invisiblebyte

FZ - Red Team Operator - Experience means nothing without knowledge

[Ben Sadeghipour @NahamSec]

This Hacker Made $40,000 Using Claude Code https://t.co/nNNthtHUiO

[Denis Laskov 🇮🇱 @it4sec]

Hacking into modems: 30+ vulnerabilities in devices used in homes, ATMs, buses, and critical infrastructure. ☎️🌐👨🏻‍💻💡🍟

More details on:
LinkedIn: https://t.co/M4C4d1GUSa
Substack: https://t.co/m9BTLjtsgZ

[SpecterOps @SpecterOps]

Every Entra ID assessment ends here: “How do I get a token without triggering Conditional Access controls?” 🤔

@rbnroot built CAPSlock, an offline ROADrecon-based Conditional Access engine that simulates sign-ins & flags gaps without touching the tenant. https://t.co/MRogABIkL2

[SpecterOps @SpecterOps]

NTLM relays failing because of EPA? 😒

@zyn3rgy & @Tw1sm break down how to enumerate EPA settings across more protocols + drop new tooling (RelayInformer) to make relays predictable.

Check out their blog for more: https://t.co/RrTww92lNO

[SpecterOps @SpecterOps]

Credential Guard was supposed to end credential dumping. It didn't.

@bytewreck just dropped a new blog post detailing techniques for extracting credentials on fully patched Windows 11 & Server 2025 with modern protections enabled.

Read for more ⤵️ https://t.co/mYPHg1mTKj

[Pedro Ribeiro @pedrib1337]

We are looking for a junior security researcher 🤠
No university degree or previous work experience required, but MUST be able to demonstrate interest in the field and some basic skills by either:

1. Have published blog post detailing 0-day vulnerability (found by yourself) or n-day (analysing someone else's vuln in detail), preferably with exploit code published for the vuln detailed in the blog post.
2. We can also accept private write-ups for vulns you have found / exploited but never published (even if they are already fixed).
3. OR if you don't have any of the above, but have a way to prove your skill, hit me up and we'll talk!

We're also accepting mid-level security researchers with a few years experience!

What we offer:
- Fully remote working environment with regular company meet-ups.
- Great salaries and bonuses!
- Flexibility to work on different CUTTING EDGE projects (mostly related to mobile).
- Mentoring and training by some of the world's top security researchers

[inversecos @inversecos]

How the NSA (Equation Group) allegedly hacked into China's Polytechnical University 👀

I analysed intelligence reports from Chinese cyber firms (360, Pangu, CVERC) to aggregate TTPs attributed to Equation Group.

🔗https://t.co/2dQuwx0lxN

[Mobile Hacker @androidmalware2]

Transform your smartphone into a portable hacking lab

Lear how to set up Kali Linux #PiTail and control it with just your smartphone. Plus, get some of my tips on troubleshooting common issues along the way
Read more: https://t.co/A2RBL05WqR

[PentesterLab @PentesterLab]

Articles worth reading discovered last week:

🗞 https://t.co/JazpxiYVqC
🗞 https://t.co/6632PT0yqm
🗞 https://t.co/gydREFO7fL
🗞 https://t.co/ZJIW2lTs0h
🗞 https://t.co/JGmoT6lyBW
🗞 https://t.co/t3ajtpieSG
🗞 https://t.co/dR7cLT0Wkv

#PentesterLabWeekly

[Rebane @rebane2001]

new blogpost time!!

this one's a fun writeup on a vulnerability chain i found across multiple google services that earned me a $4133.70 bounty

lots of fun css as usual! i had to recreate a bunch of drive/docs/gmail/youtube UIs c:

have fun!
https://t.co/64ZAIVHoSO

[Phrack Zine @phrack]

The time has come, and with it your reading material for the week.

Phrack #71 is officially released ONLINE! Let us know what you think!

https://t.co/BRnK9lnGjI

[Andrea P @decoder_it]

#FakePotato (CVE-2024-38100) post is out! Check out the short write-up on this unexpected vulnerability 😅 https://t.co/hr1VtyyWHj

[Jesse D'Aguanno @0x30n]

Boom!
Windows Hello fingerprint authentication bypassed on top three devices:
- Dell Inspiron
- Lenovo ThinkPad
- Microsoft Surface Pro
Still waiting for recordings from our BlueHat talk to drop, but here's our writeup: https://t.co/GzqqadMdeg
#infosec #security #vulnresearch @blackwinghq

[PentesterLab @PentesterLab]

BUSY WEEK!

Articles worth reading discovered last week:

🗞 https://t.co/BrvK4XsgVk
🗞 https://t.co/SdiG7L5U1h
🗞 https://t.co/WkLp5aLNNK
🗞 https://t.co/YgffwWSr1I
🗞 https://t.co/vLhv2IqpHX
🗞 https://t.co/sSCpCUhq7k
🗞 https://t.co/zLDwiQLQkQ
🗞 https://t.co/X3lO32ScHF
🗞 https://t.co/nO1kJpg2k6
🗞 https://t.co/UURjIfR1uN

#PentesterLabWeekly

[Andrea P @decoder_it]

Just published a short blog post on abusing the SeRelabelPrivilege ;) https://t.co/4otLkOXH7B

[Thomas Rinsma @thomasrinsma]

Just released the write-up for CVE-2024-4367, a bug I found recently in PDF.js (and hence in Firefox), resulting in arbitrary JavaScript execution when opening a malicious PDF.
https://t.co/sex6fR0xHS

[PentesterLab @PentesterLab]

Articles worth reading discovered last week:

🗞 https://t.co/clflo7vAlb
🗞 https://t.co/EE5PlbFlIK
🗞 https://t.co/eJS6h3becW
🗞 https://t.co/jbhzEUIWYV

#PentesterLabWeekly

[Raffaele Sabato @syrion89]

CVE-2024-34456: Trend Micro Antivirus One Dylib Injection

https://t.co/4PB3AztZOs

#applesecurity #macossecurity #macosredteam

[SpecterOps @SpecterOps]

Our latest blog post from @Icemoonhsv uncovers the complexities in manual LDAP querying. Check it out & gain a deeper understanding of your AD environment and recognize some of the common issues that can arise from querying manually. https://t.co/qyvPDQIfVu

[Andy Nguyen @theflow0]

The PS4 (up to FW 11.00) and PS5 (up to FW 8.20) were vulnerable to CVE-2006-4304: https://t.co/e3JBDFFnqW. I'll share details about successful exploitation at TyphoonCon.