Leo Loobeek

Penetration Tester | Adaptable Adversary | | Thoughts and tweets are my own

[Leo Loobeek @leoloobeek]

@TheDistance21 Daytona isn’t that far north 😁

[Leo Loobeek @leoloobeek]

After trying LangChain, then Haystack, Rigging has been the best option so far. Removes all the unnecessary abstractions and allows you to focus on building an LLM powered toolset.

[dreadnode @dreadnode]

Rigging continues to be a core part of our toolkits - new docs here: https://t.co/ZSz0LvOEdl

If you want information/tutorials on the roadmap - let us know.

[Jason Lang @curi0usJack]

Welcome to my 2023 Irreverant Red Team TTP Wrap Up (Trends, Trolls, Predictions)

It's likely some of these will ruffle feathers, but hackers break things right? 😁

🧵👇

[Dave @dtpkll]

@Vikings @KevOC7 @PhilMackey @DustBaker Season over. 24 hours after the most devastating event of his career, OUR quarterback doesn’t sit home feeling sorry for himself. No, he attends the Kids Club Trick-Or-Treat Trail in Egan. That’s our QB. #Vikings

[moo @moo_hax]

Fun little DLL making a request out to an LLM. Still have some troubleshooting left with sRDI. While it’s ultimately just a we request, LLMs + Ops os fun to think about.

[moo @moo_hax]

Before NVIDIA, I was lucky enough to work with @ram_ssk and @drhyrum at Microsoft. We got to write tooling, risk assessments, and attacks IRL. MLSec seems new, but their work on this topic is all over the Security community.

If you’re looking to orient yourself to the current state of ML Security, this is it.

https://t.co/iuwCg1Wqk0

[Leo Loobeek @leoloobeek]

@Jean_Maes_1994 @ConsciousHacker Haha I’m no wizard, I’m just as puzzled with COM as the next poor soul to spend time learning it 🫠

[Leo Loobeek @leoloobeek]

@bohops @coffeegist I’m still here. I’m not mad @bohops, I’m just disappointed.

[Kiwids @mhskai2017]

I wrote a blog post that talks about how we can abuse yet another Chrome Remote Debugging feature to "stalk" end users. https://t.co/xPHw3j4Qrb

[Jackson T. @Jackson_T]

In this post, I discuss one key difference in the thinking between sophisticated adversaries and many of the red teams that try to simulate them, as well as what that means for tradecraft and tooling.

https://t.co/FTEHcIsqsW

[Wojciech Reguła @_r3ggi]

I am sharing the slides from my latest presentation: “0-Day Up Your Sleeve – Attacking macOS Environments” I gave at @nullcon
👉https://t.co/iAhbnCbKaN

[OtterHacker @OtterHacker]

An interesting post about Kernel Callback used by EDR. It’s a nice article to read if you want to dive into EDR Kernel Callbacks bypass.
Thanks @synzack21 for the blogpost ! :)

The part about @fdiskyou evil.sys driver and experiments is really nice ! :)

https://t.co/T2rNa2WUxT

[Leo Loobeek @leoloobeek]

@subTee Thanks Casey! Just standing on the shoulders of all your great work 👊

[Karl @kfosaaen]

Packt currently has a few books (including Penetration Testing Azure for Ethical Hackers) on sale on Amazon. Use code “20SECURITY” to get the 20% off discount - https://t.co/wFDfqWiAog

[Adam Chester 🏴‍☠️ @_xpn_]

New post is up on the @trustedsec blog, this time looking at how to use ProcessDeviceMap to load arbitrary DLL's into a process on start. https://t.co/xrXYmb2zMo

[Matt Eidelberg @Tyl0us]

Introducing Ivy a unique, stealthy method of executing shellcode using VBA and COM objects without dropping office macro documents to disk. Ivy also allows for the unhooking EDRs from the VBA environment. Check it out: https://t.co/a1E0OIikyR 👀 #netsec #redteam #EDR #evasion

[Leo Loobeek @leoloobeek]

@HackingLZ The smartest hacker I've ever met @SpecialHoang is an anti cheat wizard

[bohops @bohops]

AccChecker is a pretty interesting #lolbin (+ AppLocker Bypass) from the Win SDK. Load a managed DLL with this cmd:

AccCheckConsole.exe -window "Untitled - Notepad" C:\path\to\your\lolbas.dll

More info in this gist: https://t.co/L6aw84b9P7

[Jonas L @jonasLyk]

https://t.co/yQ40iD9hkF

My webdav based reflective loader/per process devicemap based dll injector POC is by now usable.

I would really like to have a OOP wrapper for NT- designing such is surprisingly difficult, but this approach shows potential especially considering simple

[bohops @bohops]

[New Tool] RogueAssemblyHunter 🛡️

Rogue Assembly Hunter is a utility for discovering 'interesting' .NET CLR modules in running processes

https://t.co/cgUvnZQ4y3

#BlueTeam #ThreatHunting