bigJ

[0xor0ne @0xor0ne]

Cool series to learn IoT/embedded devices reverse engineering (credits @Palantir555)

Debug Ports: https://t.co/VtFoIhs56D
Firmware: https://t.co/J0kB0CHQKG
Data: https://t.co/rLFlUQGLAr
Flash: https://t.co/xNXBoApvZ7
Digging the Firmware: https://t.co/ygkhewllh8

#iot

[Tim @__invictus_]

Me at the start of every red team:
* I will report as I go
* I will take the most comprehensive notes ever seen
* I will not rely on C2 logs
* screen cap all the things
.....

Me at the end of every red team:
* well shit

[Ryan Basden @_rybaz]

Getting an extra laptop power adapter to keep at the office is the best quality of life improvement I have made in a long time

[Ash @_bin_Ash]

The Protected Users Group is one of the most OP Active Directory security protections I wish I knew about earlier🧵

What does it do? Glad you asked:
- Disables NTLM Authentication
- Disables usage of DES or RC4 encryption for Kerberos tickets
- Restricts delegation
+ Much more!

[Ash @_bin_Ash]

5head is a pentest automation toolset I wrote to help you speed up those repeatable tasks you might perform on any given network pentest.

We've just made v1.0 public, with lots of plans for future functionality and releases.

Check it out⤵️:
https://t.co/Tb7l4XHfjH

[Ash @_bin_Ash]

Finished Offshore from @hackthebox_eu :)

Review soon.

[Ryan Basden @_rybaz]

@_mostwanted002_ OSCP is the bachelor's degree of pentesting certs. You don't need it to get hired, but it sure as hell helps.

[bigJ @_inyernet]

@DavidAlvesWeb @_rybaz I am about to go through the mobile challenges on HTB. Can't say how good it is, but HTB hasn't disappointed me yet. Also, John Hammond recently live streamed a Mobile pentest workshop last week if you want to check that out: https://t.co/pp0VNVSBlh

[bigJ @_inyernet]

@DavidAlvesWeb @_rybaz https://t.co/qeMbslglHB - Can't go wrong with OWASP testing guidelines

[Graham Helton (too much for zblock) @GrahamHelton3]

Want to highlight text in a file but still see the rest of the file contents? Very helpful grep command:
grep --color 'LOOKFORME\|$' file.log

[ippsec @ippsec]

Ever come across a file running on a Linux box that was deleted from the disk? Did you know you can likely use DD to recover the file without any non-standard tools?

[vx-underground @vxunderground]

LAPSU$ extortion group, the South American group who recently claimed to exfiltrate 1TB of data from NVIDIA and also claimed to have been "hacked back" by NVIDIA, has addressed the rumors and speculation.

Initially LAPSU$ claimed NVIDIA deployed ransomware, here is the truth

[Intigriti @intigriti]

403 Forbidden - Game Over? 🕹

Not today, we are having some extra coins to play with 💰

@hasanakajan is not holding back his secrets for you 🕵️‍♂️

#bugbounty #bugbountytips 👇

[Michael Blake @Michael1026H1]

@Rhynorater Yes, Scope Monitor.

[frycos @frycos]

https://t.co/CWToxP6elZ
Blog post published with my special guest "Microsoft Exchange (CVE-2022-21969)"

[Antonio Cocomazzi @splinter_code]

Windows Defender AV allows Everyone to read the configured exclusions on the system 🤦

reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions" /s

[inversecos @inversecos]

#MalwareAnalysis Tip: Why some windows APIs end in "Ex" and "A" or "W"
i.e. CreateWindowExA

Ex Suffix = Microsoft has updated the function and the new function has the Ex suffix ;)

A / W Suffix = Function takes a str as a parameter (A/W depends on ANSI or unicode)

[Florian Hansemann @CyberWarship]

Detection Lab

Collection of Packer & Vagrant scripts that quickly bring a Windows AD online, complete with a collection of endpoint security tooling & logging best practices 😎

WriteUp
https://t.co/fPFp25cBsx

Code
https://t.co/YzQISuZFfg

#infosec #pentest #blueteam #redteam

[𝐞𝐧𝐞𝐬 @EnesSaltk7]

Always test JSON body parameters. In my case I bypassed email verification.

#bugbountytips