Jim Sykora

I enjoy security, technology, learning, books, & the great outdoors.
Trying to be human & kind.
Opinions = mine. He/Him/Hän

[Jim Sykora @JimSycurity]

Ope. Updated my profile to a custom domain.

https://t.co/VNAQDJj5lK

[Robin Granberg @ipcdollar1]

Regarding Active Directory permissions, most people assume that a Deny ACE always wins. It doesn't!
Windows stops the access check the moment enough rights are granted — any ACE after that point is never evaluated.
New post: https://t.co/aNYAd6tlxz

[Jim Sykora @JimSycurity]

@curi0usJack Been having good results so far using OpenSpec with the grill-me skill for SDD.

[Robin Granberg @ipcdollar1]

The .NET ActiveDirectorySecurity API was built for helpdesk scripts, not ACL fidelity.
If you're using it for backup, migration, or exact cloning — you're going to have a bad time. New post: the 9 design problems you need to know. https://t.co/OWOAcVbMnH

[SpecterOps @SpecterOps]

Found a Tailscale API key on an assessment?

In their latest research, @KingOfTheNOPs & @Sw4mp_f0x created TailscaleHound to turn your Tailnet into a BloodHound graph to visualize access paths between Azure & Tailscale.

Check it out ⤵️ https://t.co/KuCU5H0D8Z

[r0BIT @0xr0BIT]

shipping: WinSSHound

maps SSH access in AD as BloodHound paths. because Windows OpenSSH cheerfully ignores your "Deny Logon" GPOs (pre-2025) and on a default sshd_config every Authenticated User in the domain can walk right in. Why? Because Microsoft.

https://t.co/ONXuguz7r3

[Jim Sykora @JimSycurity]

@d0tslash I keep a couple stacks of beef jerky in my pocket. Never go hungry and dogs love me.

[SpecterOps @SpecterOps]

In his latest research, @_xpn_ tears apart VS Code Dev Tunnels and finds a C2 framework underneath — REST → WebSocket → SSH → MsgPack RPC, remote exec, file ops.

Find the Ouroboros tool and protocol breakdown at the link! 👇 https://t.co/U75Ynzr8Sw

[TrustedSec @TrustedSec]

How well do you really understand what's happening inside a #Kerberos exchange? In our latest blog, @codewhisperer84 breaks down the full authentication flow and demonstrates how to interact with every stage using the #Titanis toolset. Read it now! https://t.co/QfvnCt9C0T

[DirectoryRanger @DirectoryRanger]

ShareHound: Mapping rights of network shares using bloodhound OpenGraph, by @podalirius_
https://t.co/7wIce883Mv

[Abdul Mhanni @abdo_mhanni]

@Octoberfest73 I remember you once posted a quirk of impacket that could be used as an ioc so I thought you’d like this list of 50+ impacket IOCs😄 https://t.co/Xvro8ggumy

[Synacktiv @Synacktiv]

This second blogpost concludes @yaumn_'s research on #Windows authentication reflection.
He discloses the new Kerberos authentication coercion technique he discovered to remotely compromise Windows systems 💥

A little bonus is even included at the end 👀👇
https://t.co/RsJHxCdIGe

[Jim Sykora @JimSycurity]

@_subTee I trace that exact moment to the point in time where I thought security was some policies and risk assessments crap to making my network a hostile place for attackers.

[Logan Goins @_logangoins]

Just added krb5 auth over ADWS in my tool SOAPy. I noticed since SOAPy released 2 yrs ago with the first ADWS python code nobody had implemented krb5 auth in python.

Check it out here, and stay tuned for an upcoming blog post + big release 👀

https://t.co/PvIQC4iWlh

[SpecterOps @SpecterOps]

ICYMI 👀

@_Mayyhem & Javier Azofra Ovejero shipped MSSQLHound in Go. Same lab, 17 min → under 17 sec

Cross-platform, SOCKS, Kerberos/NT hash auth, + 37 BloodHound edges with pathfinding. If MSSQL isn't in your attack paths yet, it should be. https://t.co/7sEapEGKV8

[codewhisperer84 @codewhisperer84]

New Titanis release => https://t.co/GSc0pfdiOp

The new Dsrep lets you dump secrets from AD, Ldap supports queries for DNS records and timestamp conversions, Dcom supports dotted-property notation, along with other enhancements and fixes.

[Jim Sykora @JimSycurity]

@IAMERICAbooted @atheosblazezero @SpecterOps It's definitely not that easy. Properly modeling of the attack graph for all pertinent scenarios, accounting for important edge cases without attempting to account for all edge cases, and thoroughly validating the results is challenging and not quick.

[Jim Sykora @JimSycurity]

@bdam555 Wear the onesie

[Bad Sector Labs @badsectorlabs]

🏟️ Ludus launched 2 years ago and the community embraced and extended it with write-ups, roles, configs, and environments. We're excited to see what you build with Ludus 2! (1/4)

[NK @Nikaiw]

meet VMkatz, https://t.co/eza4AXRuFT

[Jim Sykora @JimSycurity]

@dakacki birds aren't real