Alex Kozlov

Physical Security/Red Team/Car Hacking/Hardware Hacking enthusiast. Adversarial Engineer @Lares_. OSCP/OSEP.

[Alex Kozlov @b4cktr4ck2]

https://t.co/G6bJzLcIbQ

Exploiting ESC1 using only built-in Windows binaries to generate the PFX. Shoutout to @NotMedic for troubleshooting 🥰

[Kenny Hartlaub @ibr0wse]

My story of failure and complacency isn't new or unique, but I hope it resonates and inspires others embarking on their own.

Remember, you don't always need a cert to succeed - it's about continual learning and self-challenge. For me, it was the OSCP.

https://t.co/zbVq7SQR6t

[Andy Gill @ZephrFish]

We've rebooted the Lares research blog over at https://t.co/NWmu69Nc9R; a few technical posts are in the wings, and our historical research has been migrated across too featuring work from @Antonlovesdnb, @b4cktr4ck2 & others. Stay tuned for more blog posts in the future 😁

[spencer @techspence]

I'm a complete newb but on a previous engagement I found a host with a vulnerable Splashtop streamer. I couldn't find a poc so I created a very bad poc of my own. be kind but I would welcome critiques. Credit to @r0ns3n for finding this vuln in 2021
https://t.co/VHzG0wVpIR

[Tim McGuffin @NotMedic]

Lazy threat actors didn't add encryption.
Here's my equivalent from some old tooling that does, plus some other things.

Greetz to the Crowdstrike analyst who sigged my tooling a few years ago.

https://t.co/O3Y7ylqWBZ

[Darkoperator | 🇺🇦 @Carlos_Perez]

https://t.co/AJUHrgBuwP great blogpost by one of my team members. An excellent read for anyone looking at programing against RPC.

[Alex Kozlov @b4cktr4ck2]

@NotMedic Thanks I hate it

[Alex Kozlov @b4cktr4ck2]

@rootsecdev No worries- I appreciate your offering to test in the first place 😀

[Alex Kozlov @b4cktr4ck2]

https://t.co/G6bJzLcIbQ

Exploiting ESC1 using only built-in Windows binaries to generate the PFX. Shoutout to @NotMedic for troubleshooting 🥰

[Alex Kozlov @b4cktr4ck2]

@rootsecdev @dorianmuthig @NotMedic Did you get a chance to test this against Defender for Identity?

[Alex Kozlov @b4cktr4ck2]

🥰🥰

[Lares @Lares_]

New on the Lares blog - Push Fatigue: We’re tired too: https://t.co/XtA9vqv3x8

[Robin @digininja]

Just learnt that if you put a + in front of an nmap script name when passing it to --script, it forces the script to run, even if a fingerprint doesn't match.

A very useful little feature.

[0xdf @0xdf_]

Really clear, concise explanation of use after free with an example from @MalwareTechBlog. Definitely worth 10 minutes of your time.

https://t.co/9LgHP8thGg

[LRQA Cyber Labs @LRQA_Cyber_Labs]

Introducing MalSCCM!

Today, we are releasing MalSCCM, a .NET tool by @The_Keeb which enhances PowerSCCM functionality and makes it easier to use over command and control channels.

https://t.co/InO8p0syFj

[S3cur3Th1sSh1t @ShitSecure]

Bypass conditional access policies for Azure? Try changing the user agent to mobile devices. 🙈 didn’t know that one before today - one colleague found this 🙌

[ippsec @ippsec]

Just uploaded a video on parsing Bloodhound Data with JQ, which allows us to create a lot of interesting lists. My favorite one is looking at passwords that have a set time newer than their last logon time. https://t.co/ZhbHN0KQyQ

[MANTANI Nobutaka @nmantani]

I have updated the comparison table of MOTW (Mark of the Web) propagation support of archiver software for Windows. The status of Bandizip has been corrected to "Yes", and the information of NanaZip (a 7-Zip fork) has been added. https://t.co/BIQMGYUHDA

[Chetan Nayak (Brute Ratel C4 Author) @NinjaParanoid]

A lot of times when I provide Brute Ratel demos, I get a tonne of questions on detection, so here goes a rant on how detections are usually built. First and the most basic detections are static signature based. (1/15)

[Alex Kozlov @b4cktr4ck2]

Loving these alternatives 😂

[Samir @SBousseaden]

apparently another windows utility to dump a process memory dtdump.exe (non present by default at least on my Win10x64)

[ProjectDiscovery @pdiscoveryio]

Unsure when your payload will get a pingback? And need to close the interactsh session for some reason? worry no more 😎 resumable session files are now supported in the newest Interactsh release.

Credits to @ldionmarcil for the idea.

#hackwithautomation #bugbounty #oast