Tiago Sintra

Code breaker

[Tiago Sintra @henshinpt]

@NVIDIAGeForce #GeForceRTX50

[Tiago Sintra @henshinpt]

@NVIDIAGeForce #RTXSUPER

[Rémi GASCOU (Podalirius) @podalirius_]

Ever wanted to trigger a #NTLM authentication to a machine using every possible RPC call ? You can do this using #Coercer 🥳🎉

This tool automatically detects available pipes and protocols and call every possible functions to trigger an #authentication.

https://t.co/6aVELSP4NC

[Filip Dragovic @filip_dragovic]

Spooler service disabled, RPC filters installed to prevent PetitPotam and File Server VSS Agent Service not installed but you still want to relay DC authentication to ADCS?
Don't worry MS-DFSNM have your back ;)

https://t.co/idwMnM8nIV

[Tiago Sintra @henshinpt]

@NinjaParanoid Sign me up!

[Tiago Sintra @henshinpt]

@Guillaume_Lopes Thanks! I found that article recently too. Great content there and complemented my research.

[Tiago Sintra @henshinpt]

Does anyone know a good method of hooking into methods in Java applications similarly to what Frida does but for non-Android applications?

[Tiago Sintra @henshinpt]

@TheLaluka @cyber_advising Nice blog post! I've discovered that JFR exploit pretty much at the same time as you did :) Some tips from my research: You can switch that to a POST to make it more stealthy and use the "name" parameter to inject your payload

[Tiago Sintra @henshinpt]

@morisson Tsunamis em Portugal?

[Tiago Sintra @henshinpt]

@morisson Inclui a justificação e tudo: "Prefiro criar o objeto desde o início, mas há alturas em que temos de trabalhar com um haxixe primeiro." 😂

[Tiago Sintra @henshinpt]

@darkpills @Alra3ees I agree, the payload seemed to trigger when the user visited the profile page. The request is client side, not server side.

[Flashback Team @FlashbackPwn]

New Year's special - learn how to take full control of your neighbor's router with @pedrib1337 and @RabbitPro!

https://t.co/n85Xj4O1u0

[SecurityTrails, A Recorded Future Company @securitytrails]

Want to get more credits for SecurityTrails API™?

Just retweet this tweet and you will get 100 RECURRING API CREDITS 🎉

Ends 28 Nov 2020, 3pm EST. Make sure we can PM you to ask for the email address you signed up with.

[Pedro Oliveira @kanytu]

Checkout my new writeup on how could a website steal all your Firefox cookies remotely 📱🐛.

CVE-2020-15647: Arbitrary local file access in Firefox for Android

#MobileSecurity #AndroidSecurity #Android #BugBounty

https://t.co/8vuuSulfED

[Tiago Sintra @henshinpt]

@infosec_au @assetnote Cool, looking forward to it. Although it would be nice to have it written on a blog post too

[Orange Tsai 🍊 @orange_8361]

How I Hacked Facebook Again! Unauthenticated RCE on MobileIron MDM (slides inside) https://t.co/Nm9bMjm5wU

#HITCON

[MDSec @MDSecLabs]

Introducing FireWalker: A New Approach to Generically Bypass User-Space EDR Hooking https://t.co/auVvmbTw3v by @peterwintrsmith #redteam #firewalker #MDSec

[OffSec @offsectraining]

We have an announcement about our Cracking the Perimeter course. CTP will be retired this year, with the last date for purchase being October 15, 2020. Please read our update for info about what's happening and why: https://t.co/OXyFu2Si62