Harley Lebeau

Red Teamer/Penetration Tester, Husband, Father, OSCP

[Harley Lebeau @r3dQu1nn]

Determine all well known EDR products installed on a host before executing commands in Cobalt Strike with EDR.cna! https://t.co/3EOSzaHgG6

[Harley Lebeau @r3dQu1nn]

@curi0usJack So cool man! Hope all is well!

[Dirk-jan @_dirkjan]

I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: https://t.co/jD6EaGtsn3

[Harley Lebeau @r3dQu1nn]

I haven't posted in a long time but wanted to support my region and help announce the very first Mandiant community night! Enjoy presentations from the Mandiant team and network with like minded people over food and drinks! Great opportunity! https://t.co/PflURmH8El

[/r/netsec @_r_netsec]

Attacking Active Directory Certificate Service Part 3 https://t.co/3M694Q36aB

[/r/netsec @_r_netsec]

Persistence - DLL Proxy Loading https://t.co/Rjkz2b1npS

[Chetan Nayak (Brute Ratel C4 Author) @NinjaParanoid]

Watching people tweet they bypassed a certain EDR is just cringe at this point. When you ask them what did they bypass, they dont know what. So let me take you back to school...

Executing OpenSource tool is not a bypass. An EDR employs several mechanisms for detection. Getting a new implant for a twitter image is not evasion. To have a proper bypass, several conditions must be met. Lets see...

1. When you say you bypassed an EDR, what did you pass? Initial connection? Post-ex? Userland unhooking of DLLs? DLL callbacks? Exception handlers? Kernel hooks? Userland ETW or Kernel ETW? Yaras? If you didnt test any of this, how do you know that you bypassed it.
2. I know EDRs which simply allow connection and monitor it to gather more intel on threats, but will kill the implant upon interaction with local env.
3. The implant must be executed in the form of an initial access like an actual RT/TA would do.
4. All EDR functionalities must be enabled including internet for ML anomalies
5. Did you interact with the implant after getting a shell? Most EDRs will kill you on the moment of interaction with local files or processes due to call-stack scanning.
6. Does your implant leave "shouting traces" of "I exist" in memory which can be traced with a simple process monitor with a memory dump?

Most importantly, have you ever reversed the EDR or its modules to understand what exactly is happening in the back end? Do you even know "WHAT" is actually being detected by the EDR? On the other hand, I just woke up and I guess I chose voilence today. So time to go back to sleep 😂.

[Chris Thompson @retBandit]

Come hack with us! I am hiring for operators for our Managed Red Teaming practice. This role delivers "continuous" monthly red team services for clients to a "Targeted" sophistication level, helping them mature their security program on a more frequent basis then our ad-hoc, more sophisticated advanced red team exercises, which typically last 2-3 months.
Senior candidates only, please provide a link to your GitHub and any research you have conducted. Post-Secondary education not required. There are opportunities for top performing managed red team operators to transition to the advanced team over time. US only for this req, remote.

https://t.co/2ZNFOGYy1P

[X @TheMsterDoctor1]

🔍 #Recon automation for #bughunters

1- Subdomain discovery with Subfinder:
```
subfinder -dL targets.txt -all -recursive -o facebook.txt
cat facebook.txt | wc -l
```

2- Discover subdomains via https://t.co/3SNVM49m71:
```
curl -s https://t.co/3SNVM49m71\?q\=\https://t.co/zPr7Thk72Q\&output\=json | jq -r '.[].name_value' | grep -Po '(\w+\.\w+\.\w+)$' | anew subdomains-faceboo.txt
cat subdomains-faceboo.txt | wc -l
```

3- Check live subdomains with HTTPX:
```
cat subdomains-faceboo.txt | httpx -l subdomains-faceboo.txt -ports 443,80,8080,8000,8888 -threads 200 > subdomains-faceboo-alive.txt
cat subdomains-faceboo-alive.txt | wc -l
```

4- Port scanning with Naabu:
```
naabu -list subdomains-faceboo.txt -c 50 -nmap-cli 'nmap -sV -sC' -o naabu-full.txt
```

5- Directory brute-forcing using Dirsearch:
```
python3 /home/casperino/tools/dirsearch/dirsearch.py -l subdomains-faceboo-alive.txt -x 500,502,429,404,400 -R 5 --random-agent -t 100 -F -o directory-facebook.txt -w /home/casperino/cyber-event/OneListForAll/onelistforallshort.txt
```

6- Gather parameters with Gau:
```
cat subdomains-faceboo-alive.txt | sudo gau > facebook-params.txt
cat facebook-params.txt | wc -l
```

7- Filter parameters with Uro:
```
cat facebook-params.txt | uro -o facebook-filterparameters.txt
cat facebook-filterparameters.txt | wc -l
```

8- Extract JavaScript files:
```
cat facebook-filterparameters.txt | grep ".js$" > facebook-jsfiles.txt
cat facebook-jsfiles.txt | wc -l
```

9- Find secrets with SecretFinder:
```
cat facebook-jsfiles.txt | while read url; do python3 /home/casperino/tools/SecretFinder/SecretFinder.py -i $url -o cli > facebook-secret-finder.txt; done
```

10- Sort wordlist:
```python
# Code snippet in https://t.co/o3R7Tf87NW

# Read the word list from the file
with open('/home/casperino/cyber-event/facebook-filterparameters.txt', 'r') as file:
lines = file.readlines()

# Sort the lines
lines.sort()

# Take the first 10,000 lines
lines = lines[:10000]

# Write the sorted list to a new file
with open('sorted_wordlist_10000.txt', 'w') as file:
file.writelines(lines)

11- Scan with Nuclei:
```
nuclei -l sorted_wordlist_10000.txt -c 70 -rl 200 -fhr -lfa -t /home/casperino/tools/nuclei/Custom-Nuclei-Templates/ -o facebook-nuclei.txt -es info
```

🔗 Additional resources:
1- Shodan Dorks: https://t.co/kHA1DyC0OJ
2- Github Dorks: https://t.co/gMHzPd6TxF
3- Google Dorks: https://t.co/rGhdbquDD2…

#automation #pentesting #infosec #bugbounty #cybersecurity101

[Florian Hansemann @CyberWarship]

''Attacking an EDR - Part 3''

#infosec #pentest #redteam #blueteam
https://t.co/WFZdclhbcD

[Harley Lebeau @r3dQu1nn]

@HackingDave ON whey is the only choice. ��

[Kuba Gretzky @mrgretzky]

Evilginx 💗 Gophish

The long-awaited official integration of Evilginx with Gophish has finally arrived with the Evilginx 3.3 update. 🪝🐟

The update includes lots of quality-of-life improvements as well.

Enjoy and happy phishing! 🤗
https://t.co/Cqma4vpRFm

[Kuba Gretzky @mrgretzky]

Tired of failed phishing attempts?

Using the 1337est AI FAFO technology, Evilginx trained on data from thousands of successful login attempts, can now predict valid session cookies, even before the phished user starts to enter their credentials.🔥

The new era of AIshing awaits!

[Harley Lebeau @r3dQu1nn]

@HackingLZ @_bin_Ash @anthemtotheego Love this!

[Harley Lebeau @r3dQu1nn]

@_bin_Ash @HackingLZ @anthemtotheego Wait what does dumb hard mean lol

[Kuba Gretzky @mrgretzky]

🚨BREAKING: Evilginx 3.2 is OUT! 🪝🐟

To celebrate the release of the new update, here is the special 10% discount code for the Evilginx Mastery course!

🎁Code: EVILGINX32 (valid until 31st Aug)
🔗Link: https://t.co/C5XxroUn7C

https://t.co/wIZx2HlxCU

[CCob🏴󠁧󠁢󠁷󠁬󠁳󠁿 @_EthicalChaos_]

Thanks to everyone who came to my DEF CON talk yesterday. I should have submitted for a 45 minute talk as I didn't have time to cover the DNS update capability of gssapi-abuse tool. DNS mode is super handy if you want to apply instant updates to AD DNS https://t.co/syW5QtTliw

[Dr. Nestori Syynimaa @DrAzureAD]

Slides of my #DEFCON31 talk available at https://t.co/3EcJMkg7VC

[Hacking Articles @hackinarticles]

Docker CLI Cheat Sheet

#infosec #cybersecurity #pentesting #redteam #informationsecurity #CyberSec #networking #networksecurity #infosecurity #cyberattacks #security #linux #cybersecurityawareness #bugbounty #bugbountytips

[Harley Lebeau @r3dQu1nn]

@FuzzySec 🤣🤣🤣

[Stan Hegt @StanHacked]

@OutflankNL blog: Attacking Visual Studio for Initial Access.

The post shows how viewing source code can lead to compromise of a dev's workstation. A journey into COM, type libraries and the inner workings of VS. Plus practical examples for red team ops.

https://t.co/awZL4hiH4R