Burnout

Buy High and Sell Low

[encodedguy - jsmon.sh @3nc0d3dGuY]

Are you still reverse engineering large JS files manually?

Save hours of manual workload. Checkout https://t.co/10muV7baIG

> Scan a domain at Jsmon, go to Reconnaissance
> If the app is using GraphQL, you'll see easy-to-read GraphQL operations

[r0BIT @0xr0BIT]

shipping: WinSSHound

maps SSH access in AD as BloodHound paths. because Windows OpenSSH cheerfully ignores your "Deny Logon" GPOs (pre-2025) and on a default sshd_config every Authenticated User in the domain can walk right in. Why? Because Microsoft.

https://t.co/ONXuguz7r3

[CoinGecko @coingecko]

CoinGecko formulas are now available in Microsoft Excel ✨

Use =CG.PRICE(...) to get live prices for your favorite coins and 37M+ crypto assets, right in your spreadsheets.

See all 5 formulas in action ⬇️
https://t.co/dhwiy5HhNN

Bookmark this and tag your finance friends.

[Jakob @virtualloc]

Another day, another async BOF. With KeeLog, you can monitor KeePass instances and capture the master password as soon as its entered. https://t.co/ZSqKP5Ww1F

[Jakob @virtualloc]

Been very interested in Async BOFs lately and implemented a few for use with Conquest. The first implements Rubeus monitor as a BOF and notifies when TGTs are collected. The second monitors for clipboard changes and returns them. https://t.co/p7hmjv4kAq https://t.co/Kdo9FG9Fba

[Dirk-jan @_dirkjan]

Me trying to figure out Agent Identities in Entra ID. I really wonder who decided apps and service principals weren't already difficult enough to understand and went with a design that is even wayyy more complicated 😅.

[Omkar @psomkar1]

Interviewer : where do you see yourself in 5 years ?

Me :

[SpecterOps @SpecterOps]

NTLMv1 is still out there. And now it’s easier than ever to break.

@skylerknecht walks through how Google’s rainbow tables make NT hash recovery practical, no third-party service required.

Check it out! ⤵️ https://t.co/AoC1NFBNK1

[Alex Neff @al3x_n3ff]

Releasing one of my research tools: EVENmonitor🖥️

Inspired by LDAPmonitor, I implemented a monitoring tool for the Windows Event log in pure python. You can just attach it via the network and then filter for specific event IDs or keywords.

Available at: https://t.co/TpjEnIW7C0

[Fernando Fernandez @FinFerFer]

@Dinosn With Microsoft disabling RC4 for Kerberos come summer, will that affect Ntlmv2 or will it stick around for a few more iterations?

[Nicolas Krassas @Dinosn]

PSA: That 'Disable NTLMv1' GPO you set years ago? It’s lying to you. LmCompatibilityLevel set to 5 is not enough. https://t.co/DtaZX0MAkP

[Panos Gkatziroulis 🦄 @ipurple]

KrbRoastParser - a tool for parsing Kerberos packets from pcap files to extract AS-REQ, AS-REP and TGS-REP hashes https://t.co/8iKvMhS8Az

[kmkz @kmkz_security]

Example on what real-world #LLM usage in offsec looks like:

Built a full-stack #C2 100% usable:
.HTTP + DNS fallback
.jittered traffic, real UAs
.WS SOCKS5 pivot
.on-demand modules, no persistence
LLMs didn’t design it, they accelerate
Experience drives tradecraft, #LLMs amplify

[Nicolas Krassas @Dinosn]

Every Sliver C2 Tutorial Was Outdated. So I Wrote My Own https://t.co/czNggkmiwE

[Co11ateral @co11ateral]

LDAPNomNom

Can quietly and anonymously bruteforce Active Directory usernames at insane speeds from Domain Controllers by abusing LDAP Ping requests (cLDAP). No Windows audit logs generated. High speed ~ up to 50K/sec per server. You can go way beyond that with multiple servers in parallel

https://t.co/6NJ8ivxUiU

[DirectoryRanger @DirectoryRanger]

ProxyBlob. tool designed to create SOCKS proxy tunnels through Azure Storage services, by @quarkslab
https://t.co/bMv2y4fx4V

[mthcht @mthcht2]

ICMP data exfiltration is underestimated.
https://t.co/RoX2B6AN6i

ICMP traffic is often excluded from firewall log ingestion, and on endpoints most EDRs neither alert on this exfiltration method nor expose the ICMP payload content needed to build custom detections.

[Panos Gkatziroulis 🦄 @ipurple]

KslDump - Extraction of credentials from PPL-protected LSASS using only Microsoft-signed components https://t.co/pDHUeRw33I

[NK @Nikaiw]

meet VMkatz, https://t.co/eza4AXRuFT

[kapla @LorenzoMeacci]

Big thanks to @_RastaMouse @Octoberfest73 @KlezVirus @codex_tf2 — this took a fraction of the time it should have because of you all.