Lalit

All views expressed on this page are personal and do not represent any organisation or group.

[Nicolas Krassas @Dinosn]

Cybercriminals using FUD (Fully Undetectable) crypter services for malwares: Interpol Report https://t.co/LMrC5KmmG9

[Quentin Texier 🦀 @g0h4n_0]

Did you know you can request a certificate via NTLM relay through these 2 AD CS endpoints? 🔥

/<CAName>_CES_Kerberos/service.svc/CES
/<CAName>_CES_NTLM/service.svc/CES

This article explains it really well 👇
https://t.co/0z5t2eoY8A

RustHound-CE v2.5.21 now also checks whether these endpoints exist (on top of /certsrv/certfnsh.asp) so #BloodHound can graph the path!

#ADCS #ESC_CES

[Brute @BRuteLogic]

Know every way to break a JWT.

38 pages, 47 techniques.

https://t.co/VnAeWH8t1H

With original research and tested payloads.

[Daniel San @dani_avila7]

Google Mantis is a skills pack for security review with coding agents

Install:
npx skills add google/mantis

Key commands:

/mantis-threat-model: builds a threat model from your codebase

/mantis-researcher: scans for vulnerabilities

/mantis-review: filters false positives

/mantis-reproduce: writes a PoC and runs it in a sandbox

/mantis-patch: applies a fix and confirms it blocks the PoC

/mantis-report: generates the final security report

This is a good use case for running your agent in a sandbox, since the reproduce and patch steps execute generated code

https://t.co/OhmZDDNcWy

[𝐑𝐀𝐢𝐡𝐚𝐧 @zapstiko]

LazyOwn — RedTeam Framework with AI agents, Linux BOF beacon, YARA+Nuclei marketplace

#ai #agent #nuclei #linux #yara #lazyown
https://t.co/yUry0mCInW

[Rad @rad9800]

Many folks don't know how to get their hands on firmware for various firewall vendors or what not.

I use this for various automated workflows - though I'm sure folks will lively have many of their own (e.g automating patch diffing).

I put together and share a small toolkit you can point your agent at that will dump the image to S3.

For example, say I wanted to dump PANOS:
1. Accept the BYOL agreement on AWS Marketplace
2. You now have the AWS AMI ID
3. Use this and dump it to S3
4. ???

https://t.co/zRVdvhFYHA

[༺ཧคlคฝคཊ༻ @rybinfx]

Web crawlers /[•]\ #js x #css

[Ornith @ornith_]

🪽DFlash draft models are available for Ornith-1.5 9B, 35B-A3B, and 397B.

DFlash and Ornith 1.5 make a dynamic duo: DFlash performs as the draft model, accelerating inference by drafting multiple tokens at once. Then Ornith 1.5 verifies the draft tokens in one pass instead of generating one token at a time.

👮 We conducted a performance evaluation of the DFlash models. DFlash achieves up to a 2.54× speedup without any loss in generation quality.

🔌 Come and plug this super buddy into your workstation.
https://t.co/g4LXGxBAXk

[Smukx.E @5mukx]

A canvas for red team infrastructure and cyber ranges. Compose a topology, export runnable Terraform and Ansible, and deploy it yourself. Your cloud credentials never leave your machine. dev by devZero.

Github:- https://t.co/iomG8r2HNS

[Co11ateral @co11ateral]

Testing SCADA with SCADAver

SCADAver can discover, fingerprint and attack SCADA systems during a pentest

https://t.co/tM0ecmkvzw

[Panos Gkatziroulis 🦄 @ipurple]

InjectSetConsole - Performs process code injection by leveraging a Windows named pipe. Unlike traditional techniques, it does not use the:

✅ VirtualAllocEx &amp;
✅ WriteProcessMemory APIs

https://t.co/h9MFY6W5tr

[Panos Gkatziroulis 🦄 @ipurple]

ADE Skills - Adversarial Detection Engineering Knowledge Base
ADE taxonomy, worked technique files, platform bug patterns, mitigations, and purple-team scoping tooling.
https://t.co/imbBGMR9MB

[ONE Jailbreak @onejailbreak_]

All JB, exploits, and tools by Gezine are back 📣

https://t.co/0uAO883JBu

[huihui.ai @support_huihui]

New GGUF:

huihui-ai/Huihui-GLM-5.3-Flash-abliterated-GGUF
This is an uncensored version of zai-org/GLM-5.3-Flash created with abliteration.

Note
GGUFs come from unsloth/GLM-5.3-Flash-GGUF.

Only layers 15 to 35 (0-based indexing) have been ablated, while the other layers remain unablated.

https://t.co/AgddpmkwH4

[Mr.Niko @_MrNiko]

iMessage EXR. zero click. heap overflow before the banner finishes.

CVE-2026-86869. libAppleEXR sizes the buffer for 3 channels. 12 bytes.
CompressedInterleave4 writes 4. 16 bytes. every pixel.
three of those four bytes come from the file.

BlastDoor never decodes EXR.
Spotlight and the photo indexer do, later, with SDR hardcoded on.
no tap. same ImageIO path on iPhone, iPad, and Mac.

fixed in the 27 releases. older fleet still sits on it.
credit: Niels Hofmans / ironPeak
https://t.co/viusjHmr47

#iOS #ExploitDev #InfoSec

[TechVerser @realfxw]

做网安和红队研究的朋友应该都懂这种恶心体验：想让商业大模型辅助写个 PoC、测个漏洞或者做反编译审计，模型动不动就触发合规警报当场拒答；想自己搭一套开源模型，动辄几十 GB 的显存要求又直接劝退个人开发者。更不用说把客户的核心源码、脱敏流量包甚至 0-day 日志甩给别人的云端 API，在合规上基本等于原地自杀。

OrcaRouter 刚推的这个 OrcaSAQ-2 Cyber 27B Uncensored GGUF 确实直戳痛点。

几个关键点看下来非常务实：

显存友好：从 BF16 的 54.7 GB 一路压缩到 15.7 GB，体积缩减了 70% 以上，单张 16GB/24GB 消费级显卡或者大内存 Mac 就能本地单卡跑起来。

精度损耗极低：混合精度压制下，Top-1 一致性依然顶在 94.4%，KL 散度只有 0.020，没有因为量化把逻辑推导能力搞崩。

超长上下文：拉到了 262K context length，整套项目代码库或者成坨的终端输出日志可以直接一把梭喂进去分析。

无阉割（Uncensored）：专门服务于防御性红队、漏洞挖掘、安全编码和终端自动化工作流，不会在研究攻击链条时跳出来跟你讲大道理。

支持 DFlash2 推测解码，全面兼容 llama.cpp，终端交互和脚本调用延迟都做得很利索。

网安能力的底线永远是掌控力。漏洞不上传、日志不出网、代码不上云，本地跑才是正解。模型权重已经在 Hugging Face 放出来了，做安全自动化和终端工作流的完全可以拉本地测一测。

https://t.co/2wORtMMJ3N

[Nicolas Krassas @Dinosn]

Purple Team Automation - Automated adversary emulation (Caldera) against an AD lab to validate Sigma detection coverage and map results to MITRE ATT&amp;CK. https://t.co/rk0t5WqjOI

[mRr3b00t @UK_Daniel_Card]

So I wanted to share a bit of data to show what happens when you TASK an LLM to conduct an offensive security engagement.

This is in a lab, this was without using any skills, any mad prompts, this was in a safe environment.

https://t.co/D1n2unprWn

[ONE Jailbreak @onejailbreak_]

🗞️For years you needed a jailbroken iPhone to decrypt iOS apps. That’s the part that just moved. Full IPA decrypt. No physical iPhone. No jailbreak🔥

https://t.co/tQRNQMRfna