initstring

AT&F&C1&D2&K3%C0

|
|
@[email protected]

[initstring @init_string]

@techspence @who1sroot Love hearing this success story, thanks so much for sharing! Seen similar results on general cracking campaigns too - this tool doesn't return volume but it occasionally gets those really high-value ones. :)

[initstring @init_string]

Local Privilege Escalation in Fedora Linux (CVE-2025-12744).

Red Hat has made this public, but patches aren't out yet. Reliable root for any local user.

Mitigation: sudo systemctl disable --now abrtd

Writeup + PoC: https://t.co/iLURNVyppZ

[initstring @init_string]

Drive-By Attack in Ollama Desktop v0.10.0

Found a bug in Ollama desktop GUI (not the core API) where malicious websites could hijack all private chats. Ollama crew patched it within hours. Make sure to update!

Tech details, video, IoCs, and PoC here: https://t.co/KNzypwNpC9

[initstring @init_string]

@Ne0nd0g @gitlab We also do research and "opportunistic attacks" which may be more narrowly focused on identifying new attack paths, exploits, initial access vectors, etc: https://t.co/LcQ6ekNFGF, https://t.co/iR1reYxsGY

[initstring @init_string]

@Ne0nd0g @gitlab Thanks @Ne0nd0g. We try to include assessing/improving detections, controls, and processes within the context of a stealth op. More info here on how we track those outcomes: https://t.co/uuOBvgFMni

[initstring @init_string]

@DJBretschneider @DailyOsint Thanks for the ping! If you open an issue in the GitHub repo, we can troubleshoot it. Have a good day :)

[initstring @init_string]

A lot has happened in a year! I’ve refreshed the dynamic data sources for passphrase-wordlist and generated a new file. If you’re into cracking complex passwords, this may be for you. Enjoy!

https://t.co/lHSWSbvLV1

[initstring @init_string]

I'm not very active on here, and probably won't be on the next one either. But just in case, here's the new Mastodon profile I set up: @[email protected]

[initstring @init_string]

Spent some time recently formalizing our Red Team workflow at GitLab. The process is open-source, and we're sharing our issue templates to track logistics, goals, TTPs, reports, etc.

https://t.co/wjAAvlguhQ

[initstring @init_string]

@qualys Brilliant work! I spent a long time looking for privesc in snap-confine as well, but couldn't quite get one over the line. Congrats to your team members who discovered these.

[initstring @init_string]

Sometimes I like to just grep random things and see if it made it into the list.

$ grep covid ./passphrases.txt | wc -l
5937

Well, some of those are... interesting.

[initstring @init_string]

Just pushed an update for passphrase-wordlist. Massive list of passphrases with hashcat rules for offline cracking of long, complex passwords. Enjoy! https://t.co/lHSWSbvLV1

[initstring @init_string]

@TychoTithonus @freeroute_one @CyberWarship I spent some time this weekend re-scraping sources and updating documentation. Just pushed the new version. Thanks everyone!

[initstring @init_string]

@fomm_io And yes, you'll also need to use the uBlock method in combo with whatever rebind protection you're using. It blocks local IPs, while the rebind protection blocks DNS names that resolve to local IPs.

[initstring @init_string]

Wanted to share this combo, as it's such a cool protection from drive-by attacks.

1. uBlock Origin with the "block access to LAN" filter-list
2. DNS rebind protection (available in pihole, NextDNS, dnsmasq, AsusWRT-Merlin, etc)

JS can no longer easily target your LAN!!!

[initstring @init_string]

@fomm_io I'm not familiar with Fritzbox. Try to resolve the DNS name `https://t.co/fhDFTAZoKM`. If your rebind protection is working, it should not resolve to a real IP.

[initstring @init_string]

I've not yet spent time trying to bypass the combo, but that could be a fun adventure for the future.

[initstring @init_string]

I discovered a drive-by #RCE in the @gitlab Development Kit (it's now fixed). This took chaining multiple vulnerabilities and would have allowed me to remotely compromise developer machines. Details and tips to protect yourself from similar exploits here:

https://t.co/5SVuS9ykqM

[initstring @init_string]

@joernchen The NeverEnding Story because you get to fight a wolf and ride a dragon if you read it.