BlancoHak

Jack of all trades!!! | CISSP | CISM | eJPT | C|EH | MCAF | GDSA |GCSA | GCPN | Eth3x Security Group Founder, Security Architect, DJ, Skater, ethical hacker

[MAX @MAXdeg0]

SOMEONE JUST DROPPED A SERIOUS WEAPON FOR RED TEAMERS.

An open source red team platform that automates multi step attack paths across complex environments.

Meet ARES.

Give it a target and a goal like domain_admin or full_compromise, and it plans an attack path to get there.

→ 66 active modules covering 60+ MITRE ATT&CK techniques

→ Targets Active Directory, Windows and Linux

→ Supports AWS, Azure and GCP

→ Uses BloodHound data to map attack paths

→ Built in scope guard restricts testing to approved IP ranges

→ Generates detailed reports in PDF, HTML, Markdown and JSON

MIT licensed. Self hostable. Completely open source.

One platform. Multiple attack paths. Automated red team testing.

Only test systems you own or have permission to assess.

REPO BELOW

[Cyber Security News @The_Cyber_News]

‼️ Hacktober – Cyberattack Wave Hits PHP, Node.js, Binance, LiteLLM, Pentagon, and a Few More

Details: https://t.co/nm8kBuRF96

October brought a heavy run of cybersecurity disclosures involving cryptocurrency exchanges, web servers, AI tools, software packages, government records, and grocery chains.

Binance investigated billions of dollars in unauthorized transactions, PHP issued emergency fixes, and a malicious LiteLLM release put developer credentials at risk. Other incidents involved Railway, OpenCode, Polymarket, Coinbase, Cursor, eMudhra, and Capcom.

Together, these reports show how exposed credentials and trusted software channels can turn a limited intrusion into a much larger security problem.

#CybersecurityNews

[TryHackMe @tryhackme]

🚨 Yesterday, PHP2Shell made headlines. Today, we're already teaching you how to exploit it. Yeah, we're THAT fast⚡ Two critical PHP vulnerabilities. 9.2 CVSS. Unauthenticated RCE.
And you can already exploit the chain, bypass ASLR, and pop a shell in our latest recent threat room.
Hackers don't wait. Neither do we 🟢 Go Get hands-on: https://t.co/76TcpTLxpr

[Cyber Security News @The_Cyber_News]

🔐 Claude AI Solves 25-Year NSA Cryptography Mystery in Just 30 Minutes

Details: https://t.co/BpRJ7Pn7nz

Anthropic says an internal Claude research model has traced the origins of five NSA-suppxaxxlied elliptic curve seeds in under 30 minutes, answering a cryptography question that remained open for roughly 25 years. The finding explains how important public security parameters were chosen, rather than exposing secret keys or breaking encryption.

In a report published October 16, 2026, researchers said the seeds behind NIST curves P-192, P-224, P-256, P-384, and P-521 came from lrand48, an older C library random-number generator initialized with Unix timestamps. The result challenges a long-running theory that the values were hashes of humorous phrases.

#cybersecuritynews

[MAX @MAXdeg0]

THIS IS F**KING INSANE

i found an open source AI pentesting tool that deploys multiple agents to automate security testing.

and it does more than just scan.

PENTEST-SWARM-AI can:

→ discover subdomains and live hosts

→ scan ports and find vulnerabilities

→ validate findings with evidence

→ generate exportable reports

→ connect to Claude Desktop and Cursor

→ automate scans through GitHub
Actions

multiple AI agents. one security testing workflow.

only test systems you own or have permission to assess.

REPO BELOW

[Nitin Gavhane @NitinGavhane_]

60 Cybersecurity Tools Every Security Researcher Should Know

1. Nmap — Network scanning
2. Masscan — High-speed port scanning
3. RustScan — Fast port discovery
4. Naabu — Port scanning
5. Amass — Attack surface discovery
6. Subfinder — Subdomain enumeration
7. Assetfinder — Asset discovery
8. httpx — HTTP probing
9. dnsx — DNS reconnaissance
10. Shodan — Internet asset search
11. Censys — Internet-wide asset discovery
12. SecurityTrails — DNS & domain intelligence
13. theHarvester — OSINT collection
14. SpiderFoot — Automated OSINT
15. Maltego — Link analysis & OSINT
16. Recon-ng — Recon framework
17. Burp Suite — Web security testing
18. OWASP ZAP — Web application testing
19. Caido — Web security testing
20. ffuf — Web fuzzing
21. Gobuster — Directory/DNS fuzzing
22. Feroxbuster — Content discovery
23. Dirsearch — Directory enumeration
24. Katana — Web crawling
25. Arjun — HTTP parameter discovery
26. ParamSpider — Parameter mining
27. Nuclei — Vulnerability scanning
28. Nikto — Web server scanning
29. SQLMap — SQL injection testing
30. Dalfox — XSS scanning
31. Semgrep — Static code analysis
32. Ghidra — Reverse engineering
33. IDA — Binary analysis
34. Binary Ninja — Reverse engineering
35. radare2 — Binary analysis
36. JADX — Android reverse engineering
37. Frida — Dynamic instrumentation
38. apktool — Android APK analysis
39. MobSF — Mobile security testing
40. Wireshark — Network analysis
41. tcpdump — Packet capture
42. Zeek — Network security monitoring
43. Suricata — IDS/IPS
44. Snort — Network intrusion detection
45. Volatility — Memory forensics
46. Autopsy — Digital forensics
47. Ghidra — Malware/binary analysis
48. YARA — Malware detection
49. CyberChef — Data transformation & analysis
50. Hashcat — Password auditing
51. John the Ripper — Password auditing
52. Hydra — Authentication testing
53. Metasploit — Security testing framework
54. BloodHound — Active Directory analysis
55. Impacket — Windows/network protocols
56. NetExec — Network/AD security testing
57. Mimikatz — Windows credential research
58. Trivy — Container/IaC scanning
59. Grype — Container vulnerability scanning
60. OpenVAS — Vulnerability assessment

A strong security toolkit isn't about having 1,000 tools.

It's about knowing:

Recon → Enumerate → Validate → Exploit safely → Document → Report

Learn the fundamentals behind the tools, and you can adapt to almost any environment.

#CyberSecurity #InfoSec #EthicalHacking #BugBounty #PenTesting #SecurityResearcher #AppSec #RedTeam #BlueTeam #OSINT #DFIR #DevSecOps

[CloudSecurityAlliance @cloudsa]

Try running a standard STRIDE threat model on a multi-agent system where Agent A delegates to Agent B, who calls a tool, who spins up Agent C — and nobody scripted that path. Traditional frameworks assume a fixed app boundary. Agentic AI doesn't have one. MAESTRO threat-models all 7 layers of the stack: foundation models, data ops, agent frameworks, deployment, observability, security, and the ecosystem around them. https://t.co/3w93oo29WO #AgenticAI

[RabiX Security @rabixSecurity]

🌐🔍 What Can Your Public IP Reveal?
A quick demo showing how public IP information can reveal an approximate location, ISP, and timezone. 🔐
🛡️ Privacy awareness only. Protect your IP address.
#CyberSecurity #OnlinePrivacy #Linux #CyberAwareness

[Shubham Sharma @Shubham_pen]

AAA is the backbone of access control—but can you clearly explain what Authentication, Authorization, and Accounting each actually do?
Credit to @xmodulo
#cybersecurity #cybersecurityawareness #infosec #SOC #Networks #cheatsheet

[Shubham Sharma @Shubham_pen]

Proxy vs Reverse Proxy
Credit to @Hamzaonchain
#cybersecurity #cybersecurityawareness #infosec #SOC #Networks #cheatsheet

[Nicolas Krassas @Dinosn]

PaperCut releases second emergency patch for exploited flaws https://t.co/nqJtTdwSAY

[BlancoHak @BlancoHak]

Great year @defcon 34!!!! Thank you all to the security and hacker community! Competitions, challenges, and some......

[BlancoHak @BlancoHak]

Great year @defcon 34!!!! Thank you all to the security and hacker community! Competitions, challenges, and some......

[Appwrite @appwrite]

claude opus finding a bug in perfectly working code

[Cyber Security News @The_Cyber_News]

⚠️ Microsoft Teams Vulnerability Allows Hackers to Perform Spoofing Attacks

Source: https://t.co/DtB6z8Ni05

A newly disclosed security vulnerability in Microsoft Teams could allow attackers to spoof local devices, raising concerns for enterprises and individual users who rely on the platform for daily communications.

The flaw exposes a critical weakness in how Microsoft Teams handles file and directory access, potentially allowing an attacker to manipulate or impersonate trusted elements within the application.

At its core, the vulnerability stems from files or directories in Microsoft Teams being accessible to external parties.

#cybersecuritynews #Microsoftteams

[Umesh Kumar Yadav @Umesh__digital]

Dennis Ritchie created C in the early 1970s without Google, Stack Overflow, GitHub, or any AI ( Claude, Cursor, Codex) assistant.

- No VC funding.
- No viral launch.
- No TED talk.
- Just two engineers at Bell Labs. A terminal. And a problem to solve.

He built a language that fit in kilobytes.

50 years later, it runs everything.

Linux kernel. Windows. macOS.

Every iPhone. Every Android.

NASA’s deep space probes.

The International Space Station.

> Python borrowed from it.
> Java borrowed from it.
> JavaScript borrowed from it.

If you have ever written a single line of code in any language, you did it in Dennis Ritchie’s shadow.

He died in 2011.
The same week as Steve Jobs.
Jobs got the front pages.
Ritchie got silence.

This Legend deserves to be celebrated.

[JNS @_devJNS]

"i use Linux, btw"