Halil Dalabasmaz

Red Teamer

[samet @belleveben]

After 3 years, I just shipped Mergen v2 🛡️

Open-source macOS security audit tool. 85 CIS Benchmark checks, auto-fix, native SwiftUI app + Go CLI.

It doesn't just tell you your firewall is off. It turns it on this time.🔥

https://t.co/EUZgsx1QIJ

[Halil Dalabasmaz @hlldz]

@fr0gger_ @DarkCoderSc @vxunderground @0xAstr0 @d4rksystem @fumik0_ @kaganisildak @Glacius_ @Praetorian_GRD @Jochen16291934 @__Thanat0s__ @dreamkinn @yaps8 @Edode_ @ghost_pepper108 @Sh0ckFR @Hexacorn @Lexsek_ @T_8ase I really appreciate, it looks great.

[Halil Dalabasmaz @hlldz]

Call stack analysis is very popular these days. Another API that can be used for clean call stack in API calls and system calls is TrySubmitThreadpoolCallback/TpSimpleTryPost. Here is the PoC for proxying DLL loads: https://t.co/sHVIbHgF2u

[Halil Dalabasmaz @hlldz]

Pengyhash is fast 64-bit non-cryptographic hash algorithm. Here is the Go implementation https://t.co/tmTmmyczcj

[Halil Dalabasmaz @hlldz]

@dobinrutis I watched your presentation on Youtube, cool presentation and research. 👍 Also, active usage of RefleXXion in the field made me happy, thanks. 👊

[Halil Dalabasmaz @hlldz]

@nnrdgn @PicusSecurity Thanks Nurdoğan 😊👊

[Halil Dalabasmaz @hlldz]

I’m happy to announce that I’ve joined @PicusSecurity Red Team! 🥳

[Halil Dalabasmaz @hlldz]

@mindspoof @PicusSecurity Teşekkürler abi 😊👊

[Halil Dalabasmaz @hlldz]

@su13ym4n @PicusSecurity Thank you! 😊

[Halil Dalabasmaz @hlldz]

@Frknayar @PicusSecurity Thanks mate! 👊💪

[Halil Dalabasmaz @hlldz]

@SBousseaden @PicusSecurity Thanks mate!😊👍

[Halil Dalabasmaz @hlldz]

@danielhbohannon @PicusSecurity Teşekkürler Daniel. 😊👍

[Halil Dalabasmaz @hlldz]

@0x09AL @MDSecLabs @xforcered Congrats man!👌

[Halil Dalabasmaz @hlldz]

Here is the RefleXXion. It is a utility designed to aid in bypassing user-mode hooks utilised by AV/EPP/EDR etc.

https://t.co/gEihB7ZQHY

Thank you @peterwintrsmith for sharing this technique.

[Halil Dalabasmaz @hlldz]

@C5pider @0xCrashX 4/4 If you still insist on using a mod that will require you to mess with Padding, as far as I can see you are using Tiny-AES-C, I recommend reading this content. https://t.co/mUOvbMQ7Iw

[Halil Dalabasmaz @hlldz]

@C5pider @0xCrashX 3/4 For the CS way, I have two suggestions, it might be good for a little improvement.

1- If I'm not mistaken, the Beacon uses a fixed value for the IV value. You can randomize this.

2- You can use AES 256-Bit CTR mode. That way you don't have to deal with goddamn padding. :D

[Halil Dalabasmaz @hlldz]

@C5pider @0xCrashX You can do the key exchange just like Cobalt Strike did. I had done a similar integration for myself before, with a little improvement.

[Halil Dalabasmaz @hlldz]

“A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.”

Is there a better project description than this? I haven't seen it yet. 😅👌

https://t.co/T6SrLbkDsg