a804046a

[a804046a @a804046a]

2¹⁹ bits of keystream for all the 16bit keys of ARC4. The waves mean «ARC4 is bad on first bytes» (WEP anyone ?) http://t.co/ARYZfkCamd

[DFIR437 @CP437_DFIR]

How could you learn #PowerShell ? a friendly piece of advice.

[DFIR437 @CP437_DFIR]

$(foreach($k in $(gci -re)){forEach($v in $k.GetValueNames()){[pscustomobject]@{p=$k.Name;n=$v;v=$k.GetValue($v);t=$k.GetValueK*($v)}}})

[DFIR437 @CP437_DFIR]

#powershell Windows Registry to CSV
> Learn what the clicky settings menu actually change on disk
> Check what malware did

[DFIR437 @CP437_DFIR]

I'll attend the #Botconf

[a804046a @a804046a]

Nice WPS vuln :')
https://t.co/EnLO4bmy7N

[DFIR437 @CP437_DFIR]

STANDALONE MS17-010 (#Wanacry) CHECKER
This virtual machine should be used in small companies to scan networks.

https://t.co/wjrqxDTrVy

[DFIR437 @CP437_DFIR]

You can filter the alerts raised by HTTP accesses to https://t.co/xTrd8omUF2 by UA, as InternetOpenUrlA (as used by #WannaCry) has no UA :

[a804046a @a804046a]

New account dedicated to my day-to-day #DFIR job in a big company with more than two computers : @CP437_DFIR

[a804046a @a804046a]

Can cookies flagged "secure" be sent over NULL-cipher https:// connections ?

[a804046a @a804046a]

https://t.co/gPLuDp16tl <3

[a804046a @a804046a]

Mechanical displays by Daniel Rozin !
https://t.co/DDOonYvPGA
https://t.co/D0DUwcQUxg

[a804046a @a804046a]

#powershell NATIVE SCAN
(New-Object -ComObject WIA.DeviceManager).DeviceInfos.Item(1).Connect().Items(1).Transfer().SaveFile("$(pwd)\a.bmp")

[a804046a @a804046a]

>>> '{:08x}'.format( struct.unpack("<I", socket.inet_aton( socket.gethostbyname( "https://t.co/3PUMSZdFXD")))[0])
'cedb3ad8'

[a804046a @a804046a]

@maldr0id Which was very nice (: (:

[a804046a @a804046a]

THIS IS A LIVE TWEET FROM THE #BOTCONF DURING A TLP RED TALK 😱

[a804046a @a804046a]

#botconf2017

[a804046a @a804046a]

@MKody97 @Silou_Atien J'ai juste pas remis l'iframe vers la map de french-brony qui a voulu me prendre gratos mon domaine.

[a804046a @a804046a]

Any #botconf attendees in this TL ?

[a804046a @a804046a]

Very nice malware write up :
« Hajime: Analysis of a decentralized internet worm for IoT devices »
#はじめ
https://t.co/V586aaMr1l

[DeviantArt @DeviantArt]

Attack and defense. https://t.co/Kius0WwCOV