Payload Forge

[Payload Forge @payloadforge]

SpecterOps has 3 free on-demand courses in its Tradecraft Academy. Kubernetes for Red Teamers is a solid intro to attacking Kubernetes and Mythic.

I also patched the lab for KVM/libvirt:
https://t.co/X3LwqNziZt

#RedTeam #Kubernetes

[Payload Forge @payloadforge]

Original PoC by Aniq F.
https://t.co/i4aXOfx5CZ

Patched forks if you want to test before the PRs merge.
https://t.co/LzmbOQeulp
https://t.co/URPxCe8yIr

[Payload Forge @payloadforge]

CertiGhost (CVE-2026-54121) was published on 24 July by H0j3n and Aniq F. I expected to spend five minutes running their PoC in my Ludus lab. Every run failed in the same place with STATUS_NOLOGON_SERVER_TRUST_ACCOUNT.

https://t.co/kULeSn224k

[Payload Forge @payloadforge]

With both patched, the CA cleared both callbacks and issued a certificate. A workstation target completed PKINIT and returned its NT hash and ccache. Three PRs followed.

Impacket https://t.co/p5h1gUe57U
CertiGhost fix https://t.co/SI4EIbjG5G
Debug https://t.co/3RyMZULoKR

[Payload Forge @payloadforge]

I bypassed Skillable's per-user lab limit by changing a userId the browser hands over, then used a colleague's allocation with his consent. Skillable says it is SCORM's fault, not theirs, and will not fix. So I disclosed it. CVE-2026-56877.
https://t.co/Bjb6FwIjR4

[Payload Forge @payloadforge]

A real root-level bug chain, acknowledged by the maintainer and the deployment operator. Still no CVE.

Declined on scope, rejected twice as “appears to be a test”, now parked at MITRE. Fixed and merged upstream; the ID field still blank.

https://t.co/t3bj9kst3m

#cve #CRTO

[Payload Forge @payloadforge]

Passed the CRTO. Five years late, but passed.

Retrospective on what changed between 2020 and 2026: platform, tradecraft, exam. Plus two security issues reported under coordinated disclosure.

https://t.co/HAB6aVuVea

[Payload Forge @payloadforge]

Same appliance tested twice at two different orgs.

First time: 20+ findings from VA scans and a ChatGPT prompt. Second time: 5 CVEs in 5 days, vendor patches, halted go-live.

I wrote up what changed.

https://t.co/7gg68iMsDn

[Payload Forge @payloadforge]

2/2 Grok cited 119 sources with CLI flags that don't exist. Claude caught the hallucination… then suggested its own unverified workarounds. The actual fix? Plain old human debugging instinct.
Full write-up: https://t.co/j6LaJV2yvI.

[Payload Forge @payloadforge]

1/2 War diary from LLM-assisted pentesting: needed a vulnerable che-machine-exec instance for my Metasploit PR (CVE-2025-12548, unauth RCE in Eclipse Che). Asked Grok 4 and Claude Sonnet 4.6. Both confidently wrong.

[Payload Forge @payloadforge]

@_RastaMouse

[Payload Forge @payloadforge]

@Filzime @Filzime @MakeItAQuote Quote

[IAM!ERICA @EricaZelic]

CitrixBleed. Yep, that's it, the whole exploit.
https://t.co/sZW0X65bcU

[Payload Forge @payloadforge]

@_RastaMouse Some men just want to watch the world burn.

[Payload Forge @payloadforge]

@mpgn_x64 Thanks for your hard work 🫡

[Payload Forge @payloadforge]

@snovvcrash Or Winfoom on *win (which supports PAC and Kerberos auth)

[Payload Forge @payloadforge]

@snovvcrash Proxy through Cntlm

[Payload Forge @payloadforge]

@DKaufmann_ @NextDNS @Pug50 Same issue here on pfSense since ~9h ago.

[Tavis Ormandy @taviso]

I think lots of developers find it surprising that resource limits apply across setuid/setgid/filecap exec boundaries. Here is the quick and dirty tool I use to find interesting errors to investigate. https://t.co/xuJwh9rcPS