Bobby Sanchez

Literally the best #redteam tips | XSS is LIFE | Do you even CORS? | Probably the best hacker in the world | Self-employed | Tweets do not reflect my employer

[Bobby Sanchez @redteambs]

#blueteam guy terminated my beacons. Threw his car keys on the roof. #redteam

[Bobby Sanchez @redteambs]

Bug bounty hunters are the Uber drivers of InfoSec. #criticalxss @Hacker0x01 @Bugcrowd

[Bobby Sanchez @redteambs]

Public shaming works every time. This is why I never redact passwords from screenshots. #redteam #lol

[Bobby Sanchez @redteambs]

This is how white hats deface companies. #pwnd

[Anton @antonjb]

Must make you nervous if your logo comes up during @troyhunt’s talk

[Bobby Sanchez @redteambs]

... I’d say pentesting is a pretty dangerous job, yeah. At any moment an APT could pop my Twitter in retaliation for my blog posting. I’ve got to live with that possibility everyday.

[Bobby Sanchez @redteambs]

Out of jail. Judge didn’t like me using flash bangs on engagements. No one sees the ducky when they can’t see or hear. #whatever

[Bobby Sanchez @redteambs]

Points at floor. You dropped your CEH card. #blueteam guy looks. Lol. #redteam

[Bobby Sanchez @redteambs]

On engagement. Replace toilet paper in all stalls with decoys. After lunch. Completely free access to workstations amid cries for help. #ignored. pic related. #redteam

[Bobby Sanchez @redteambs]

#blueteam guy walks past. Wanna race? Throttle the GPU fans. No reply. Thought so. #gpurace #ntlm #8charkeyspace #alwayswin

[Bobby Sanchez @redteambs]

Tattoo all your scored krbtgt hashes as a chest piece to attract new clients. Shows #dedication which customers love. #prestige #redteamtip

[Bobby Sanchez @redteambs]

@malcomvetter Trick question.
✅ Bobby Sanchez

[Bobby Sanchez @redteambs]

Involuntary pec tenses when I’m sensing 0days in scoping meetings. Pic related. Boss asked me to stop but literally out of my control. #pentest #redteam

[Bobby Sanchez @redteambs]

Want to URL encode ton of web fuzzing payloads. Paste into online encoder because cba for Python rn. Site 500s, 'gateway timeout' for past hour. Literally hack without trying. Demand bounty. Angry response from site owner. #disrespect so do it again. Gateway timeout. Big lol.

[Bobby Sanchez @redteambs]

Boss wouldn't buy us the bicep-curl powered cracking rig off @kickstarter. Going for this lame #brutalis thing instead. #redteam more like #sadteam

[Bobby Sanchez @redteambs]

Friend sent me a passport scan. Can you print this for me? Something about home loan application. Printer's broken etc. #boring. Immediately uploaded to @VirusTotal because #OPSEC. Friend angry. #whatever #trustnoone #redteam

[Bobby Sanchez @redteambs]

Never expensed anything. Colleagues make fun of me. wastingmoney.jpg. Fastforward to weekend #physical #redteam practice. Apparently not "legal". #whatever. Arrested. Boss won't pay bail. Threaten to expense 2xbail worth of conference Chipotle. Bail paid. #redalwayswins

[Bobby Sanchez @redteambs]

Shoutout @ChipotleTweets

[Bobby Sanchez @redteambs]

Bringing pepper spray on my next physical engagement. Elevator guy and receptionist gonna taste the power of the habanero. Pic related. #redteam #physicalpt #habanero

[Bobby Sanchez @redteambs]

@haveibeenpwned They got mong'd.

[Bobby Sanchez @redteambs]

Sent client a PT report. Macros enabled. Three days later, beacon deployed. Lol. Macro also automatically adds new finding to the report. Big lol. Now in trouble with boss. #donthatetheplayer #redteam

[Bobby Sanchez @redteambs]

Doing pentest. Target version vulnerable to RCE (popped in like 2 seconds flat). Recommendation: upgrade to next minor version. Two days later, retest. Recommended minor version also vulnerable af (psych!). Popped a second time. Big lol. #flex #redteam #lol