WHmacmac

ptester/ red teamer wannabe, OSCP, OSWE

[7h3h4ckv157 @7h3h4ckv157]

claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.mdfile that primes Claude with expert-level methodology for a specific attack surface from SQLi to shellcode, EDR evasion to exploit development.

Resource: https://t.co/0XvEqoqPfv

[Nicolas Krassas @Dinosn]

I built an open-source library of 700+ cybersecurity skills for AI coding agents -- covers DFIR, threat hunting, cloud security, and more https://t.co/vM5SgmXCrO

[Tom Dörr @tom_doerr]

Guide to Windows identity and Kerberos research

https://t.co/4S05BfOje9

[AISecHub @AISecHub]

Red Team Operations Architecture Map

A single HTML file that covers the full kill chain from infrastructure setup to impact. It maps out how techniques actually chain together - 28 attack flow chains showing real-world operator workflows, from initial access through lateral movement to domain compromise. Things like ZIP → LNK → DLL Sideload, Device Code Phish → Token Theft → Cloud Lateral, NTLM Reflection → LDAPS Relay → Full Domain Compromise.

119 technique cards broken down across C2, evasion, injection, persistence, credential access, privilege escalation, AD attacks, cloud ops, MOTW bypass, vishing, AI-assisted operations, and more. Each card covers the why, not just the what detection surfaces, OPSEC tradeoffs, and vendor-specific nuances for CrowdStrike, Cortex, SentinelOne, and Defender.

No frameworks, no dependencies. One HTML file, works offline, open it in a browser and go.

Source: https://t.co/1TBT1IPJLN

[Oliver Prompts @oliviscusAI]

ElevenLabs just lost its moat 🤯

Someone just dropped Voicebox, and it clones any voice from just a 3-second audio clip, running 100% locally on your machine.

100% Open Source

[Print3M @Print3M_]

Awesome real-life RedTeam infrastructure overview by @0XDbgMan 🔥🔥🔥 Juicy.

https://t.co/CzFTgMNknl

[Nav Toor @heynavtoor]

🚨BREAKING: Microsoft just solved the "Agent Loop" problem.

Agent Lightning is an open-source framework that lets agents learn from their own mistakes using Reinforcement Learning.

Your agent fails a task → Agent Lightning analyzes why → Updates the prompt automatically → Next run succeeds.

100% Opensource.

[Tom Dörr @tom_doerr]

Orchestrates Codex, Gemini, and Claude for parallel task execution

https://t.co/48Kt9hUoMF

[Logisek @logisekict]

🚀 AZexec: New Release Out Now!

Big update with a ton of new offensive capabilities added:

- Lockscreen enumeration: detect Windows lockscreen accessibility backdoors
- Intune enumeration: enumerate Endpoint Manager–managed devices and configuration
- Password spraying: two-phase workflow with validated usernames to reduce lockouts
- Local authentication mode: target cloud-only (non-federated) accounts
- OAuth2 delegation enumeration: identify consent-based impersonation paths
- Remote command execution: execute commands on Azure VMs and devices
- PI execution method: execute as another user via process injection
- Empire execution: deploy Empire stagers for C2 access
- Meterpreter execution: deliver Metasploit payloads
- Spidering: enumerate and optionally download files from storage, VMs, and devices
- File transfer: get and put files across VMs, Arc devices, and Azure storage
- Credential extraction: dump credentials via SAM, LSA, NTDS, tokens, DPAPI, and more

- https://t.co/pn75EvMlKO

#Azure #RedTeam #OffensiveSecurity #CloudSecurity #Pentesting #PenTest #Offsec #Infosec #Logisek

[Florian Roth ⚡️ @cyb3rops]

Rapid7 dropped a write-up on the Notepad++ update-chain abuse and - finally - it comes with real IOCs

- update.exe downloaded from 95.179.213[.]0 after notepad++.exe -> GUP.exe
- file hashes for update.exe / log.dll / BluetoothService.exe / conf.c / libtcc.dll
- network IOCs incl. api[.]skycloudcenter[.]com (-> 61.4.102[.]97), api[.]wiresguard[.]com, 59.110.7[.]32, 124.222.137[.]114

by @rapid7
https://t.co/rrespJ9Ju0

[Trading 212 @Trading212]

The same Trading 212 experience, now with crypto. Invest with 0 commission.

[Black Hills Information Security @BHinfoSecurity]

"By default, a domain account can configure RBCD on themselves or any resource they control [which] lets the service decide who may delegate to it instead of the domain."
Read more: https://t.co/ahoGUBed81

Abusing Delegation with Impacket (Part 3): Resource-Based Constrained Delegation
by: Hunter Wade
Published: 11/26/2025

[Six2dez 🇵🇸 @Six2dez1]

Burp AI Agent is now public

MCP-powered AI agent (and server) living inside Burp. Instead of a chat next to it, extends itself: tools, actions, live traffic and findings. AIO to reduce context switching while testing

Repo: https://t.co/tSIHsmY4wE
Docs: https://t.co/khQnwiJ2ZE

[Claude Code Changelog @ClaudeCodeLog]

1/3: Claude now supports authorized security testing, CTFs, and educational security work (not just defensive). It still refuses harmful use: destructive techniques, DoS, mass targeting, supply chain compromise, and malicious detection evasion. Dual-use tools require explicit authorization context.

Diff: https://t.co/oTMNVRdIWb

[Black Hills Information Security @BHinfoSecurity]

"Prompt Injection: The AI version of talking your way past the bouncer."
Read more: https://t.co/SsemN5HbRe

Getting Started with AI Hacking Part 2: Prompt Injection
by: Brian Fehrman
Published: 10/8/2025

[SpecterOps @SpecterOps]

WSL2 is a powerful attacker hideout because it runs as a separate Hyper-V VM, and defenders rarely monitor it.

Daniel Mayer explains how attackers pivot into WSL2 and what it took to build tooling that works across WSL2 versions.

Read more ⤵️ https://t.co/TaPsDDW4Cq

[Google Research @GoogleResearch]

Announcing our latest open medical AI models for developers: MedGemma 1.5, which is small enough to run offline & improves performance on 3D imaging (CT & MRI), & MedASR, a speech-to-text model for medical dictation. Both available on Hugging Face + Vertex AI. https://t.co/jPm4UodeAH

#MedGemma #HealthAI #GenerativeAI

[Black Hills Information Security @BHinfoSecurity]

2026 is here—time to refresh that toolkit!

Atomic Red Team:
Atomic Red Team Hands on Getting Started Guide - https://t.co/zQzBdAbZBd

Why? Exactly are you not using Atomic Red Team? - https://t.co/ctlCxcPU9O

DeepBlueCLI
DeepBlueCLI - Tactical IR - https://t.co/wx1YlaaG4e

Threat Hunting Toolkit
Looking for Needles in Needlestacks w/ Threat Hunting Toolkit - https://t.co/VSG2vWRe8u

Bloodhound:
A Blue Team's Perspective on Red Team Hack Tools - https://t.co/DR05O8D4fv

RITA:
RITA - Finding Bad Things on Your Network Using Free and Open Source Tools - https://t.co/s9fXnI0aFr

Zeek:
Introduction to Zeek Log Analysis w/ Troy Wojewoda - https://t.co/dqtz0cgedd

Wireshark:
Getting started with Wireshark - John Strand - https://t.co/XjUK5AIoFx

Search Engine:
How to Design and Execute Social Engineering Calls w/ John Malone - https://t.co/PwbInooDcY

[Steven Lim @0x534c]

This article explores a novel attack technique that combines Ghost SPNs and Kerberos reflection to elevate privileges on SMB servers, highlighting a critical gap in traditional detection methods.

It details how attackers can exploit stale or misconfigured Service Principal Names (SPNs) in Active Directory—termed "Ghost SPNs"—to manipulate Kerberos authentication and reflect service tickets back to the SMB server, gaining elevated access. The technique bypasses common defenses like LDAP filtering and SPN hygiene, making it stealthy and potent. Semperis emphasizes the need for proactive detection strategies and shares insights into identifying vulnerable configurations and mitigating the threat.

https://t.co/xcSvOEyrdk