alien

@nikk0s3c

Aspiring Red teamer

Joined December 2014

1.9K Following

196 Followers

469 Posts

nikk0s3c retweeted

vx-underground

@vxunderground

3 days ago

AI is cool and badass. I like it. No, it's not the end of the world. We can "contain" it. Now I will rant for a moment about what I dislike about AI. I strongly dislike when large corporations try to inject AI into every product, essentially forcing us to use AI. I also strongly dislike when people use AI for every small little thing in their life, such as leaving comments on websites like Xitter, YouTube, Reddit, etc. It defeats the entire purpose of leaving a comment on something... you're supposed to share YOUR thoughts, not an AI agents generated string output. It's goofy. I also strongly dislike the nonsense blabbering of AI propaganda, how it will destroy the world, or how companies need to "contain it", essentially acting as means to corner the AI model market, trying to strip it away from individuals who may want to host it locally. It's a facade of "Only WE can do AI, not YOU", whilst charging absurd fees for usage. I also dislike AI nerds who try to tell me to use AI to do things I do simply because I enjoy doing them. Yes, maybe an AI agent could reverse engineer faster than me, or code faster than me, but I do it because I enjoy it. AI is an excellent tool to enhance work flows, or learn (assuming it doesn't hallucinate). Okay, that's all I want to say about AI for today.

185

240

73K

nikk0s3c retweeted

cr3ghost

@cr3ghost

9 days ago

The commercial C2 market is changing fast. Bank of America is acquiring MDSec, and Nighthawk customers have been warned that license extensions after the acquisition may not be possible. That leaves a surprisingly small group of serious commercial C2 platforms. Cobalt Strike. Outflank C2. Brute Ratel C4. And the rapidly rising Havoc Professional by @C5pider. What makes Havoc particularly interesting is where red teaming is heading next: automation, AI-assisted operations, agentic workflows and potentially MCP-driven integrations. Havoc Pro already has much of the architecture needed for that future: • Windows + Linux, x64 + ARM64 • Runtime C2 channel switching • Custom agents • Custom covert channels • Python + C++ extensibility • Server-side extensions • Task automation • BOFs • Firebeam VM • CET-aware stack spoofing • Direct + P2P channels • Kaine-kit The C2 market may be consolidating, but Havoc appears to be moving in the opposite direction. More capabilities. More extensibility. More operator control. This week I'm going to dig into how Havoc compares with the remaining commercial C2 platforms. Which one would you benchmark first? #RedTeam #AdversarySimulation

cr3ghost's tweet photo. The commercial C2 market is changing fast.

Bank of America is acquiring MDSec, and Nighthawk customers have been warned that license extensions after the acquisition may not be possible.

That leaves a surprisingly small group of serious commercial C2 platforms.

Cobalt Strike.
Outflank C2.
Brute Ratel C4.
And the rapidly rising Havoc Professional by @C5pider.

What makes Havoc particularly interesting is where red teaming is heading next: automation, AI-assisted operations, agentic workflows and potentially MCP-driven integrations.

Havoc Pro already has much of the architecture needed for that future:

• Windows + Linux, x64 + ARM64
• Runtime C2 channel switching
• Custom agents
• Custom covert channels
• Python + C++ extensibility
• Server-side extensions
• Task automation
• BOFs
• Firebeam VM
• CET-aware stack spoofing
• Direct + P2P channels
• Kaine-kit

The C2 market may be consolidating, but Havoc appears to be moving in the opposite direction.

More capabilities. More extensibility. More operator control.

This week I'm going to dig into how Havoc compares with the remaining commercial C2 platforms.

Which one would you benchmark first?

#RedTeam #AdversarySimulation

268

182

18K

nikk0s3c retweeted

International Cyber Digest

@IntCyberDigest

16 days ago

Nightmare Eclipse, the person who has been dropping Windows zero-days, has finally decided to share his story. He's an ex-Microsoft employee, we had dinner together, and I've known him and his story for some time. His real name is Abdelhamid Naceri. He's a very talented and intelligent individual, and he came across as someone who'd be a real professional to work with. "If only I didn't pour my soul into that job with countless of stupid non sleep nights, i would have gotten over it..." - Naceri He loved Microsoft. I wouldn't say that what he did, releasing all those zero-days, was normal, but he felt he had no other option because of the injustice Microsoft did to him. They fired him, and you can read the vague reason they gave in the email sent to him by the Vice President of Engineering at MSRC, below. According to Abdel's account, VP Tom Gallagher met with him after the firing to tell him they were blacklisting him from Microsoft and writing him a bad reference so he'd never be able to get a job again. Normally you'd think, well, big deal, just find another job, right? But Abdel doesn't have a European passport, and he was only a couple of months away from getting permanent EU residence. So instead of granting him those couple of months, Microsoft fired him for a reason that, as far as we can tell, was never made clear, then fought him in court and offered him €55,000 plus a year's pay to drop the case. All while Abdel was releasing zero-days. Abdel continued suing Microsoft for unfair termination in Germany, a fight that has cost him over $200,000. He says Microsoft refused to reveal any details about the security breach and went another direction. If you are reading this, and you can offer him a LEGAL job, this is his e-mail: [email protected]

IntCyberDigest's tweet photo. Nightmare Eclipse, the person who has been dropping Windows zero-days, has finally decided to share his story. He's an ex-Microsoft employee, we had dinner together, and I've known him and his story for some time.

His real name is Abdelhamid Naceri. He's a very talented and intelligent individual, and he came across as someone who'd be a real professional to work with.

"If only I didn't pour my soul into that job with countless of stupid non sleep nights, i would have gotten over it..." - Naceri

He loved Microsoft.

I wouldn't say that what he did, releasing all those zero-days, was normal, but he felt he had no other option because of the injustice Microsoft did to him.

They fired him, and you can read the vague reason they gave in the email sent to him by the Vice President of Engineering at MSRC, below.

According to Abdel's account, VP Tom Gallagher met with him after the firing to tell him they were blacklisting him from Microsoft and writing him a bad reference so he'd never be able to get a job again.

Normally you'd think, well, big deal, just find another job, right? But Abdel doesn't have a European passport, and he was only a couple of months away from getting permanent EU residence.

So instead of granting him those couple of months, Microsoft fired him for a reason that, as far as we can tell, was never made clear, then fought him in court and offered him €55,000 plus a year's pay to drop the case.

All while Abdel was releasing zero-days.

Abdel continued suing Microsoft for unfair termination in Germany, a fight that has cost him over $200,000.

He says Microsoft refused to reveal any details about the security breach and went another direction.

If you are reading this, and you can offer him a LEGAL job, this is his e-mail: msnightmare@proton.me

111

524

229K

nikk0s3c retweeted

cr3ghost

@cr3ghost

18 days ago

Free resource for anyone learning heap exploitation. Credit to @shellphish for maintaining how2heap, a practical collection of glibc heap exploitation techniques with small working PoCs across different libc versions. Fastbin, tcache, unlink, overlapping chunks, House techniques and more. https://t.co/VeKBCENJtP #ExploitDevelopment #VulnerabilityResearch #ReverseEngineering

cr3ghost's tweet photo. Free resource for anyone learning heap exploitation.

Credit to @shellphish for maintaining how2heap, a practical collection of glibc heap exploitation techniques with small working PoCs across different libc versions.

Fastbin, tcache, unlink, overlapping chunks, House techniques and more.

https://t.co/VeKBCENJtP

#ExploitDevelopment #VulnerabilityResearch #ReverseEngineering

493

423

16K

Who to follow

Space Coast Sec

@SpaceCoastSec

Helping build cybersecurity awareness and community on the Space Coast. Meetings 2nd Wednesday each month. aka @dcgroup321 https://t.co/CUlSnHdFoa

Do not go where the path may lead, go instead where there is no path and leave a trail -Ralph Waldo Emerson

nikk0s3c retweeted

Yusuke Nakajima

@nakajimeeee

23 days ago

【EDR回避・リバースエンジニアリング】研究者、SentinelOneのローカル検知ロジックを学部生レベルのツールで丸裸に、静的XORキー1個で全設定を解読セキュリティ研究者nullze氏は、SentinelOne Agent 26.1.2.177(Windows版)をGhidraと数十行のPythonのみでオフライン解析し、ゼロデイや特殊な手法を一切使わずローカルの検知ポリシー・ルール・機械学習モデル・信頼リストを平文で抽出できたと報告した。Policy.jsonやDriverRules.jsonなど全設定ファイルは、全ファイル共通のわずか11バイト静的XORキーで暗号化されており、tarアーカイブのnullパディング部分を利用した既知平文攻撃で鍵を即座に割り出せた。ルール本体(Luaスクリプト307件)もRC4暗号化されているが、復号鍵は製品自身のlunar_loader.lua内にそのまま同梱されていた。さらに深刻なのは、「機械学習」と称する挙動検知モデル(primaryBehavioralModel.bin)が、実質65条件の単純な決定木であり、使用される特徴量はわずか5種のみ、しかも先頭43条件が単一の特徴量(プロセス間メモリアクセスと推定)のみを判定する構造だったことである。この特徴量がしきい値未満なら残り全条件を無視して「クリーン」判定を返す。加えて信頼リスト(Matchers.lua)には、Cymulate等27種の攻撃シミュレータ、28種のセキュリティベンダー、Microsoft全体への包括的除外設定、WinPMEMなど8種のフォレンジックドライバなど、検知除外対象が具体的な製品名・パス付きで平文列挙されていた。著者は、EDRの前提である「エンドポイントが攻撃者の手に渡る」状況を踏まえれば、検知ロジックの機密性はローカルでも維持されるべきだと指摘し、製品側にキー管理の抜本的見直しと、単一特徴量がモデル全体の判定を左右する設計の是正を求めている。クラウド側の相関分析やSOC監視までは対象外の限定的な検証である点も明記されている。 https://t.co/riCrIdccvt

292

247

15K

nikk0s3c retweeted

cr3ghost

@cr3ghost

23 days ago

Detection engineers, red teamers, malware analysts, reverse engineers and blue teams: if EDR bypass, EDR blinding, BYOVD, rootkits or Ring 0 tradecraft interests you, @Idov31 has published an absurd amount of FREE Windows security research. Nidhogg: 25+ rootkit / EDR tampering capabilities, easily be integrated with your C2 framework. NovaHypervisor: VT-x + EPT defense when the kernel itself may already be compromised or abused through BYOVD. Jormungandr: Jormungandr is a kernel implementation of a COFF loader, allowing kernel developers to load and execute their COFFs in the kernel. Cronos: PoC for a new sleep obfuscation technique (based on Ekko) leveraging waitable timers to RC4 encrypt the current process and change the permissions from RW to RX to evade memory scanners. Venom: Venom is a library that meant to perform evasive communication using stolen browser socket Sandman: Sandman is a backdoor that is meant to work on hardened networks during red team engagements. MrKaplan: MrKaplan is a tool aimed to help red teamers to stay hidden by clearing evidence of execution. And the blog goes much deeper: Windows drivers, WinDbg, IRPs/IOCTLs, ObRegisterCallbacks, process/thread/image callbacks, registry callbacks, IRP + SSDT hooking, APC injection, kernel-to-user injection, AMSI bypass, ETW/ETW-TI tampering, credential access, PPL, callback removal/tampering and the primitives EDRs depend on for visibility. Then you get into PatchGuard, KVA Shadow, CR3/address-space internals, VBS, VTL0/VTL1, HVCI, VMX, VMCS, VM-exits, VMCALL, EPT, EPT hooks and the bigger question: how do you defend an endpoint when Ring 0 itself can no longer be trusted? Red teamers: study EDR bypass/blinding, kernel post-ex, BYOVD, covert execution, sleep obfuscation and unconventional C2. Detection engineers + blue teams: study exactly what telemetry, callbacks and trust boundaries attackers can manipulate. Malware analysts + reverse engineers: see what modern kernel tradecraft actually looks like under the hood. The FREE Lord Of The Ring0 series alone could keep you busy for a long time, and the individual project writeups turn the theory into actual implementations. This is a rare GitHub full of PoCs with basically a public Windows offense-vs-defense research lab. Blog: https://t.co/7gpRfTt2OP GitHub: https://t.co/0HIDZmI7dN Bookmark it. Clone the repos. Save the references while everything is public. #DetectionEngineering #RedTeam #MalwareAnalysis #ReverseEngineering

cr3ghost's tweet photo. Detection engineers, red teamers, malware analysts, reverse engineers and blue teams: if EDR bypass, EDR blinding, BYOVD, rootkits or Ring 0 tradecraft interests you, @Idov31 has published an absurd amount of FREE Windows security research.

Nidhogg: 25+ rootkit / EDR tampering capabilities, easily be integrated with your C2 framework.

NovaHypervisor: VT-x + EPT defense when the kernel itself may already be compromised or abused through BYOVD.

Jormungandr: Jormungandr is a kernel implementation of a COFF loader, allowing kernel developers to load and execute their COFFs in the kernel.

Cronos: PoC for a new sleep obfuscation technique (based on Ekko) leveraging waitable timers to RC4 encrypt the current process and change the permissions from RW to RX to evade memory scanners.

Venom: Venom is a library that meant to perform evasive communication using stolen browser socket

Sandman: Sandman is a backdoor that is meant to work on hardened networks during red team engagements.

MrKaplan: MrKaplan is a tool aimed to help red teamers to stay hidden by clearing evidence of execution.

And the blog goes much deeper: Windows drivers, WinDbg, IRPs/IOCTLs, ObRegisterCallbacks, process/thread/image callbacks, registry callbacks, IRP + SSDT hooking, APC injection, kernel-to-user injection, AMSI bypass, ETW/ETW-TI tampering, credential access, PPL, callback removal/tampering and the primitives EDRs depend on for visibility.

Then you get into PatchGuard, KVA Shadow, CR3/address-space internals, VBS, VTL0/VTL1, HVCI, VMX, VMCS, VM-exits, VMCALL, EPT, EPT hooks and the bigger question: how do you defend an endpoint when Ring 0 itself can no longer be trusted?

Red teamers: study EDR bypass/blinding, kernel post-ex, BYOVD, covert execution, sleep obfuscation and unconventional C2. Detection engineers + blue teams: study exactly what telemetry, callbacks and trust boundaries attackers can manipulate. Malware analysts + reverse engineers: see what modern kernel tradecraft actually looks like under the hood.

The FREE Lord Of The Ring0 series alone could keep you busy for a long time, and the individual project writeups turn the theory into actual implementations.

This is a rare GitHub full of PoCs with basically a public Windows offense-vs-defense research lab.

Blog:
https://t.co/7gpRfTt2OP

GitHub:
https://t.co/0HIDZmI7dN

Bookmark it. Clone the repos. Save the references while everything is public.

#DetectionEngineering #RedTeam #MalwareAnalysis #ReverseEngineering

477

102

545

21K

nikk0s3c retweeted

SpecterOps @SpecterOps

27 days ago

Introducing SpecterOps Skills: a public repository built to turn practitioner knowledge into reusable, reviewable workflows for AI-assisted security work. @zinic shares what we're building, why we're building it, and how you can contribute ➡️ https://t.co/bZAkCFRSlg

SpecterOps's tweet photo. Introducing SpecterOps Skills: a public repository built to turn practitioner knowledge into reusable, reviewable workflows for AI-assisted security work.

@zinic shares what we're building, why we're building it, and how you can contribute ➡️ https://t.co/bZAkCFRSlg https://t.co/oQeqR69IPs

177

126

15K

nikk0s3c retweeted

Tim Blazytko

@mr_phrazer

26 days ago

The recording of "Deobfuscation in the Age of Agentic Reverse Engineering" is now public: https://t.co/jMO0GHRM8l We (CC @nicolodev) show how to use agents to break protections found in anti-cheats, DRM systems & commercial protectors. Slides: https://t.co/Fz2DhU2RlT

384

104

321

28K

nikk0s3c retweeted

Outflank @OutflankNL

27 days ago

Outflank is proud to have collaborated with @SpecterOps on a new red team AI skills marketplace. This collection packages offensive security knowledge into reusable skills for AI agents. Read more on our blog: https://t.co/l1VXGMarIg

137

nikk0s3c retweeted

cr3ghost

@cr3ghost

26 days ago

Infosec tradecraft just became reusable by AI agents. SpecterOps just open-sourced: 79 skills. 22 reusable agents. 26 plugin families. BloodHound. Cobalt Strike. Outflank C2. Ghidra. Binary Ninja. Ghostwriter. Recon. AppSec. Code review. C2 development. Reverse engineering. Adversary simulation. Windows + macOS tradecraft. And this is NOT just for red teamers. Vulnerability researchers: These workflows could accelerate code review, patch analysis, 1-day research and potentially help with 0-day discovery when paired with real research expertise. Reverse engineers + malware analysts: Give agents structured workflows, references and tooling instead of starting every investigation from a blank prompt. Blue teams + detection engineers: Study the same offensive tradecraft, emulate attacker behavior, build better detections and start asking what telemetry survives increasingly agent-assisted operations. DFIR + threat intel: Understand what adversaries may automate next and turn repeatable investigative knowledge into reusable workflows. Red teamers: BloodHound attack paths, recon, C2 development, adversary simulation and operator tradecraft are becoming increasingly agent-assisted. This isn't another collection of AI prompts. It's practitioner knowledge being turned into reusable, reviewable security workflows. Potentially useful for everyone from CTF learners and newcomers all the way to malware analysts, reverse engineers, exploit devs, red teams, blue teams and vulnerability researchers. This is only the beginning. @SpecterOps Skills: https://t.co/Cj77Ir3Qlj @OutflankNL and @kyleavery breakdown: https://t.co/q5sEaZlp1E #Infosec #RedTeam #ReverseEngineering

cr3ghost's tweet photo. Infosec tradecraft just became reusable by AI agents.

SpecterOps just open-sourced:

79 skills.
22 reusable agents.
26 plugin families.

BloodHound. Cobalt Strike. Outflank C2. Ghidra. Binary Ninja. Ghostwriter. Recon. AppSec. Code review. C2 development. Reverse engineering. Adversary simulation. Windows + macOS tradecraft.

And this is NOT just for red teamers.

Vulnerability researchers:
These workflows could accelerate code review, patch analysis, 1-day research and potentially help with 0-day discovery when paired with real research expertise.

Reverse engineers + malware analysts:
Give agents structured workflows, references and tooling instead of starting every investigation from a blank prompt.

Blue teams + detection engineers:
Study the same offensive tradecraft, emulate attacker behavior, build better detections and start asking what telemetry survives increasingly agent-assisted operations.

DFIR + threat intel:
Understand what adversaries may automate next and turn repeatable investigative knowledge into reusable workflows.

Red teamers:
BloodHound attack paths, recon, C2 development, adversary simulation and operator tradecraft are becoming increasingly agent-assisted.

This isn't another collection of AI prompts.

It's practitioner knowledge being turned into reusable, reviewable security workflows.

Potentially useful for everyone from CTF learners and newcomers all the way to malware analysts, reverse engineers, exploit devs, red teams, blue teams and vulnerability researchers.

This is only the beginning.

@SpecterOps Skills:
https://t.co/Cj77Ir3Qlj

@OutflankNL and @kyleavery breakdown:
https://t.co/q5sEaZlp1E

#Infosec #RedTeam #ReverseEngineering

976

210

57K

nikk0s3c retweeted

📕「マルウエアの教科書」著者 | 吉川孝志 | 増補改訂版🌟発売中

@MalwareBibleJP

about 1 month ago

Windowsのどのカーネルドライバがどのような脆弱性で権限昇格に使われてきたかを、ダッシュボードなどで可視化したナレッジベース「KernelSight」が公開されています。文書はドライバの種別、攻撃対象領域、脆弱性の分類、攻撃の足がかり、事例、緩和策の順に241ページ。ダッシュボードではドライバ別と脆弱性の分類別を突き合わせた一覧表を掲載し、重大度や悪用の有無での絞り込み、CSVとJSONでの書き出しにも対応します。根本原因の内訳は明確で、入力値の検証漏れが約6割。排他制御の不備が約14%、権限チェックの欠如が約4%と続き、監査で確認すべき箇所は6つのアンチパターンに整理されています。付随するドライバ調査は従来と異なり、危険なAPIがインポートテーブルに載っているかどうかではなく、その関数をユーザーモードからの制御命令（IOCTL）で実際に呼び出せるかをGhidraで判定する方式。【要点整理】・6つのアンチパターンは、長さの未検証、排他制御の欠如、ディスク上のオフセットの未検証、物理メモリとモデル固有レジスタ（MSR）の開放、IOCTLの権限チェックの省略、ユーザーバッファの二重フェッチ・ディスク上のオフセットを検証しない類型の代表が共通ログファイルシステム（CLFS）。ランサムウエアに悪用された3件も同じ類型・物理メモリとMSRの開放はバグではなく設計。権限チェックの省略と並び、脆弱な正規ドライバの持ち込み（BYOVD）の根本原因・ドライバ自体に脆弱性がなくても、設計上カーネルメモリの読み書きを開放していれば悪用可能。必要なのは正しいIOCTLを送るクライアントのみで、エクスプロイト開発は不要・ドライバ調査は2段階。既知の悪用可能ドライバ一覧1,775本を対象に、まず実行ファイルからインポートテーブルと対応IOCTL、ROPガジェット数を抽出し、次にGhidraのヘッドレス解析で、危険なAPIがIOCTLの処理経路から呼び出せるかを判定・危険なAPIの名前がインポートテーブルにあるだけのドライバと、その関数をIOCTL経由で実際に呼び出せるドライバとを区別する仕組み。名前の有無だけで判定する従来手法との差分・この1,775本のうち、ユーザーモードのポインタをそのまま受け取る方式が805本。二重フェッチが発生しやすい構造・入力検証の不備と二重フェッチは静的解析で検出可能。排他制御とエラー処理の不備は実行時にしか顕在化しないためファジングが有効・件数の多さは危険度ではなく監査の有無を反映。カーネルストリーミング系の14件は2024〜25年の集中監査による結果・収録件数はページごとに134、147、156、161と4種類が併存。緩和策が無効な本数も制御フローガード（CFG）だけ全数の1,775と一致し、表の見出しと値が不一致危険なAPIの名前がインポートテーブルにあるだけで悪用可能と数えると、実際にはその関数を外部から呼び出せないドライバまで対象に入ってしまいます。二段目の解析に手間をかける見返りは、遮断や調査の対象を、外部から実際に呼び出せるものだけへ絞り込める点です。詳細は以下を参照： https://t.co/vF8pMKPW9m (※可能な範囲でファクトチェックは実施済なものの、元記事の精度依存や速報・要約の性質上漏れもありうるため、正確な情報は一次情報を直接参照のこと)

MalwareBibleJP's tweet photo. Windowsのどのカーネルドライバがどのような脆弱性で権限昇格に使われてきたかを、ダッシュボードなどで可視化したナレッジベース「KernelSight」が公開されています。文書はドライバの種別、攻撃対象領域、脆弱性の分類、攻撃の足がかり、事例、緩和策の順に241ページ。ダッシュボードではドライバ別と脆弱性の分類別を突き合わせた一覧表を掲載し、重大度や悪用の有無での絞り込み、CSVとJSONでの書き出しにも対応します。根本原因の内訳は明確で、入力値の検証漏れが約6割。排他制御の不備が約14%、権限チェックの欠如が約4%と続き、監査で確認すべき箇所は6つのアンチパターンに整理されています。付随するドライバ調査は従来と異なり、危険なAPIがインポートテーブルに載っているかどうかではなく、その関数をユーザーモードからの制御命令（IOCTL）で実際に呼び出せるかをGhidraで判定する方式。

【要点整理】

・6つのアンチパターンは、長さの未検証、排他制御の欠如、ディスク上のオフセットの未検証、物理メモリとモデル固有レジスタ（MSR）の開放、IOCTLの権限チェックの省略、ユーザーバッファの二重フェッチ

・ディスク上のオフセットを検証しない類型の代表が共通ログファイルシステム（CLFS）。ランサムウエアに悪用された3件も同じ類型

・物理メモリとMSRの開放はバグではなく設計。権限チェックの省略と並び、脆弱な正規ドライバの持ち込み（BYOVD）の根本原因

・ドライバ自体に脆弱性がなくても、設計上カーネルメモリの読み書きを開放していれば悪用可能。必要なのは正しいIOCTLを送るクライアントのみで、エクスプロイト開発は不要

・ドライバ調査は2段階。既知の悪用可能ドライバ一覧1,775本を対象に、まず実行ファイルからインポートテーブルと対応IOCTL、ROPガジェット数を抽出し、次にGhidraのヘッドレス解析で、危険なAPIがIOCTLの処理経路から呼び出せるかを判定

・危険なAPIの名前がインポートテーブルにあるだけのドライバと、その関数をIOCTL経由で実際に呼び出せるドライバとを区別する仕組み。名前の有無だけで判定する従来手法との差分

・この1,775本のうち、ユーザーモードのポインタをそのまま受け取る方式が805本。二重フェッチが発生しやすい構造

・入力検証の不備と二重フェッチは静的解析で検出可能。排他制御とエラー処理の不備は実行時にしか顕在化しないためファジングが有効

・件数の多さは危険度ではなく監査の有無を反映。カーネルストリーミング系の14件は2024〜25年の集中監査による結果

・収録件数はページごとに134、147、156、161と4種類が併存。緩和策が無効な本数も制御フローガード（CFG）だけ全数の1,775と一致し、表の見出しと値が不一致

危険なAPIの名前がインポートテーブルにあるだけで悪用可能と数えると、実際にはその関数を外部から呼び出せないドライバまで対象に入ってしまいます。二段目の解析に手間をかける見返りは、遮断や調査の対象を、外部から実際に呼び出せるものだけへ絞り込める点です。

詳細は以下を参照：
https://t.co/vF8pMKPW9m

(※可能な範囲でファクトチェックは実施済なものの、元記事の精度依存や速報・要約の性質上漏れもありうるため、正確な情報は一次情報を直接参照のこと)

158

124

nikk0s3c retweeted

Clandestine

@akaclandestine

about 1 month ago

⚡️ The Opsec Bible ⚡️ The OPSEC Bible is an educational project designed to teach you how to become "ungovernable" through proper Operational Security (OPSEC). It provides comprehensive, step-by-step guides covering three core levels: Privacy, Anonymity, and Deniability, for both client-side and server-side activities. The project aims to counter misinformation and simplify complex security concepts, making them accessible to a wide audience. It is built around an agorist and anti-statist philosophy, encouraging self-reliance and freedom from government control. The entire content is open-source and can be read offline, run locally, or even contributed to for Monero rewards. 🧅 Tor URL (Source): https://t.co/Qxwld9Plxx

akaclandestine's tweet photo. ⚡️ The Opsec Bible ⚡️

The OPSEC Bible is an educational project designed to teach you how to become "ungovernable" through proper Operational Security (OPSEC). It provides comprehensive, step-by-step guides covering three core levels: Privacy, Anonymity, and Deniability, for both client-side and server-side activities. The project aims to counter misinformation and simplify complex security concepts, making them accessible to a wide audience. It is built around an agorist and anti-statist philosophy, encouraging self-reliance and freedom from government control. The entire content is open-source and can be read offline, run locally, or even contributed to for Monero rewards.

🧅 Tor URL (Source): https://t.co/Qxwld9Plxx

603

884

27K

nikk0s3c retweeted

Perly 🦈

@_Shark_byte

about 1 month ago

I compiled over 11k bug bounty reports into one library a little bit ago, I wanted to run some analysis on bounty reports, but had a hard time finding and compiling everything especially across platforms so I decided to just make a library + api for anyone who wants to run any sort of tests/analysis etc lemme know what yall think + anything to add to make it as useful as possible :) link in replies

891

146

75K

nikk0s3c retweeted

/ˈziːf-kɒn/

@x33fcon

4 months ago

"The Art of Evasion" talk at #x33fcon by @ShitSecure - https://t.co/yDSKjo4zpO

nikk0s3c retweeted

/ˈziːf-kɒn/

@x33fcon

about 1 year ago

#x33fcon 2025 talks: @kevin0x90 - Beyond PsExec - Stealthy Lateral Movement Techniques > https://t.co/lrq6s0bxaN

256

162

20K

nikk0s3c retweeted

/ˈziːf-kɒn/

@x33fcon

4 months ago

"#EDR Introspection" talk at #x33fcon by Levi Cailleret - https://t.co/vVdJbPDTc1 - #maldev

131

nikk0s3c retweeted

Adam Chester 🏴‍☠️

@_xpn_

3 months ago

https://t.co/hlIWwwgdzo

10K

nikk0s3c retweeted

PandaRE 🐼 🇺🇦

@PandaRE__

3 months ago

I have been seeing reverse engineering / malware analysis courses that cost thousands of dollars. Do you know you can actually learn that for free, right? There are also a bunch of other courses out there that are way cheaper or even free: - https://t.co/x0CWhENuTj - https://t.co/dAUX2IulA9 - https://t.co/XD7BMbQbQB - https://t.co/HyAEehO3F9 - https://t.co/NffYBgFmWD - https://t.co/pJUPZCLVWz - https://t.co/DldwPTTz6N - https://t.co/RdKdLqZp8H

835

173

142K

nikk0s3c retweeted

cr3ghost

@cr3ghost

3 months ago

Adding to this list. All free. No paywall. No signup. https://t.co/x516DQRcB8 - 700+ pages of malware analysis and exploit research https://t.co/cgxRDKvx2g - full university malware analysis course https://t.co/7uSbDhTq6s - RE101, RE102, macOS RE, PE injection https://t.co/mRHslgjr4f - ARM assembly, shellcode, heap exploitation https://t.co/SLm7Vlyd93 - applied RE series and hypervisor development https://t.co/3SLFBf6xSp - buffer overflows to kernel exploitation https://t.co/gDWRH5YpIx - 30+ courses, WinDbg, IDA, Ghidra, UEFI, kernel exploitation https://t.co/rA4x1Hv2iE - 41 tutorials spanning 17 years of exploit dev https://t.co/DIqWzR1Xp3 - 19-part series, usermode to kernel https://t.co/BJpRHdbTHu - Windows internals, secure kernel, VBS, KDP, dynamic analysis YouTube: https://t.co/KLUDZ9us2g https://t.co/yxJUVqTzvK https://t.co/IvelLJIQhH https://t.co/C8aErWJ5RJ https://t.co/NDG3swCvB1 Thousands of dollars worth of knowledge. All free. #ReverseEngineering #MalwareAnalysis #InfoSec