Init1Security

Elevating security with expert offensive strategies

[sagitz @sagitz_]

Today we disclose PHP2Shell - remotely exploitable memory corruptions in PHP

WordPress pre-auth RCE: ✅
Drupal pre-auth RCE: ✅
Joomla pre-auth RCE: ✅
Remote memory disclosure of any PHP application: ✅

Read more ⬇️🧵

[Init1Security @init1security]

@ipurple Thank you!! So much to teach!

[Init1Security @init1security]

We are still growing the course a little more before release but we added some latest redirection techniques, sign up at https://t.co/hi6YB02yxN ready for release on 🎃⚔️🥳

[Init1Security @init1security]

@nuf_cc We would love to expand on MalDev, please DM and let's talk!

[Init1Security @init1security]

SQL is still an important part of Active Directory, so we had to bring it to the training and demonstrate the powerful capabilities of powershell and how it can abuse SQL. The training will still grow even after release to catch up with the latest attacks!! Sign up release Oct 31!! 🎃
https://t.co/lvACcnvbSL

[Init1Security @init1security]

@ipurple $500 we based it on the market price but of course with lifetime access and free updates. We hope it’s fair and excited to release.

[Init1Security @init1security]

@afterimagesec Soon!!

[Init1Security @init1security]

🚨 Release: October 31 🚨

🔥 20+ AD Attacks
📂 10+ Initial Access File Formats
📦 6+ Containers
🔒11+ Persistence Techniques
Built for Red Team training, featuring a growing arsenal of techniques, including BOFs, patched Open Source tools and Custom Tools available for students.
This is just the foundation. More techniques, features, and improvements are on the way in the near future.

October 31. Get ready. 🎃

#RedTeam #CyberSecurity #ADSecurity

[Init1Security @init1security]

@N7WEra It’s an on demand training course sorry about that. We forgot the link but you can find more information here. https://t.co/hi6YB020If

[Init1Security @init1security]

@TurnipInTheWild Plewse someone make a full movie

[Panos Gkatziroulis 🦄 @ipurple]

It has been a quieter month than usual for iPurple blogging, as I have been working on content for a number of upcoming projects and activities.

A new article will be published early next week. In the meantime, have a look at my latest post on leveraging WerEnc.dll to encrypt your implant.

Why use it?

✅ Smaller stagers by reusing encryption code already built into Windows
✅ AES-256 encryption support
✅ Trusted, signed Microsoft DLL

Living-off-the-land encryption has its advantages.

https://t.co/JUOyyYHbRb

[Init1Security @init1security]

@ipurple Thank you!, Excited to finally release and give out our best quality content with tools dedicated for the latest Windows Environments

[Init1Security @init1security]

We "fixed" ISO's!!. Not really but the hidden attribute has been patched for latest Win11, a simple bit flip and the attribute is back, PhantonMount will be our tool offered for students to get back on utilizing ISO containers on our RTO Course.

[Init1Security @init1security]

We did it! We properly extracted and analyzed the 3 most popular browsers and built the BOFs for Havoc, all attacking the latest versions and extract credentials from them.
Exciting news for the training!
https://t.co/hi6YB02yxN

[Init1Security @init1security]

@SwiftOnSecurity Zelda A Link to the Past

[Init1Security @init1security]

Happy October!!!

[rekdt @rekdt]

Happy first day of Security Human Awareness Month (SHAM) to those who celebrate

[Init1Security @init1security]

LLM for CyberSecurity according to Anthropic
https://t.co/6fMvUAB412

[Init1Security @init1security]

@SyntheticBeef Ai can cut time, costs, add improvements and ideas why hate it?

[Init1Security @init1security]

ANIMO has extensive capabilities to look at SPNs

https://t.co/0QYCbXRCCX

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft Security Research has identified extensive cloud resource destruction activity linked to JADEPUFFER, which Microsoft tracks as Storm-3168. The activity used compromised service principals and performed cloud credential collection that could be used to facilitate future exfiltration. https://t.co/Fua6pFBspV

Two compromised service principals divided discovery, destruction, and credential collection, with timing and overlapping token streams strongly indicating automated or scripted execution that included more than 100 storage account deletion attempts in about seven minutes.

Discovered by Sysdig in July 2026, JADEPUFFER is reported to be the first documented agentic ransomware operation. These new findings expand publicly documented activity associated with Storm-3168 and indicate an evolution in the threat actor's cloud operations.

Read the blog for analysis, Microsoft Defender detections, and mitigation guidance on protecting workload identities, revoking or rotating exposed credentials, and safeguarding backup and recovery resources.

[Init1Security @init1security]

@afterimagesec Thank you we are putting a lot of focus and effort to give out high-quality training stay tuned!!

[Init1Security @init1security]

New Tool: skeletonToken
A new tool inspired by the classic Skeleton Key technique from Mimikatz, designed to forge valid TGTs for domain users on Windows Server 2025.
Exciting news for our course skeletonToken will ship Day 1 with Havoc.