Posting my write up for @XintraOrg 's Hybrid Azure APT Emulation Lab (Husky Corp) https://t.co/TnhhLHMMQi. Fairly in depth blog post walking through OAuth, Managed Identity, and PTA abuse, Pass the PRT, etc. Huge s/o to @inversecos and the team for making an amazing lab.
I had a fun side project where I reverse engineered, hacked and modded an old Spider-Man mobile game. Check my blog for juicy technical details about game hacking and Android security things - https://t.co/xoKVdmLc4R
Excited to announce the 🚀 launch of the 🔥 LOLESXi project. It provides valuable insights into adversarial techniques targeting VMWARE ESXi.
https://t.co/MLCSW1Zix1 #threatresearch#lolesxi#dfir
I can make you click a phishing link. Want to know how? Just click this link and I will teach you ;) Don't worry. This is not a test. Nobody will know. Just do it: https://t.co/rAnZ2JvS7D
Awesome List of Password Spraying TTPs
Okay, I started pulling this together before my morning run for another project I'm working on. I need contributions. Please submit MRs if you have any ideas for additions!
https://t.co/XuLP9bKi0D
I exfiltrate data from People, SharePoint, Teams, OneDrive, and Outlook. I navigate to https://t.co/dmQ9PeuJYd use People from low privileges to find M365 Public Groups and see what documents I can exfil, what email archives I can read, gain knowledge about the organizational structure and people's PTO sometimes, and get distribution lists. I plant malicious files in OneDrive to transition from cloud to on-prem, I browse to other apps like ServiceNow to get information in wiki's and how-to's. I check admin portals like https://t.co/xPQGqJxwF4 for targeting and get all the configuration information about Oauth app registrations and Enterprise Apps for exploitation. I look for shared mailboxes and delegated mailboxes to hide in. I get location specific restrictions to learn where I can go. I set up internal Illicit Consent phishing for lateral movement and do phishing via access to Teams and SharePoint with device codes and other methods for lateral movement ... to name a few.
Dropping a new initial access technique via RDP that I dubbed "Rogue RDP". Use malicious .RDP files to bypass email/servers/security gateways and then run code to binary plant/exfil from your own RDP server, blinding EDR. Bonus: Target runs HyperV? RCE! https://t.co/iMMS1pK0qs
🗒️ LLM Testing Findings
An open source collection of LLM Integration & Application Findings
Consider using these for a “tabletop” assessment of your own LLM integrations and applications
By @bishopfox#pentesting#AI#cybersecurity
https://t.co/16JNtQACYH
I'm pumped to announce the release of Misconfiguration Manager, a knowledge base and how-to for both offensive and defensive SCCM attack path management, that @subat0mik, @garrfoster, and I have been working on! Check it out and let us know what you think! https://t.co/OuGS5uLAYA
This is a great blog by @Tw1sm
Tldr; Compromise workstations by coercing machine account HTTP authentications and relaying them to LDAP to set shadow credentials on the computer object. Then extract the NT hash, create a silver ticket, move laterally 🔥
https://t.co/PJWolaL5VL