Fallou Seck

OSCP+ | OSCP | OSWP | cybersecurity enthusiast

[Fallou Seck @loufa_0]

Basic Pentesting - I have just completed this room! Check it out: https://t.co/w8Zm4hZYnF
#17_years_old #senegal #tryhackme #security #webapp #boot2root #cracking #basicpentestingjt via @tryhackme

[dbugs @ptdbugs]

A PoC/exploit has been discovered for vulnerability CVE-2026-54121
PT ID: PT-2026-58514

Vendor: Microsoft
Product: Windows 10 Version 1607
Description: Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network.

References:
• https://t.co/Bv0OpKQzG8
• https://t.co/dr5GoBAf3l

#dbugs_vuln

[🕳 @sekurlsa_pw]

https://t.co/WKzc4wcC72

[hashkitten @hash_kitten]

Seems that wp2shell PoCs are now floating around the internet, so we've published our blog post including our research methodology for finding the bug as well as a deep dive into the chain itself - https://t.co/iuU0yiYJBT

[herrcore @herrcore]

https://t.co/4WQJMzS2XS

[Toan Pham @__suto]

22 Windows LPE reported by one of my colleagues at @Seasecresponse .
This data should not be in any public dataset so if you plan to do any fine-tuning it would be helpful we hope.
All credit goes to him.
https://t.co/FnkQe5jWd4

[🕳 @sekurlsa_pw]

lolcreds
Living Off the Land Credentials

“Application, appliance, and platform credentials: where they live, what they look like, known defaults, and what they unlock”
By @haxxm0nkey

https://t.co/hO3ABWok4k

[🕳 @sekurlsa_pw]

(Note: this is from April)

https://t.co/SxdJPDhw7P

Reproduced by someone else:
https://t.co/E4HFGI1giT

[portbuster @portbuster1337]

Added 4 new LPE exploits to lpe-toolkit:
- PEdit COW CVE-2026-46331
- DirtyClone CVE-2026-43503
- Bad Epoll CVE-2026-46242
- FUSE OOB CVE-2026-31694

https://t.co/BmdCcmBkWK

[Com Feed @thecomfeed]

⚠️ UPDATE: New Court Files Reveal How Microsoft Helped the FBI Identify Peter Stokes "Bouquet" (Scattered Spider Member)

The court files reveal that Microsoft helped the FBI track Peter Stokes down using GDID — a Global Device Identifier, which is assigned to every Windows installation and cannot be changed unless the OS is wiped. The GDID helped them track:

• IP history
• Full web activity
• Video game activity and games played
• Logged-in social accounts, including Snapchat, Facebook, and Apple

According to the court documents, the critical mistake was using a VPN to create the ngrok account used in the May 2025 Tiffany & Co. hack from the same Windows device associated with his GDID.

Although the account was created from a VPN IP address ending in .168, Microsoft records show that the same GDID (6755467234350028) accessed the ngrok signup page at the exact time the account was created, linking the hack to his personal social accounts.

[Mehmet Ergene @Cyb3rMonk]

🔥 https://t.co/7qAqL3Tb2P

[Keanu Nys @RedByte1337]

Just open-sourced CredSpy

Couldn't find any tools that allowed unauthenticated enumeration of auth methods for @Microsoft accounts, so I created it.

Shows whether target accounts use Passkeys, certificate auth, passwordless push, etc...

Find it here: https://t.co/BZ7XfHi5KW

[faker @MoodRaytano]

@JFrogSecurity https://t.co/CQoEeaGjZS

[PracSec @prac_sec]

SpecterInsight v6.0.0 is live! Inveigh workflows, local and remote exploit integration, native Zig payloads with source code obfuscation, network intelligence, and SSL C2 to enhance your threat emulation activities.

https://t.co/LuwKxolcYj

[Michael Weber @BouncyHat]

I'm tired of my tools getting sig'd so I built a pipeline to keep our tools alive for longer and bring some classics back.

Post 1 of 3 is live now. The final post will drop our Go/C# -> WASM toolchain. It builds #Sliver, #Chisel, and some of #GhostPack.

https://t.co/yFF65A8MQO

[🕳 @sekurlsa_pw]

https://t.co/laDOE5LChz

"When an organisation uses Exchange Online (or on-premises exchange in hybrid mode) with a third-party mail server or spam filter as its MX record, it is possible to send mail from any sender to that organisation. Outlook delivers it without warning"

[pyn3rd @pyn3rd]

#CVE-2026-53435: #Jenkins Unsafe XStream Deserialization Leads to Arbitrary File Read (low-privileged authenticated user)

[obscaries ❘ AppSec @obscaries]

AWS pentesting today is less about servers and more about identities, permissions, and trust relationships.

Guide covers IAM abuse, privilege escalation, SSRF, S3, Lambda security, and cloud attack methodology.

Source: https://t.co/lJXtQUJcrb

#AWS #CloudSecurity #BugBounty

[Smukx.E @5mukx]

The (Anti-)EDR Compendium

TL;DR: EDR functionality and bypasses, with focus on undetected shellcode loader.

Blog:- https://t.co/hwKLCTO1TR

[0xor0ne @0xor0ne]

Introduction to return address and call stack spoofing

https://t.co/E4D7ETZy7Z

https://t.co/HZLQdWsj8s

#infosec

[dbc @madcat516]

@darkrai @instagram lol yeah, major exploit but there’s nothing you can do. It’s like the roblox ai assistant exploit from a few days ago where you could reset emails if you had their billing. Instagram on the other hand is even easier, you only need the user