Zoro

[Zoro @n0000p4]

@VittoStack Invite pls

[Vivek | Cybersecurity @VivekIntel]

🧬 DLLHijackHunter — Automated DLL Hijacking Discovery & Exploitation Validation

Not just detection — real execution proof.

• Finds hijack paths (services, tasks, COM, UAC bypass)
• Filters false positives (ACL + KnownDLL + API sets)
• Canary DLL → confirms actual execution
• Scores findings by exploitability

From misconfig → confirmed privesc path

🔗 https://t.co/au6AkI8PSW

#RedTeam #WindowsSecurity #PrivEsc

[Tom Dörr @tom_doerr]

Mindmaps for cyber security technologies and certifications

https://t.co/yGn0jAr3yM

[Alexandre Borges @ale_sp_brazil]

This presentation remains the go-to reference for learning the inner workings of the IDA Pro Hex-Rays decompiler:

(video) https://t.co/20HMiMjMv2

(article) https://t.co/wcwWv1OPia

#decompiler #reverseengineer #informationsecurity #cybersecurity

[0xor0ne @0xor0ne]

"From Zero to QEMU: A journey into system emulation" (slide deck by Antonio Nappa)

https://t.co/bYgH3zq83f

#infosec #qemu

[Zoro @n0000p4]

@aiktp_com @tom_doerr Get a big loan, so you will be motivated to work your ass off😂😂😂. Other than that journaling also works.

[Mr. OS @ksg93rd]

#reversing
#Kernel_Security
#Sec_code_review
Exploiting Reversing (ER) series:
Part 1 - Windows kernel drivers (1) https://t.co/MoAXZ7pHJK
Part 2 - Windows kernel drivers (2) https://t.co/IqZr2h1fuz
Part 3 - Chrome https://t.co/7fsTWqsEmw
Part 4 - macOS/iOS https://t.co/W7VBr9luVF
Part 5 - Hyper-V https://t.co/6LzkwbSrNZ
// step-by-step research series on Windows, macOS, hypervisors and browsers

[Tom Dörr @tom_doerr]

Red team platform with LLM agent and automation workflows

https://t.co/DguImmcdEL

[DirectoryRanger @DirectoryRanger]

Windows IPC Deep Dive, by @haider_kabibo
1 https://t.co/WXPXxYwT0U
2 https://t.co/vdZcjzyyyz
3 https://t.co/Xymk9LE0sp
4 https://t.co/zmAGonybBR
5 https://t.co/rUOLhwYzHZ
6 https://t.co/uKuSglYtJQ
7 https://t.co/pOmrJhf3kK
8 https://t.co/db882XQ5zo
9 https://t.co/5DomsZQ9co

[Tom Dörr @tom_doerr]

Tracks human poses through walls using WiFi signals

https://t.co/k2TqRvklOp

[Anderson Nascimento @andersonc0d3]

What is memory? (part 1): Virtual memory and address spaces
https://t.co/bCLTZIdhd3

What is memory? (part 2): The anatomy of a process
https://t.co/gDEDEUFp5K

What is memory? Part 3: Registers, stacks, and threads
https://t.co/nw0zoVBvf8

What is memory? Part 4: Stack allocations, dynamic allocations, and the heap
https://t.co/WZY5RKWnQI

[Panos Gkatziroulis 🦄 @ipurple]

Loads a legitimate DLL and abuses Vectored Exception Handling to replace it on-the-fly with a malicious payload https://t.co/BDP7BTYwYP

[Mr. OS @ksg93rd]

#reversing #repost
Windows Inter Process Communication:
A Deep Dive Beyond the Surface
Part 1 - IPC Roadmap - https://t.co/xXndRaEU7C
Part 2 - RPC Architecture Overview - https://t.co/976LmFavNf
Part 3 - Handles and binding - https://t.co/F3x5Kt5c8q
Part 4 - RPC Security - https://t.co/AEcP1Gdi2t
Part 5 - Securing the interface and endpoint - https://t.co/scfQ1a0OLy
Part 6 - Endpoint Multiplexing - https://t.co/vX1PeXGPnc
Part 7 - RPC Research Tools - https://t.co/oyqpIo2QYS
Part 8 - Reverse engineering an RPC server - https://t.co/ogBqjoo8mz
Part 9 - High-level reverse engineering - https://t.co/tJoe1GuKNz

[Peter Girnus 🦅 @gothburz]

I work at Slack.

We tell employees their DMs are private.

And they are.

Mostly.

Look, when we say "private" we mean private between you and the person you're messaging.

And your admin.

And HR.

And legal.

And whatever compliance tool your company bought.

And the export logs.

And the backup systems.

And anyone with a court order.

But other than that, totally private.

We're very clear about this in our documentation.

Page 47.

Section 12.

Subsection C.

Paragraph 8.

The part nobody reads before they trash-talk their manager at 11pm.

Here's what employees don't understand.

When you delete a message, you're just deleting it from your view.

The message still exists.

In exports.

In backups.

In the retention policy.

It's like closing your eyes and thinking you're invisible.

The data belongs to the company, not you.

We say this right in our terms.

Workspace owners control everything.

They decide how long messages are stored.

Sometimes it's 30 days.

Sometimes it's forever.

Hope you didn't say anything spicy in 2019.

Enterprise customers get extra features.

Full message exports.

Metadata tracking.

Who messaged whom.

When.

How often.

Communication patterns.

It's for "compliance."

It's for "legal needs."

It's for "regulatory requirements."

It's definitely not for micromanagement.

We're very careful to explain that admins can't see messages in real-time.

They have to formally request an export.

Fill out some forms.

Click some buttons.

Maybe wait an hour.

Very high barrier.

Almost impossible to abuse.

The key takeaway is simple.

Treat Slack like work email.

Not like WhatsApp.

Not like Signal.

Just because it looks like a chat app doesn't mean it works like one.

If a message could cause trouble when HR reads it, don't send it.

This is empowering employees with knowledge.

If you wouldn't say it in the break room with your manager behind you, don't type it in Slack.

That's privacy.

Informed privacy.

Enterprise-grade informed privacy.

[0xor0ne @0xor0ne]

Collection of blog posts, write-ups, papers and tools related to cybersecurity, reverse engineering and exploitation

https://t.co/6YgCLKcdUH

#cybersecurity #infosec

[kmkz @kmkz_security]

A Brief Analysis of Chrome's CVE-2025-6554 in the Wild
https://t.co/LtZBLuN0hJ

[gmh5225.eth @gmhzxy]

hyper-reV: A powerful memory introspection & reverse engineering hypervisor leveraging Hyper-V. Read/write guest memory, SLAT hooks, and hide pages, all while evading detection. Supports Intel/AMD, tested on Win10/11. Check it out: https://t.co/Ihjg9QYTOh
#HyperV #ReverseEngineering

[S3cur3Th1sSh1t @ShitSecure]

This is so much! 🔥🔥😎

Found two new Potato triggers just today. Not only Potato but can also be used for LPE as remote auth is done which could be relayed to LDAP without Signing enabled. Or relayed to ADCS for a certificate.

https://t.co/H83AIxtskn

[nc 🌐🕸️🐱 @thoughtfault]

opsec like bedrock