Gleb Cherbov

[Steph @w34kp455]

Here are a few thoughts about #RockYou2024(2021) while the hype train is running to the station "Everyone hack3d" with a stop at "why it's useless". Obviously, most compilations suffer from the garbage inside, and it's always better to know how the wordlist was crafted.

[Gleb Cherbov @cherboff]

@fofabot Fortinet or Fortnite who cares at all :D

[Gleb Cherbov @cherboff]

Played around with ChatGPT for pentest reporting.
Still a long way from making us unemployed anytime soon. But yeah! It can speed up a boring routine😺

[Dmitry Chastuhin @_chipik]

The ability to look at the entirety of a situation to see the bigger picture is critical, especially for application security.

What's the point of audits if all the vulnerabilities found remain in 50-page pentester reports or ci/cd Pipeline artifacts?

https://t.co/eWfS1havU2

[Steph @w34kp455]

#ChatGPT is fantastic in case you need to deal with regular expressions.

[Хабр @habr_com]

Полевой набор пентестера

Ребята из Digital Security рассказывают о составе типового полевого набора, который пентестеры берут с собой, выезжая для проведения анализа беспроводных сетей или проектов в формате Red Team: https://t.co/w8L08LJWei

[Gleb Cherbov @cherboff]

@hakluke Informative weaknesses mentioned in report is not making it less stronger. Just do it in a proper way! That's why we have an optional "weakness" flag for every finding reported. So it is pretty simple to separate them to different report sections with no info trash in main parts.

[Gleb Cherbov @cherboff]

@hakluke Informative weaknesses mentioned in report is not making it less stronger. Just do it in a proper way! That's why we have an optional "weakness" flag for every finding reported. So it is pretty simple to separate them to different report sections with no info trash in main parts.

[Gleb Cherbov @cherboff]

@1oximin Unfortunately, there are no detailed howto build guideline at the moment. If you have issues with it feel free to ask with DM.

[Gleb Cherbov @cherboff]

New Phantap https://t.co/vhPTxJsSim tool looks very useful and it must have a perfect fit and run on a YAUHD device
https://t.co/bGUyn57sF9

[Gleb Cherbov @cherboff]

@w34kp455 Gratz! Now you can literally read out your cat

[Steph @w34kp455]

Hey everyone! I just launched a yet-another-new-free- project for subdomain discovery with online tools, screenshots, and automation. So it's time to have a look!
#pentest #bugbounty

[Gleb Cherbov @cherboff]

just curious how much androids in use may suffer the same and will be never patched

[Mathy Vanhoef @vanhoefm]

Another enterprise WPA2 implementation flaw: subject name (hostname) of the server was checked using the substring function instead of doing an exact compare.

[Gleb Cherbov @cherboff]

@GuhnooPlusLinux @_nwodtuhs Sounds a lot like YAUHD https://t.co/bGUyn57sF9

[Gleb Cherbov @cherboff]

@TihanyiNorbert @kmkz_security actual question is since when defender should classify such behaviour(socket opening/cmd spawn) as malware?

[Cyber Advising @cyber_advising]

Microsoft Exchange Deserialization RCE (CVE-2021–42321)

PoC
https://t.co/jlCNoOlaBw

[OWASP Amass @owaspamass]

It's great to see the @owasp #Amass Project alongside these excellent #security tools and integrated with @_hexway Hive!

#infosec #pentest #osint #redteam

[Charlie Bromberg « Shutdown » @_nwodtuhs]

Here is a first draft on an NTLM relay mindmap 🙂 from authentication coercion to post-relay exploitation. I'll gladly update/correct it if you think there are things wrong or missing.

➡️Featured on The Hacker Recipes https://t.co/0y4cOkMcTb

[Ex Android Dev @ExAndroidDev]

Check out my new blog post about AD CS relay attack
https://t.co/BucDQXjh9I
#pentest #redteam

[PT SWARM @ptswarm]

💥Easy RCE Ports

Java RMI: 1090,1098,1099,4444,11099,47001,47002,10999
WebLogic: 7000-7004,8000-8003,9000-9003,9503,7070,7071
JDWP: 45000,45001
JMX: 8686,9012,50500
GlassFish: 4848
jBoss: 11111,4444,4445
Cisco Smart Install: 4786
HP Data Protector: 5555,5556

#ptswarmTechniques

[Gleb Cherbov @cherboff]

@sh2kerr And which Linux distro it was based on at the beginning?