Sunand

Hacker | Security Researcher

[/r/netsec @_r_netsec]

I Could've Rickrolled the Entire FIFA World Cup. All I Needed Was My ID. https://t.co/ffuJsfOG9x

[7h3h4ckv157 @7h3h4ckv157]

Master the art of reverse engineering and binary exploitation. Train through an immersive terminal. Progress through the belt system. 📍

Source: https://t.co/enxuULFPeF

[RedTeam Recipes | RTR @RedTeamRecipes]

We dropped our complete OSED notes index on the blog. It’s a raw technical reference covering x86 assembly, PE structure analysis, format string primitives, and OS mitigation bypasses.

https://t.co/BDr6aJZO5J

#offsec

[0xor0ne @0xor0ne]

Papers on using LLMs for vulnerability detection

https://t.co/c0F7TkOvHp

#llm #infosec

[BRute Logic @BRuteLogic]

JWT Auth Bypass TestBed

https://t.co/qoYUYTxduT

Test your skills: 18 main tests with variations.

A proprietary tool with 40+ techniques for Brute One will be available this week to spot all these cases in the wild in a matter of seconds.

https://t.co/ThMs09G3Hp

[Alex Neff @al3x_n3ff]

SPN-less RBCD with NetExec🔥

While classic RBCD requires a computer account, you can use U2U authentication to perform RBCD with a normal user account, if a computer account is not available.

Thanks to @azoxlpf, you can now perform this attack with NetExec as well🚀

[Md Ismail Šojal 🕷️ @0x0SojalSec]

FULL REMOTE CODE EXECUTION on default nginx 1.30.0 no config changes needed. 🫠

Verichains a deadly exploit chain combining Nginx-Rift (CVE-2026-42945) + Nginx-PoolSlip (CVE-2026-9256).

2-byte heap pointer overwrite & heap over-read then ASLR bypass to arbitrary command execution via system() on connection teardown.

[_SiCk @encrypted_past]

Vendors++
Added:
GL.iNet
Hikvision
Dahua

Not all of them encrypt, but nice to have.
https://t.co/eMD7qL6Nhp

[R.B.C. @G3tSyst3m]

My latest blog post: Using BYOVD to loot LSASS bypassing HVCI and all other security protections built in to Windows 11 25h2:

https://t.co/xuKSBQSwYr

[Nebula Security @nebusecurity]

Introducing nginx-poolslip, a fresh RCE for the the latest nginx release 1.31.0.

nginx-rift has been patched, but our security agent Vega has found a new 0 day.

We will release the full technical writeup with ASLR bypass 30 days after the patch on https://t.co/LAhOC5UHrp.

[impulsive @weezerOSINT]

This is Microsoft's 5th WinRE BitLocker bypass in 3 years. CVE-2022-41099, CVE-2023-21563, CVE-2024-20666, BitUnlocker, now YellowKey

[impulsive @weezerOSINT]

How it works:

1. Recovery tools look for a config file called RecoverySimulation.ini on the OS drive
2. If Active=Yes, it enables "test mode" for the recovery tools
3. Test mode unlocks your BitLocker drive but a flag called FailRelock tells it to skip relocking
4. cmd.exe spawns with full access to your "encrypted" drive

[Nicolas Krassas @Dinosn]

Awesome Large Language Models for Vulnerability Detection https://t.co/p0DR30TQEg

[DirectoryRanger @DirectoryRanger]

ADWSDomainDump. Active Directory information dumper via ADWS (Active Directory Web Services)
https://t.co/EECO9NOWMl

[obscaries ❘ AppSec @obscaries]

Found a pretty solid fuzzing resource for web security testing 👀

👉 https://t.co/JtQVcqiQzH

Contains:
• endpoint discovery wordlists
• XSS/SSRF/LFI payloads
• parameter fuzzing lists
• Burp Intruder payloads
• recon & web fuzzing dictionaries

Useful with:
ffuf • Burp Suite • dirsearch • arjun

Good repo for bug bounty & web app testing workflows.

#BugBounty #CyberSecurity #WebSecurity #InfoSec #EthicalHacking

[Co11ateral @co11ateral]

DeadMatter

Extracts LSASS credentials from memory dumps. Lightweight. Can be used to bypass AV/EDR. Usually is paired with DumpIt as both of them don't need GUI.

Tested with Microsoft Defender and Kaspersky

https://t.co/phV5wNPfBZ

@three_cube @_aircorridor #edr #apt #redteam

[Vivek | Cybersecurity @VivekIntel]

Claude-Red: Turn Claude into a Red Team Operator with 38 Offensive Security Skills. 🤖💀

Prebuilt SKILL .md modules for SQLi, XSS, EDR evasion, exploit dev, OSINT & more — structured like real attacker workflows.

AI is powerful, but garbage input = garbage output. Skills define capability.

#RedTeam #AIsecurity #CyberSecurity
https://t.co/QraHdkdU0A

[Alex Neff @al3x_n3ff]

New NetExec module: mssql_cbt🔥

Relaying to MSSQL can be a hidden gem when you are out of options. The only protection against relaying to MSSQL is to enforce Channel Binding Tokens (CBT). Thanks to @Defte_, NetExec now has a module that checks whether this CBT is required.

[Iceman @herrmann1001]

The latest Proxmark3 release is called BREAKMEIFYOUCAN!

Not a random name.

That is the actual 3DES factory default key NXP burned into every MIFARE Ultralight C they shipped since 2008.

Somebody finally broke it properly.

The paper drops the keyspace from 2^112 down to 2^28.

Counterfeit cards fall in under 60 seconds from a single card interaction. The tooling is merged: https://t.co/2CYKrRdv22

#Proxmark3 #RFID #NFC #MifareUltralightC #NXP #OpenSource

[DirectoryRanger @DirectoryRanger]

TokenSmith. generates Entra ID access & refresh tokens on offensive engagements, by @JumpsecLabs
https://t.co/FG7GijDEJj