We published our Offensive Azure Security Cheatsheet 🚀🌩️
Built from commands, notes, and practical knowledge gathered while creating Breaching Azure and Breaching Azure Advanced courses, now shared with the community for quick reference.
Use it, share it, and PR your best tips 👇
https://t.co/aoQIIpqkEG
#CloudBreach #AzureSecurity #CloudSecurity #OffensiveSecurity #RedTeam #PurpleTeam #MicrosoftAzure #EntraID #Microsoft365 #CyberSecurity #CloudPentesting #Pentesting #ThreatDetection #SecurityResearch #InfoSec #cheatsheet #BreachingAzure
jwt .io shows you the token. it won't tell you how to break it.
so i built jwtforge.
it audits JWTs for vulns (alg:none, algorithm confusion, kid/jwk injection) and forges working attack tokens with curl/burp/nuclei/jwt_tool ready to run.
all in your browser. nothing leaves your tab.
https://t.co/KhjPzykITx
The best AD learning loop I've seen: BadBlood → PingCastle → remediate → rerun. Cheap, repeatable, and the "why is this still failing" moments teach more than any cert lab.
CVE-2026-31431 a/k/a CopyFail
> Linux LPE
> Description sounds like AI slop
> Exploit is legit
> Impacts every Linux kernel from 2017 - Now
> Proof-of-concept released
> It's Wednesday?
https://t.co/FXgjWW7lOV
Another zero day exploit released by some nerd (can't remember name right now) because they're annoyed with Microsoft. It's been confirmed by other nerds. It is yet another legit zero day. Whew.
https://t.co/Zllhns1ztn
@uglyluhan Reading the JJK wiki page, the Mahoraga name is a mistranslation by the official translator.
The Japanese name - Makora appears to be from 12 Divine Generals. Do you have any interesting info about these 12?
🔁 JWT vulnerabilities remain a critical attack surface in modern web applications... 🧐
Many applications properly validate JWT signatures but overlook cases such as algorithm confusion attacks, JWK spoofing and other scenarios that can lead to complete authentication bypass! 😎
Our comprehensive guide covers 5+ common JWT misconfigurations, including step-by-step exploitation techniques and practical examples.
Read the article today (link in post below) 👇
My BlueHammer version ( now redhammer) implements my VDM version patch, deploys and loads the BYOVD for my exploitkit.
It bypasses the new signature for BlueHammer aswell. How is this still unpatched?
Tired of forgetting that one perfect reverse shell or privesc command mid-engagement? 😩
CyberDeck is your retro CRT hacker's cookbook: 150+ searchable CLI gems + multi-step attack recipes, all in glorious green-phosphor Alien vibes.
Built for red teamers who live in the terminal.
Read the full feature drop: https://t.co/eRRQP7RPcS
Try it NOW → git clone https://t.co/hrp8g9DlFP && python3 https://t.co/eCfjCwPZS8
Open Redirects are everywhere, you just have to look at the right spot.
It could be as simple as waybackurls + a simple grep.
Try it on your next target 👀
Found an exposed Swagger/OpenAPI file on your target? 🧐
Sj by @BishopFox audits endpoints defined in Swagger docs automatically, tests all defined endpoints, generates curl/sqlmap commands, and even bruteforces for hidden definition files! 🤠
Check it out! 👇
🔗 https://t.co/x41DTGB6dR