Edo Maland

ꜱᴇɴɪᴏʀ ꜱᴇᴄᴜʀɪᴛʏ ᴄᴏɴꜱᴜʟᴛᴀɴᴛ / ᴘᴇɴᴇᴛʀᴀᴛɪᴏɴ ᴛᴇꜱᴛᴇʀ | ᴏꜱᴄᴇ³ | ᴏꜱᴇᴘ | ᴏꜱᴄᴘ | ᴏꜱwᴘ | ᴏꜱwᴇ | ᴄʀᴛ | ᴄʀᴛᴘ | ᴄʀᴛᴇ | ᴄʀᴛᴏ | ᴇᴡᴘᴛxᴠ2 | ᴇᴄᴛᴘxᴠ2 - ᴡᴀɴɴᴀʙᴇ ʀᴇᴅ ᴛᴇᴀᴍᴇʀ

[Thierry @0x7hierri]

This tool called #Sudomy created by @screetsec , I use it to find hidden live subdomains that are even still under production lol. To my surprise, those subdomains are vulnerable despite WAF protecting the main domain.
#Please use this tool: https://t.co/eFaBcBCyzZ

[Positive Technologies Global @PTsecurity_EN]

Built-in≠safe. @ScreetSec shows how PowerShell goes full red team: recon, exploit, escalate, move laterally — all fileless, all stealth. Real offensive tricks, amsi/etw bypasses, and defense evasion that hits where it hurts. #PHTalks, Jakarta 🇮🇩, 23 Jul: https://t.co/mOSs5IRukH

[Edo Maland @screetsec]

@MarcoFigueroa Thanks for reaching out! @MarcoFigueroa

Feel free to share your ideas and submit a pull request on GitHub for collaboration.

There is also the Docker maintainer for the Sudomy tools. Perhaps you can discuss with him as well

cc://@myugan59

[CCob🏴󠁧󠁢󠁷󠁬󠁳󠁿 @_EthicalChaos_]

Working on a new tool that will be ready soon. One thing I can say from the research.... if your environment leverages Windows Hello without TPM's, DO NOT allow the default setting of a digit only based pin. Windows stores the pin length and can be brute forced in seconds.

[Edo Maland @screetsec]

@mastomii @offsectraining Thanks om tomii

[Edo Maland @screetsec]

Gotcha, 𝗦𝗲𝗰𝗿𝗲𝘁.𝘁𝘅𝘁 in My Hands! ✊

I'm happy to share that I've achieved the OSEP certification from @offsectraining !

https://t.co/szWDXrZ9WE

[Adam Chester 🏴‍☠️ @_xpn_]

Quick POC this evening looking at how LAPS (v2) passwords are stored and decrypted on Active Directory (tl;dr, msLAPS-EncryptedPassword attr and NCryptStreamUpdate for crypto) https://t.co/QaZdleEvNc

[Florian Roth ⚡️ @cyb3rops]

If you're a read teamer and want your work to have a higher impact, I recommend the following:

1. put yourself in the perspective of a defender for a while
2. understand their methods, learn about their detections
3. learn to read YARA, Sigma, Snort signatures
...
🧵

[Edo Maland @screetsec]

I earned a badge from Zero-Point Security! https://t.co/69YyDRnBZZ.

Thanks @zeropointsecltd, the lab exams are well-designed, enjoyable, and challenging. If you want to explore and use Command and Control (C&C) like Cobalt Strike, I absolutely recommend it!😜

[mr.d0x @mrd0x]

Reminder to not trust calendar (.ics) attendees.
https://t.co/XTm7sLVQZr

[Edo Maland @screetsec]

@nandareynaldi @ryirwansyah @jerukitumanis That’s great articles, thank you

[Vincent Van Mieghem @_vivami]

Bypassing CrowdStrike, Microsoft Defender for Endpoint etc. for fun.. not profit https://t.co/VCLnD0e1bL

[Yanir Tsarimi @Yanir_]

(10/10) Read about the full discovery here > https://t.co/9ADaj2LkfM

[Edo Maland @screetsec]

@amrul_01 You're also awesome 🤘

[Edo Maland @screetsec]

Finally! I got the final extreme certification from eLearnSecurity about Red Teaming and Active Directory security to challenge myself again and complete my learning path. This one was one of the hardest exams I've ever taken, very challenging, but I learned a lot.

[Edo Maland @screetsec]

@Bram22982935 Thanks for the heads up, I will check it

[Edo Maland @screetsec]

@akazh18 Thank you!

[Scott Sutherland @_nullbind]

Great blog on Azure SAS Token privilege abuse: https://t.co/ZdUnrwpGlK

[Manas @ManasH4rsh]

This repo contains almost everything about appsec. Refer this and you should have enough idea about appsec:)

https://t.co/sIIGHdOK8q

[Kostas @Kostastsale]

I created a #CyberChef recipe to ease the extraction of URLs from the word document (.doc & .docm) which download #Emotet. It is not completely foolproof, but it worked 99% of the time for me.

https://t.co/CV0CVh4Hdo