Tracehunt

Opsec-driven cyber ranges. Train like a red team, think like a blue team — master both sides of the hunt.

[Tracehunt @TraceHuntLabs]

@Wakedxy1 @PinkDraconian So glad you had fun evading @Wakedxy1 ! 😎

[Tracehunt @TraceHuntLabs]

@PinkDraconian You guys did a killer job 😎 Well done!

[PinkDraconian @PinkDraconian]

This was soooo much fun! 🔥
We were invited to try this new and upcoming platform @TraceHuntLabs

TraceHunt is different from all other pwn-the-box or CTF platforms. On most of those platforms you just hack, get the flag, and done.

[Tracehunt @TraceHuntLabs]

@techspence You can also use your teammates' machines to have more cracking attempts using Hashtopolis (hashcat underneath). Might be useful in a time-boxed pentest
https://t.co/eKJPS8cIBW

[Tracehunt @TraceHuntLabs]

We've all done it: upload a webshell, get code execution and move on. But what if your target is being monitored ?
In our latest blog post, we tackle webshell tradecraft in monitored networks including disk activity, process context, and HTTP patterns.

https://t.co/X4Ob3khaUP

[Tracehunt @TraceHuntLabs]

@techspence I'd add LDAP/SMB signing enforcement as well, solves the majority of relay attacks 😎

[IT Guy @T3chFalcon]

Tor through VPN or VPN through Tor?

If you had to pick one, which setup makes more sense and why?

[Alex Neff @al3x_n3ff]

Enumerate DNS zones that allow unauthenticated updates using NetExec🔥

Adding or updating DNS entries without authentication can give attackers a huge advantage.
Thanks to @toffyrak such DNS zones can now be enumerated using NetExec🚀

[IT Guy @T3chFalcon]

Most people don't now that..

Clearing your bash history (history -c) does not erase your tracks. If you used sudo, Linux logged the exact command in a different file.

It’s called auth.log.

Paths:
/var/log/auth.log (Debian/Ubuntu)
/var/log/secure (RHEL/CentOS)

Forensic investigators don't need your history file. They just grep for COMMAND=. Every time you type sudo nmap... or sudo vim /etc/shadw, the Auth Log records:
The User who ran it.

The Terminal (TTY) they used.

The Exact Command they executed.

💀

[Tracehunt @TraceHuntLabs]

@T3chFalcon This is exactly the stuff we alert on while solving our challenges 😅

[Tracehunt @TraceHuntLabs]

@T3chFalcon We are launching opsec-driven cyber-ranges in Q1 2026, feel free to subscribe for early access if interested! Solve multi-network challenges and try to avoid as many alerts as possible 🚨

[Tracehunt @TraceHuntLabs]

SSH access to a system ?

🎯 Red teamers: Avoid interactive sessions to prevent entries in the `last` log. Run commands with `notty` by appending your cmd to the SSH command.

🛡️ Defenders: Monitor unexpected origin IP's in the `last` log and modifications to `/var/log/wtmp`

[Tracehunt @TraceHuntLabs]

SNMP enum in legacy/OT networks:

🎯 Red teamers: use specific MIB's that contain useful info such as `HOST-RESOURCES-MIB::hrSWRunParameters` instead of cycling the entire MIB range with snmpwalk

🛡️Defenders: Flag snmpwalk packets starting with 0x30 and containing 0xA1 or 0xA5

[LetsDefend @LetsDefendIO]

Malware Analyst

[Tracehunt @TraceHuntLabs]

@cyb3rops Interesting project! Do you happen to have a repo link already ?

[Tracehunt @TraceHuntLabs]

@techspence I think this could be true for SOC analysts but a decent threat hunter should know how an attacker persists, moves laterally and could be able to bypass the defences you put in place.

Otherwise, you'll only find script kiddy level attacks

[Tracehunt @TraceHuntLabs]

@techspence Hey! We are launching opsec-driven cyber ranges with realtime alerting in 2026 which will also include AD stuff. It should learn defenders how attackers think and operate and consequently how to alert on it. Feel free to reach out if you're interested!

https://t.co/KBKrWw2PCm

[Tracehunt @TraceHuntLabs]

@hakluke All invoices are formatted using the same template ? If so, you can parse it with PyPDF and extract text from a specific zone on the page. It should be quite reliable.

[Tracehunt @TraceHuntLabs]

@Robert_Watkin_ At least 2 to exit zombie mode in the morning 😅

[Tracehunt @TraceHuntLabs]

@passthehashbrwn The moment you start questioning if you configured the correct domain and proxy settings 😂