Regarding Active Directory permissions, most people assume that a Deny ACE always wins. It doesn't!
Windows stops the access check the moment enough rights are granted — any ACE after that point is never evaluated.
New post: https://t.co/aNYAd6tlxz
The .NET ActiveDirectorySecurity API was built for helpdesk scripts, not ACL fidelity.
If you're using it for backup, migration, or exact cloning — you're going to have a bad time. New post: the 9 design problems you need to know. https://t.co/OWOAcVbMnH
Found a Tailscale API key on an assessment?
In their latest research, @KingOfTheNOPs & @Sw4mp_f0x created TailscaleHound to turn your Tailnet into a BloodHound graph to visualize access paths between Azure & Tailscale.
Check it out ⤵️ https://t.co/KuCU5H0D8Z
shipping: WinSSHound
maps SSH access in AD as BloodHound paths. because Windows OpenSSH cheerfully ignores your "Deny Logon" GPOs (pre-2025) and on a default sshd_config every Authenticated User in the domain can walk right in. Why? Because Microsoft.
https://t.co/ONXuguz7r3
In his latest research, @_xpn_ tears apart VS Code Dev Tunnels and finds a C2 framework underneath — REST → WebSocket → SSH → MsgPack RPC, remote exec, file ops.
Find the Ouroboros tool and protocol breakdown at the link! 👇 https://t.co/U75Ynzr8Sw
How well do you really understand what's happening inside a #Kerberos exchange? In our latest blog, @codewhisperer84 breaks down the full authentication flow and demonstrates how to interact with every stage using the #Titanis toolset. Read it now! https://t.co/QfvnCt9C0T
@Octoberfest73 I remember you once posted a quirk of impacket that could be used as an ioc so I thought you’d like this list of 50+ impacket IOCs😄 https://t.co/Xvro8ggumy
This second blogpost concludes @yaumn_'s research on #Windows authentication reflection.
He discloses the new Kerberos authentication coercion technique he discovered to remotely compromise Windows systems 💥
A little bonus is even included at the end 👀👇
https://t.co/RsJHxCdIGe
@_subTee I trace that exact moment to the point in time where I thought security was some policies and risk assessments crap to making my network a hostile place for attackers.
Just added krb5 auth over ADWS in my tool SOAPy. I noticed since SOAPy released 2 yrs ago with the first ADWS python code nobody had implemented krb5 auth in python.
Check it out here, and stay tuned for an upcoming blog post + big release 👀
https://t.co/PvIQC4iWlh
ICYMI 👀
@_Mayyhem & Javier Azofra Ovejero shipped MSSQLHound in Go. Same lab, 17 min → under 17 sec
Cross-platform, SOCKS, Kerberos/NT hash auth, + 37 BloodHound edges with pathfinding. If MSSQL isn't in your attack paths yet, it should be. https://t.co/7sEapEGKV8
New Titanis release => https://t.co/GSc0pfdiOp
The new Dsrep lets you dump secrets from AD, Ldap supports queries for DNS records and timestamp conversions, Dcom supports dotted-property notation, along with other enhancements and fixes.
@IAMERICAbooted@atheosblazezero@SpecterOps It's definitely not that easy. Properly modeling of the attack graph for all pertinent scenarios, accounting for important edge cases without attempting to account for all edge cases, and thoroughly validating the results is challenging and not quick.
🏟️ Ludus launched 2 years ago and the community embraced and extended it with write-ups, roles, configs, and environments. We're excited to see what you build with Ludus 2! (1/4)