t0

[Entrypoint @Entrypoint_fr]

We've been working on something for a while.

The talks your blue team doesn't want you to see.

🔴 Red Teaming. Initial Access. AD. Cloud & Web exploitation.

📍 Paris - Le Dernier Étage
📅 March 19–20, 2027

https://t.co/WcrpbyzSSV

CFP and additional details coming soon.

[Abdul Mhanni @abdo_mhanni]

Wrote a blogpost about how you can use the Windows server 2003 source code as a red teamer to make your tools look less like tools.

I also go over and map out the main/important files and practical examples of using it to augment MS-*/RFC specs: https://t.co/HfUYBAdCJJ

[Alexandre Borges @ale_sp_brazil]

I am excited to release the extended version of the sixth article in the Exploiting Reversing Series (ERS). Titled "A Deep Dive Into Exploiting a Minifilter Driver (N-day)" this 293-page deep dive offers a comprehensive roadmap for vulnerability exploitation:

https://t.co/Sh8pgB4J6G

Key updates in this extended edition:

[+] Dual Exploit Strategies: Two distinct exploit versions.
[+] Exploit ALPC Write Primitive Edition: elevation of privilege of a regular user to SYSTEM.
[+] Exploit Parent Process ID Spoofing Edition: elevation of privilege of an administrator to SYSTEM.
[+] Solid Reliability: A completely stable and working ALPC write primitive.
[+] Optimized Exploit Logic: Significant refinements to the codebase and technical execution for better stability and predictability.

For those who have read the original release, whose exploit was working, my strong recommendation is that you adopt this extended edition as definitive.

The article guides you through the entire lifecycle of an exploit: from initial reverse engineering and vulnerability analysis to multiple PoC developments and full exploitation.

I hope this serves as a definitive resource for your research. If you find it helpful, please feel free to share it or reach out with your feedback!

Enjoy your reading and have an excellent day day.

[Swissky @pentest_swissky]

Don't judge an audiobook by its cover: taking over your Amazon account with a Kindle - @thalium_team
https://t.co/LsSRqtVfXe

[Synacktiv @Synacktiv]

At #Pwn2Own Berlin 2025, a full exploit chain against VMware Workstation was demonstrated via a heap overflow in the PVSCSI controller.
Despite Windows 11 LFH mitigations, advanced heap shaping and side-channel techniques enabled a reliable exploit.

🔍 Full technical write-up 👇
https://t.co/R0E5Uqql1E

[hypr @hyprdude]

We're back, baby! This time with 19+ bugs I reported to MediaTek over the past year + PoCs for each one! I'll also tell you a *fun* story about MediaTek's "creative" impact assessment process. They earned a spot on the naughty list this year :)

Check it ⬇️

[codewhisperer84 @codewhisperer84]

Check out Titanis, my new C#-based protocol library! It features implementations of SMB and various Windows RPC protocols along with Kerberos and NTLM.

https://t.co/GC5wA2y3EO

[Dirk-jan @_dirkjan]

I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: https://t.co/jD6EaGtsn3

[Jose Vicente Campos @Jose4Vi]

Si te gusta el mundo del NFC, o simplemente tienes curiosidad por aprender, prueba la nueva versión del nfc-laboratory https://t.co/w79ekZ49gQ

[Synacktiv @Synacktiv]

Ever thought your kitchen appliance could harbor a persistent threat? We reverse-engineered the Thermomix TM5 and uncovered vulnerabilities allowing arbitrary code execution, persistence, and secure boot bypass. Discover our step-by-step breakdown!
https://t.co/qDSoMYdHUK

[Dennis @ttdennis]

Yesterday at #Troopers25, @twillnix and I published some of our research on Bluetooth headphones and earbuds. We found that there is a large number of Airoha-based headphones that can be fully compromised via Bluetooth.

https://t.co/OvjOjKDbNh

[Alex Plaskett @alexjplaskett]

Exploiting the IKKO Activebuds "AI powered" earbuds

https://t.co/IbpzOO9Zq4

[Alex Plaskett @alexjplaskett]

The hidden JTAG in your Qualcomm/Snapdragon device’s USB port

https://t.co/foAZsgt9Ru

[Synacktiv @Synacktiv]

Interested in vulnerabilities in video games? 🎮
@tomtombinary presented critical flaws in Neverwinter Nights Enhanced Edition at #Hexacon, which could allow attackers to take control of players' computers. 🛡️
Check out the full details of these bugs!👇
https://t.co/BPF89g7eMO

[Synacktiv @Synacktiv]

🚀 This week, @us3r777 & @__pierreg kick off our new Whitebox Vulnerability Research training! Students will dive into PHP, Java, and .NET, analyzing & exploiting 1-day vulnerabilities. Let’s get started! 💻🔍

[Synacktiv @Synacktiv]

In our latest article, @croco_byte and @SScaum demonstrate a trick allowing to make Windows SMB clients fall back to WebDav HTTP authentication, enhancing the NTLM and Kerberos relaying capabilities of multicast poisoning attacks!
https://t.co/2sgeUeSEe7

[Synacktiv @Synacktiv]

In our latest article, @l4x4 revisits the secretsdump implementation, offering an alternative avoiding reg save and eliminates writing files to disk, significantly reducing the likelihood of triggering security alerts. Read the details at https://t.co/omhdnjOrIR.

[Synacktiv @Synacktiv]

We've just updated our training catalog to include the latest additions, including a brand new course on ransomware investigations!
Find all the dates and details at https://t.co/WHbTXvluJE

[Hugow @hugow_vincent]

Très sympa d'enregistrer cet épisode où on a parlé relay kerberos et Red-Team 🥷 merci @mpgn_x64 🙏

[Synacktiv @Synacktiv]

In our latest article, @croco_byte proposes an implementation of a trick discovered by James Forshaw in his research. Discover how to perform pre-authenticated Kerberos relay over HTTP with our Responder and krbrelayx pull requests!
https://t.co/uTEokfE49h