e1abrador

Open-source tool maker and Penetration tester. Public tools here:

[e1abrador @e1abrador]

I have created a #CrackMapExec module to search for interesting files on compromised machines. Mainly focused when you have a large number of compromised machines and it is unfeasible to search 1 by 1 for files with useful information.
thx @mpgn_x64 for the awesome cme project!

[e1abrador @e1abrador]

@PiListingNews 3

[e1abrador @e1abrador]

@rami_hashimi done

[e1abrador @e1abrador]

@HarrySandh21970 @thedawgyg We (@nbk_2000 and me) made a talk about this in @Jhaddix course TBHMLive. If you purchased the course you should have access to the talk!

[e1abrador @e1abrador]

@thedawgyg @HarrySandh21970 On large scopes the best way of winning people using AI will be mastering the vertical and horizontal recon.

[JS0N Haddix @Jhaddix]

Day ONE of FIVE days of celebrating our 2 year ARCANUM-VERSARY! @arcanuminfosec

2nd Giveaway - We have 4 Swag Packs up for grabs!

Get a shirt, stickers, pens, a BADGE and more!

👍 1 Like = 1 Entry!
♻️ 1 Share = 2 Entries!

Winners announced 1/21!

enjoy our tshirt models @G0LDEN_infosec and @PhillipWylie 🫶

[Phillip Wylie @PhillipWylie]

To help celebrate @arcanuminfosec Information Security's two-year anniversary, @Jhaddix gave me 5 codes good for any Arcanum course to give away!

Winners will be announced on 1/22.

👍 1 Like = 1 Entry!

♻️ 1 Share = 2 Entries!

[JS0N Haddix @Jhaddix]

Day TWO of FIVE days of celebrating our 2 year ARCANUM-VERSARY! @arcanuminfosec

3rd Giveaway = FOUR seats to our new course by @the_IDORminator "Zero to [BAC] Hero" !

👍 1 Like = 1 Entry!
♻️ 1 Share = 2 Entries!

Winners announced 1/21! Syllabus link below 👇

[e1abrador @e1abrador]

@rickyedit 923

[e1abrador @e1abrador]

👀👀👀

[🕳 @sekurlsa_pw]

Certipy v5
▪️ESC16 (new)
▪️ESC13 & ESC15
▪️Post exploitation of ESC12 & ESC14
▪️LDAP Signing and LDAPS channel binding default enabled
▪️ Cert enrollment over HTTPS with channel binding enforced
▪️Improved detection, less false positives
▪️Wiki https://t.co/WTU8ivSbX6

[Aurélien Chalot @Defte_]

You have got a valid NTLM relay but SMB and LDAP are signed, LDAPS has got Channel Binding and ESC8 is not available... What about WinRMS ? :D

Blogpost: https://t.co/p2uwj2yKTQ
Tool: https://t.co/zMPpwtyFir

And also, big thanks to jmk (Joe Mondloch) for the collab' :D!

[JS0N Haddix @Jhaddix]

Next week is our next run of our Attacking AI course!

Check out the expanded syllabus ⬇️

https://t.co/1R8TLDlMBm

📢 Last Min Giveaway Time!

Two seats up for grabs, winner will be chosen Tuesday next week!

Each person can have up to 3 entries to the giveaway!

➡️Repost This Post = 2 Entries
➡️Like This Post = 1 Entry

[e1abrador @e1abrador]

@galnagli https://t.co/zFxsDdKikd

[e1abrador @e1abrador]

@0xd0m7 Un writeup no?? 🔥

[Matcluck @doopsec]

Just released SCCMHound! A BloodHound collector for SCCM. SCCMHound allows both attackers and defenders to construct BloodHound datasets using the vast
amount of information that is stored/retrievable through SCCM. Feel free to take it for a spin!

https://t.co/3J1IjEfDmO

[e1abrador @e1abrador]

@hasan_zmzm @nbk_2000 @_Ali4s_ Depends on how big the scope is, since there is only 24h you should optimize it as much as you can.

[e1abrador @e1abrador]

@UsmanMansha420 @nbk_2000 @_Ali4s_ I use public wordlists and custom ones. For permutations i use the default wordlist in dnsgen, and about resolvers, the trickest wordlist is a good one.

[e1abrador @e1abrador]

@UsmanMansha420 @nbk_2000 @_Ali4s_ I feel the same about passive sources. Subfinder works well, but I personally prefer diving deeper by understanding the service’s API through its documentation so i know 100% what is happening under the hood;)