Yeeb

Penetration tester, red teamer and capture the flag player with incident response experience.

[CryptoCat @_CryptoCat]

Found an unpatched RCE in Gogs 👀 Any authenticated user can get code execution on the server through argument injection into git rebase. Full @rapid7 writeup + @metasploit module available now!

🔗https://t.co/VAYLxZ6o1b

[Fady Moheb @N1NJ10_]

Stop burning RDP persistence with 4732 alerts. Bypass the "Remote Desktop Users" group entirely.
GUI access only requires:

- SeRemoteInteractiveLogonRight (Inject SID via secedit)
- RDP-Tcp listener permissions (Modify CIM class)

OPSEC: Trades 4732 for 4704. Most SOCs don't tune 4704 with the same aggression.

h/t @Cptjesus for the concept.

[Aurélien Chalot @Defte_]

If you were wondering why NTLM reflection isn't working on windows < 2016, here you go, thanks for the RE @azoxlpf

https://t.co/RrwuZ06hvH

[ar0x @_ar0x4]

Really hyped to be speaking at #x33fcon this year! Can’t wait, it’s gonna be a good one 🔥

[S3cur3Th1sSh1t @ShitSecure]

New small Blog Post from my side - anyone faced 429 too many requests on Microsoft Graph in your projects? This blog provides more insights on how to bypass those. ���

https://t.co/v3DlLWzFqq

[Core Impact @_CoreImpact]

Impacket 0.13.1 is live! This release includes new relay surfaces, stronger support for modern Windows and SQL Server environments, and a set of practical improvements across the examples scripts. Check out the blog post to get more details>

https://t.co/B52xTyCNMT

[🕳 @sekurlsa_pw]

Abusing ESC1 to get domain admin.

[r0BIT @0xr0BIT]

shipping: WinSSHound

maps SSH access in AD as BloodHound paths. because Windows OpenSSH cheerfully ignores your "Deny Logon" GPOs (pre-2025) and on a default sshd_config every Authenticated User in the domain can walk right in. Why? Because Microsoft.

https://t.co/ONXuguz7r3

[Yarden Shafir @yarden_shafir]

I checked and it's been 2 years since my last blog post??? So anyway, here's a quick blog post about KDP pool - the latest KDP feature that will replace the secure pool in future Windows versions: https://t.co/EhZmTQ4pfL

[Pingiskok @pingiskok]

Every JWT writeup online covers 2–3 attacks and stops.
I got tired of jumping between 40 blog posts, so I wrote the whole thing. All in one place.
https://t.co/iCSzQ4GjcS

#infosec #appsec #bugbounty #websec #jwt

[Julian Horoszkiewicz @ewilded]

Finally, it is published 😁 Making Vulnerable Drivers Exploitable Without Hardware - my latest research on driver vulnerability hardware-gating, explaining the concept of hardware-dependent code and diving deep into creative deployment techniques - software-emulated phantom devices, driver restacking, and forced driver replacement — all explored through the lens of Bring Your Own Vulnerable Driver (BYOVD) attacks:
https://t.co/COJ0BKpZQe

[Synacktiv @Synacktiv]

Attacking heavy applications through named pipes: an attack surface often overlooked due to its complexity.

In this article, @TurboThonSec explains how we designed a tool abusing legitimate processes to attack higly privileged components of heavy clients.

Article⬇️
https://t.co/Y9tAU0xGAi

[codewhisperer84 @codewhisperer84]

New Titanis release => https://t.co/GSc0pfdiOp

The new Dsrep lets you dump secrets from AD, Ldap supports queries for DNS records and timestamp conversions, Dcom supports dotted-property notation, along with other enhancements and fixes.

[The Bingus Man @NotNordgaren]

Just put your vbscript inside of html and put that inside of an mp3 in the middle of some frame data and mshta will just...

Fucking execute it?!?!

[nora @hypervisor]

most aligned claude:

[Fabian Bader @fabian_bader]

📢 You already know FOCI, BroCI, and all the OAuth2.0 flows? But do you already know the secret token providers of Entra ID?

In my latest research post I explore how you can, hidden from the Defenders, request new access token.

https://t.co/1IzJxVCLnP #EntraID #DefenderXDR

[Gavin K @atomiczsec]

updated this BOF to detect more dev endpoints and MCP configs that could expose server definitions, commands, arguments, and embedded credentials

useful for real environments since it quickly maps spots where:
- creds/tokens live in plaintext
- MCP configs expose backend services + execution paths
- AI tooling leaks data flows and internal integrations

[SpecterOps @SpecterOps]

Relayed NTLM creds are powerful, if you can use them.

@senderend shows why browsers fail through ntlmrelayx SOCKS and introduces ghostsurf to make NTLM-authenticated web apps accessible.

Read more ⤵️ https://t.co/BdtzoKquD1

[bohops @bohops]

I’ve been grinding hard on AI for the better part of the last 8+ months - learning, building, adapting, and pulling late nights just like so many others right now.

Cutting through the FUD and hype, there is real potential here. Industry-breaking potential. The era we’ve been waiting for - to finally supercharge and develop the tools and platforms we’ve wanted to build for years - is here, and agent assistance is accelerating everything.

With coding agents, I’ve built solid tools and had research breakthroughs that would have taken weeks or months before. These should feel like real wins worth celebrating. But honestly? I don’t feel victorious. In many ways, it just feels necessary to keep pace. As Dave said: adapt or be left behind - and for good reason.

I’m not ready to be left behind. But damn, I’m tired.

I’m tired of constantly reinventing myself. Tired of constantly re-tooling. Tired of the endless cycle of keeping up, the late nights, and the personal sacrifices that come with it. I’ve even lost the desire to share knowledge and research with the community the way I used to. From the conversations I’ve had, I’m far from alone - many others in this space feel the same but don’t necessarily vocalize it outside of smaller circles.

Is it because I see AI purely as a threat? Not really. The offensive side of our industry has been heading this way for a while, and I’ve been moving with it. The truth is, the excitement Dave describes is real - but for me right now, it’s mixed with exhaustion. I’m grateful for the breakthroughs, yet I catch myself wondering how long I can sustain this level of constant reinvention without something giving. The early-2000s energy is back, sure… but so is the burnout that often came with it.

Being a bit older now, with young kids at home, the pace hits differently. I don’t have the same endless energy I once did, and the late nights and constant context-switching carry a heavier weight. Finding balance is tough, but it feels more important than ever. Hopefully we can all figure out how to ride this wave more sustainably - without burning out in the process.

[kozmer @k0zmer]

https://t.co/TXHncwJWly