nodauf

Offensive security enthusiast | Interested in malware dev, AD, Windows, ...

[otter @0xtter]

https://t.co/ZOn72Ziefd

[Adam Chester 🏴‍☠️ @_xpn_]

First blog post in a mini series where I look at "disposable tooling". This post shares what I have found to be useful when 1-shot'ing LLM generated Stage-0 agents for Mythic. https://t.co/LX0JVGmHBf

[Grzegorz Tworek @0gtweet]

By-design AV bypass with "dev drive" 😅
I really like this feature!
Update your detection rules if you want to spot this...

[Alex Neff @al3x_n3ff]

Onelogon: Taking over Active Directory Accounts via Netlogon🔑

We analyzed Netlogon, bypassed the Zerologon patch, resulting in a full auth bypass. An attacker can leverage this to compromise computer accounts, or even the entire AD. Non-standard config must be present tho 🧵

[Dirk-jan @_dirkjan]

I just wrote a new blog on bypassing CA policies in Entra ID that have a resource exclusion, and why you probably want to enable baseline enforcement if you have such policies. Enjoy!

https://t.co/a1rGl3wss8

[Mathilde Venault @MathildeVenault]

I was presenting this morning at @reconmtl my RE journey of the ClickOnce technology.. that led to discover a new abuse on it!

If you've missed it, or are interested to learn about this little known feature, the research is also available on @CrowdStrike's blogspot below ☀️

[SpecterOps @SpecterOps]

The first version of BloodHound MCP proved an LLM could talk to BloodHound. The next version taught a more important lesson: MCP design is context design.

@turbo_sec breaks down what changed, what didn't, and why smaller tools beat larger API surfaces. https://t.co/NOjP72WMJL

[Synacktiv @Synacktiv]

Kernel LPEs dropping before patches are widely available? It's been a wild month for Linux defenders.

Our CIO @r3n1k breaks down how tried-and-true hardening measures can raise the bar and buy your Blue Team time against N-days.
https://t.co/5WgbXMj0Fo

[Panos Gkatziroulis 🦄 @ipurple]

UnCanny - Another new coercion primitive with LPE 0day - machine-account NTLM coercion from a non-admin user via Windows Store InstallService plugin resolution experiments https://t.co/Vw2LEhoZXZ

[BRute Logic @BRuteLogic]

OAuth Bypass Testbed

https://t.co/8WHf78YqCz

Test your skills against a LOGIN (randomly vulnerable) and/or 17 AUTHENTICATION SERVER endpoints.

Like with JWT, a fully automated OAuth tool with complete FFF (Find, Forge, Fire) PoCs is on the way, exclusively for Brute One.

[🕳 @sekurlsa_pw]

https://t.co/laDOE5LChz

"When an organisation uses Exchange Online (or on-premises exchange in hybrid mode) with a third-party mail server or spam filter as its MX record, it is possible to send mail from any sender to that organisation. Outlook delivers it without warning"

[Dark Web Informer @DarkWebInformer]

‼️ Nightmare Eclipse is back on GitHub under a new alias and has released a new Windows Defender vulnerability zero-day called RoguePlanet.

PoC: https://t.co/n0xF6uGt4u

New GitHub Account: https://t.co/qwU93VedpH

[Two Seven One Three @TwoSevenOneT]

New #redteam tool for blocking EDRs: EDRChoker
Instead of fully blocking the EDR agents' connections to their server, we can throttle their bandwidth so they consistently time out when sending data, which is effectively the same as blocking but avoids triggering "block" or "drop" packet events
#pentest #cybersecurity
Github: TwoSevenOneT/EDRChoker

[rootsecdev @rootsecdev]

This morning I have made public an internal repo on relaying available to everyone. I call it the relay bible. I still have a few more additional tweaks and techniques to add in here but for the most part. It's ready. Hope everyone enjoys my reference.

https://t.co/if08LR2Nwv

[Max Schmitt @mx_schmitt]

Azure violated their own ToS ⁉️
https://t.co/JHepNbl4tu

[rootsecdev @rootsecdev]

Bookmarking @HackingDave AI model regression site. This is useful. For now Opus 4.8 is my daily driver followed by a few frontier models. It’s an exciting time for AI to assist me in research.

https://t.co/hMLE1R4T7k

[International Cyber Digest @IntCyberDigest]

‼️ The alienation continues: more security researchers are sticking up the middle finger after feeling squeezed by Microsoft and GitHub. MSRC emailed Black Hat USA 2026 presenters asking which MSRC cases, VULN-IDs, or CVEs their talks would cover. GitHub told a researcher to delete his public PoC repos and flagged his accounts under ToS.

[Insomni'hack @1ns0mn1h4ck]

🚨 One more week to submit your workshop ideas!

📝✨ Still have an innovative idea or an exciting topic to share?

We’re extending the deadline to give everyone a chance to contribute.

👉 Submit your proposals by the end of the week: https://t.co/EO900ZoxS2

#CyberSecurity #CFP

[SEKTOR7 Institute @SEKTOR7net]

Bring Your Own Trusted Binary (BYOTB).

Tools, tunnels and trusts, a post by David Kennedy (@JUMPSEC)

Source: https://t.co/DsCEO7HQbW

#redteam #blueteam #maldev #malwaredevelopment

[Insomni'hack @1ns0mn1h4ck]

🎉 Our Call for Talks is officially open.

Submit your proposal from June 1st to August 23rd and be part of this incredible event.

Scheduled from February 4th to 5th, the conference is your platform to share your insights.

👉 Apply now: https://t.co/HCGeleq8vs

#CyberSecurity