent review of the Summer 2023 Microsoft Exchange Online intrusion laying out what led to the intrusion & what industry & gov't can do to ensure an intrusion at this magnitude does not happen again. https://t.co/pf5Vx2kuuo

[Justin Elze @HackingLZ]

Amazon is the new source for OST 🔥🔥

[HTTP418 @HTTP418InfoSec]

The GoPhish API can be used for some fun and games, my latest post shows how single use phishing links can be made using GoPhish + AWS SES! https://t.co/dajTw2cT66

[s1zz @s1zzzz]

MachineAccountQuota = 0, preventing you from grabbing NAA creds remotely?

DPAPI to the rescue!

Ported over NAA Extraction via DPAPI to sccmhunter.

h/t: @agsolino & @clavoillotte for https://t.co/uLXWJvJm3E

[HTTP418 @HTTP418InfoSec]

Confused on the basics of C++? Hopefully this little post will help out with some of the confusion! https://t.co/iPx9NVUR41

[HTTP418 @HTTP418InfoSec]

@Emiroda @_Mayyhem Extended Protection - prevents NTLM relaying from being possible!

https://t.co/CqVj0ZK5vb

[HTTP418 @HTTP418InfoSec]

@theluemmel Thanks, very kind of you!

[HTTP418 @HTTP418InfoSec]

I have just written a post (https://t.co/73DNT9a356) summarising the various published SCCM attacks, from PXE enumeration through to Site Takeovers 1/2

[HTTP418 @HTTP418InfoSec]

@vendetce @_Mayyhem @garrfoster @_xpn_ @Raiona_ZA @DiLomSec1 Thanks, appreciate it!

[vx-underground @vxunderground]

We would like to express our condolences to Blue Teamers.

Microsoft has announced Microsoft Excel will now support Python.

More information: https://t.co/LutCzlYc0x

[mr.d0x @mrd0x]

Didn't have time to talk about the newly released TLDs last week, but here we go.

File Archiver In The Browser: Emulating file archive software in the browser with a .zip domain for phishing

https://t.co/yvT6lT0UnU

[HTTP418 @HTTP418InfoSec]

Additionally, I have done another post on the basics of BloodHound for those who are new to the tool! (2/2) https://t.co/FhywYIXhR4

[HTTP418 @HTTP418InfoSec]

I've just published a post on how Cypher language can be used to assess & audit an AD environment with some of its more complex features (1/2) https://t.co/6rZlTXaD5e

[HTTP418 @HTTP418InfoSec]

Another amazing article by @KimZetter, grab a cup of tea and make time to read this!

[Kim Zetter @KimZetter]

Two years ago the SolarWinds hack made history as the boldest, most sophisticated supply chain hack ever pulled off. I dug into the detailed story about the ingenious way the hackers pulled it off - and then got caught - in this tale for WIRED magazine https://t.co/mxgJBIP26L

[HTTP418 @HTTP418InfoSec]

@CyberWarship Thanks!