ɥɔıʌǝɹɐsʇ

Tech. infosec. Photography. Perpetual n00b. Opinions mine. IG: petermayanja / Check 👉🏿#AirMayanja

[ɥɔıʌǝɹɐsʇ @petermayanja]

"Intelligence without ambition is a bird without wings." - Salvador Dali

[Greg Brockman @gdb]

sometimes there is no way to debug besides staring at the code until you become enlightened

[Moses Mugerwa @mosesrebo]

With the soccer crew

[ɥɔıʌǝɹɐsʇ @petermayanja]

@JILLKUI @_wangwe I always chalk it up to your musezi ways. 🤷🏿‍♂️

[Daniel Cuthbert @dcuthbert]

We’ve got an smb vuln and now an RCE in word. Next up ⁦@hdmoore⁩ is gonna release this cool framework called Metasploit

2000s baby. They are back https://t.co/EbkanOYfxn

[Nasreddine Bencherchali @nas_bench]

If you actually want to work in detection. Please make an effort to understand the data sources you are using.

It's not EventID==X or CommandLine contains Y, just because you executed malware in your lab and checked the event log. 😭

Here a couple to think about

- Understand how event id are not unique across providers
- CommandLine can be spoofed, and you should know how easy it is.
- ETW offers a lot of hidden gems. Learn more and explore it.
- The registry contains a lot of hard to spoof evidence.
- A technique is not linked to a tool

[John Lindquist @johnlindquist]

Wowzers, dodged a bullet there 😅

[spencer @techspence]

It’s really hard to be a good internal pentester if you’ve never walked in the shoes of a sysadmin or if you’ve never been in an IT support role.

You may be able to run some tools, find vulns and even “get DA” but that’s where your effectiveness will end. That’s the easy part..

What about when questions come up about the finding or how to remediate it?

What about when something you do causes issues?

What about when the client asks how to make X thing better?

Internal pentesting is weird for me because I attribute so much of my “success” to my IT support/sysadmin days.

[PC Philanthropy @PcPhilanthropy]

I’m this old

[Panos Gkatziroulis 🦄 @ipurple]

Relaying Kerberos over SMB using krbrelayx https://t.co/J09qMLgkMF

[Wallabies @wallabies]

MAX. JORGENSEN. 🔥

#Wallabies #AutumnNationsSeries

[EK Rugby Analysis @ek_rugby]

DROP GOALS ARE OVERRATED ANYWAY.

WHAT A WIN WALLABIES

#ENGvAUS

[ɥɔıʌǝɹɐsʇ @petermayanja]

Jorgensen!!
What a game!
#ENGvAUS

[Dennis @dkardonsky_]

Pretty bold take

[alịa @alia0209]

seriously annoyed

fresh linux, all of my peripherals, wireless devices, bluetooth devices, wi-fi, headset, mic, sound, all the games I enjoy, my whole dev setup

all worked first time zero config zero setup zero installers

where's the fight gone man

[Rebane @rebane2001]

new blogpost time!!

this one's a fun writeup on a vulnerability chain i found across multiple google services that earned me a $4133.70 bounty

lots of fun css as usual! i had to recreate a bunch of drive/docs/gmail/youtube UIs c:

have fun!
https://t.co/64ZAIVHoSO

[James Kettle @albinowax]

Love a good client-side exploit chain! This crazy cross-product chain targeting Google by @rebane2001 is a great example of the type of exploit that gets easier the longer you spend targeting a single company
https://t.co/mxhH2N7teW

[Lynn (finally free) @chordbug]

participating in a python ctf this weekend and our team name is chr(sum(range(ord(min(str(not()))))))