dcL0ver

Blue teamer, Active directory lover

[SpecterOps @SpecterOps]

Create a folder called (calc). Shift+Right click « Open PowerShell Window here » and boom you have a command injection.

@podalirius_ found two command injection vulnerabilities in Windows Explorer's context menus, both exploitable since 9 years. https://t.co/LNNTpKeDnJ

[SpecterOps @SpecterOps]

In his latest research, @_xpn_ tears apart VS Code Dev Tunnels and finds a C2 framework underneath — REST → WebSocket → SSH → MsgPack RPC, remote exec, file ops.

Find the Ouroboros tool and protocol breakdown at the link! 👇 https://t.co/U75Ynzr8Sw

[Synacktiv @Synacktiv]

@ToulouseHacking 📡 Wi-Fi pentesting in 2025 & WPA3 bypasses: https://t.co/GYZ4zSkKCn

🛡️ Cross-domain & cross-forest RBCD: https://t.co/cJsnify0qQ

🏴 THCON pre-challenge write-up: https://t.co/OLTH3I0Ax2

[Synacktiv @Synacktiv]

Back from @ToulouseHacking 2026 🔥

Our teams had the pleasure of speaking once again this year, sharing research and real-world offensive security insights from the field:

📡 Wi-Fi pentesting in 2025 & WPA3 bypasses - Quentin
🛡️ Cross-domain & cross-forest RBCD - Simon
🏴 THCON pre-challenge write-up - @0xf4b

Great job to all of them 👏

[S3cur3Th1sSh1t @ShitSecure]

New small Blog Post from my side - anyone faced 429 too many requests on Microsoft Graph in your projects? This blog provides more insights on how to bypass those. 🫡

https://t.co/v3DlLWzFqq

[Yuval Gordon @YuG0rd]

@4ndr3w6S pulled me into this rabbit hole, and it was a fun one.

[Andrea P @decoder_it]

I published a new "security research" post, and for once, it’s not about Windows 😅
This time I took a look at the myAudi connected vehicle platform and its APIs..🤓
Curiosity drives security research, no matter the target
Read it here 👇
https://t.co/QLYEHaMI29

[Synacktiv @Synacktiv]

This second blogpost concludes @yaumn_'s research on #Windows authentication reflection.
He discloses the new Kerberos authentication coercion technique he discovered to remotely compromise Windows systems 💥

A little bonus is even included at the end 👀👇
https://t.co/RsJHxCdIGe

[Synacktiv @Synacktiv]

Authentication reflection attacks are still not dead!

In our new blogpost series, @yaumn_ shares his journey into bypassing the mitigations of CVE-2025-33073 to pop SYSTEM shells again🚀

👇
https://t.co/pbZ2KjXq7Q

[Marc André Tanner @marcandretanner]

We successfully used winget as a PowerShell execution proxy for initial access. While in that setting you can't get around the exe invocation itself, it works well if the feature isn't disabled.

https://t.co/6yNWC6R2DZ

Next usecase: lateral movement? 👀

[Vivek | Cybersecurity @VivekIntel]

🧬 DLLHijackHunter — Automated DLL Hijacking Discovery & Exploitation Validation

Not just detection — real execution proof.

• Finds hijack paths (services, tasks, COM, UAC bypass)
• Filters false positives (ACL + KnownDLL + API sets)
• Canary DLL → confirms actual execution
• Scores findings by exploitability

From misconfig → confirmed privesc path

🔗 https://t.co/au6AkI8PSW

#RedTeam #WindowsSecurity #PrivEsc

[Andrea P @decoder_it]

LmCompatibilityLevel=5 on your DCs but still seeing NTLMv1 auth succeed? The PDC's level is the only one that counts for the whole domain. Yeah, NTLM is deprecated… Link to post👇
https://t.co/ESE2EB4vst

[obscaries ❘ AppSec @obscaries]

An absolute goldmine for bug bounty hunters 👀💥

A massive collection of real, disclosed HackerOne reports — organized by vulnerability type, impact, and target 🎯

If you want to go beyond theory and actually understand how real-world exploits work… this is it.

Study patterns. Learn impact. Hack smarter. 🚀

🔗 Source: https://t.co/yMey4fzDbn

#BugBounty #InfoSec #CyberSecurity #EthicalHackin

[0x12 Dark Development @Salsa12__]

Combined both projects from the repo: using BYOVD we terminate Windows Defender, then perform a permanent disable without triggering tamper protection

I’ll push the commit in a few minutes, but I’m unsure about publishing it on Medium, what do you think?

https://t.co/oTmt6VvSa8

[SpecterOps @SpecterOps]

SCCM is everywhere, but realistic testing environments aren’t.

In his latest blog post, @_Mayyhem expands on work by @synzack21 and @badsectorlabs with a Ludus-based SCCM lab for research and attack path testing.

Read more ⬇️ https://t.co/1rtXFCC65H

[Swadesh Kumar @swadeshkumar_]

🚨Breaking: Anthropic engineers revealed a simple trick they use internally.

Claude agents can now remember how to improve themselves.

A file called:

AGENT_LEARNINGS.md

The AI updates this file whenever it makes a mistake.

Inside it:

• mistakes it made
• patterns to avoid
• better approaches

Before starting new tasks, the agent reads the file.

Result?

The agent gets smarter over time without retraining the model.

This is called external memory scaffolding.

Expect this pattern to show up in every serious AI agent system.

♻️ Repost to share with your audience.
✔️ You can follow @swadeshkumar_, for more internal updates.

[Moritz @m_r_tz]

The FLARE team now freely distributes its quality reverse engineering and malware analysis educational content at https://t.co/bGCIjBfD3C. Launched with:
- Malware Analysis Crash Course
- Go Reversing Reference
- Intro to TTD

[DirectoryRanger @DirectoryRanger]

WMEye. tool for performing Lateral Movement using WMI and remote MSBuild Execution
https://t.co/wi9ZdNVrof

[SpecterOps @SpecterOps]

Relayed NTLM creds are powerful, if you can use them.

@senderend shows why browsers fail through ntlmrelayx SOCKS and introduces ghostsurf to make NTLM-authenticated web apps accessible.

Read more ⤵️ https://t.co/BdtzoKquD1

[Simone Margaritelli @evilsocket]

Mongoose: Preauth RCE and mTLS Bypass on Millions of Devices (including the International Space Station apparently ...)

https://t.co/7oGqUjMH8V