André

eJPT, eCDFP. Blue team - Following #infosec twitter.

[cr3ghost @cr3ghost]

One of the best FREE Windows exploit development and security research blogs out there. Kernel pool exploitation. PTE overwrites. HVCI and kernel CFG bypass. XFG internals. Browser type confusion. Kernel shadow stacks. Secure kernel internals. ARM64 Pointer Authentication bypass. ETW and PPL research.

Covers everything from ROP fundamentals all the way to cutting edge ARM64 and VBS security research. Still actively publishing in 2026.

https://t.co/tyfevXiWOp

Author: @33y0re

#ExploitDevelopment #WindowsInternals #ReverseEngineering

[Andrew Northern 𓅓 @ex_raritas]

Happy to announce my latest piece of research just dropped with #CENSYS_ARC @censysio !

https://t.co/3dra88w3xB

🧵
👇👇👇

[Sébastien Dudek 📡 @FlUxIuS]

🧙‍ We built Grimoire: a single search box for every offensive playbook, fully offline.

Type ssrf, kerberoast, jwt, sudo and instantly hit the right page across more than 100 curated sources at once. 🔍⚡

[cr3ghost @cr3ghost]

FuzzySecurity covers usermode exploitation, kernel exploitation, privilege escalation, persistence, credential theft, lateral movement, UAC bypass, heap internals, ROP chains, shellcoding, RFID hacking, and malware analysis. All free.

One of the few resources that takes you from basic buffer overflows all the way to kernel pool overflow and GDI bitmap abuse in a single series.

https://t.co/sBuYFKewBc

Author: @FuzzySec

#ExploitDevelopment #ReverseEngineering #InfoSec

[Hugow @hugow_vincent]

Releasing DCOMIllusionist as part of our talk on DCOM at @x33fcon with @k3vinTell. It's a remote in memory fileless lateral movement technique based on some research of @tiraniddo
https://t.co/XLljazKmnH

[Smukx.E @5mukx]

The (Anti-)EDR Compendium

TL;DR: EDR functionality and bypasses, with focus on undetected shellcode loader.

Blog:- https://t.co/hwKLCTO1TR

[Panos Gkatziroulis 🦄 @ipurple]

Shellcode Loaders - Advanced Execution & Evasion Tradecraft https://t.co/H52oGmW83a

[blackorbird @blackorbird]

Aether is a Windows memory-forensics and threat hunting tool that scans live process memory for malicious pattern, detect injection techniques, implant signatures, reflectively loaded .NET assemblies. it works with a multi-layer confidence model that dramatically reduce the false positive rate and hunt for malicious behaviour.
https://t.co/3rZVu9gvVl

[Fady Moheb @N1NJ10_]

https://t.co/4n2TwYFJY9

[Two Seven One Three @TwoSevenOneT]

https://t.co/t1C6qMHBc1

[Voidwalker @JustWantToQ1]

https://t.co/neuUNPdOAS Could it be? A real write up?

[cr3ghost @cr3ghost]

Alexandre Borges has published over 700 pages of free security, malware and vulnerability research.

A complete Malware Analysis Series covering Windows, macOS, iOS, Linux and shellcode. An Exploiting Reversing Series covering Windows kernel exploitation, Hyper-V, Chrome, and a three-part deep dive on CVE-2024-30085.

No paywall. No course. Just research. Free as in beer.

https://t.co/x516DQRcB8

Author: @ale_sp_brazil

#ReverseEngineering #MalwareAnalysis #InfoSec

[Robert Graham @robertgraham]

We know what probably happened.

From what we see publicly, NightmareEclipse doesn't communicate well, is emotionally immature, and appears to want to extort Microsoft.

Almost certainly, this played a part in the conflict between them and Microsoft -- it's probably as much NightmareEclipse's fault as Microsoft's.

With that said, everything Florian says is correct. It doesn't excuse Microsoft's failures. They are supposed to be the responsible one,

When there is miscommunication or dispute, it's always allowable to drop 0day, regardless whose fault it is. It's Microsoft's job to avoid that, even when they really aren't at fault for the miscommunication.

But Microsoft has convinced themselves of the opposite, that "responsible" disclosure means only the responsibilities of the vuln finder.

Vuln finders have no responsibility. Dropping 0day is responsible. Responsible companies don't have so many bugs.

We let industry subvert the disclosure process. Instead of working to secure their code, vendors have tricked people into believing in the myth of "responsible disclosure", that vendors should be given time to fix and patch their bugs so they are never to blame for the bugs to begin with.

That's why you have customers still buying Fortinet appliances even though their bugs continue to be major sources of customers getting hacked. Customers shrug their shoulders: as long as Fortinet has a vulnerability disclosure program and releases patches, they aren't responsible for when hackers keep breaking into their boxes.

This is garbage. Vendors are still responsible for preventing bugs in the first place, a responsibility that doesn't go away just because they patch.

Regardless of what happened, Microsoft's threats are a gross violation of ethics in the industry.

[Fady Moheb @N1NJ10_]

Tools like Snaffler are great, but crawling SMB shares creates a telemetry nightmare. You instantly light up the SIEM with :

- 5140 / 5145 (Network Share Access)
- 4656 / 4663 (Object & File Access)

So I built Invoke-WindowsSearch to query the native Windows Search DB (OLE DB) directly via WinRM/RPC, It extracts the targets without touching the actual files, completely bypassing the 4663 and 5145 detection footprint.

Trade-offs: Requires the WSearch service (disabled by default on Server OS) and lacks complex regex capabilities. Know your environment before execution.

#RedTeam #ActiveDirectory #OPSEC #ThreatHunting #PowerShell

[Smukx.E @5mukx]

How to Use Ghidra to Analyse Shellcode and Extract Cobalt Strike Command & Control Servers.

Blog:- https://t.co/ehNG0boPQu

#malware #analysis

[André @klist_sessions]

How To Use Ghidra For Malware Analysis - Identifying, Decoding and Fixing Encrypted Strings https://t.co/V83qVLtCfR

[Het Mehta @hetmehtaa]

The Hacker Recipes is the AD attack bible that OSCP prep guides forget to mention.

Kerberos delegation abuses.
NTLM relay chains.
DCSync paths.
Constrained vs unconstrained delegation.

https://t.co/sOQy6OwG7S

[vx-underground @vxunderground]

Chat, I don't want to be that guy, but I think Microsoft has really pissed off security researchers and we're approaching the tipping point.

This Eclipse guy has really rocked the boat for Microsoft.

[Przemysław Kłys @PrzemyslawKlys]

I've release a new version of PowerBGInfo - PowerShell alternative to BGInfo. It's complete rewrite, doesn't depend on other modules and should be easier to maintain with more features and functionality including Charts.

🔗https://t.co/URd2PrywL0

[payloadartist @payloadartist]

Do you watch Netflix in your free time?

Try hackflix for security conference talks

https://t.co/SVbkWApdoe

#cybersecurity #bugbounty