SapientFlow

Red Teaming & Malware Development

[SapientFlow @sapientflow]

@JoelKatz @JedMcCaleb @dark_horse

Canton Network’s L1 need-to-know privacy via Daml is a bank magnet and one of a kind, as pitched to the SEC (https://t.co/35v1D8Un3a). BIS’s Project Promissa proves it (https://t.co/b43Vpy1jzi). Could this steal Ripple/Stellar’s (cross-border payment) pitch?

Canton’s private model feels distant from XRPL/Stellar’s public ledgers.
Any bridges linking Daml’s smart contracts to XRP/XLM’s token systems?
Private XRPLs or Stellar anchors might offer privacy—how do they compare to Canton’s bank-ready setup?

Digital Asset's Canton Network satisfies banks’ privacy needs for sensitive financial products like no other. XRPL/Stellar lead in retail speed & liquidity, and their open ecosystems resonate with crypto’s inclusive roots, while Canton excludes retail users. Can synergies blend these worlds?

[SapientFlow @sapientflow]

Why the debate between @vincent_vancode and @SMQKEDQG ?
Let’s clarify what you’re really arguing about.

RippleNet is ISO 20022 compliant, and its preferred blockchain for transaction settlement is the XRPL, which uses XRP as its native token for gas fees.
However, as Vincent points out, no blockchain — nor any token — sends ISO 20022 messages directly over the chain.
This is why Vincent refers to tokens like XRP as "non-compliant" in the context of ISO 20022 messaging.

Instead, RippleNet (and other ISO 20022 "compliant" systems) relies on an off-chain private network to handle this messaging standard. Here’s how it works: Bank A sends an API request with ISO 20022-formatted data to RippleNet. RippleNet then determines the most efficient way to route the transaction. It might use traditional financial rails (TradFi) for fiat-based exchanges, or it could leverage a blockchain—not necessarily the XRPL—depending on the best path for settlement.

When RippleNet opts for On-Demand Liquidity (ODL) and its optimized chain, the XRPL, it initiates a transaction from Bank A’s wallet to the destination wallet on the XRPL. This transaction contains no ISO 20022 messaging — it’s in JSON, the XRPL’s native format. However, RippleNet may include a unique identifier in the transaction’s Memos field (e.g., the ISO 20022 EndToEndId) to enable off-chain correlation.

Once the XRPL transaction is complete, RippleNet retrieves the transaction ID (e.g., TX1234567890) and correlates it with the original ISO 20022 message using the stored MsgId and EndToEndId. RippleNet then generates an ISO 20022 confirmation message (e.g., in pain.002 format) and sends it to Bank B, ensuring the bank can match the transaction to its original request. This off-chain correlation ensures seamless communication between the blockchain and traditional financial systems, bridging the gap between the two worlds.

To put it differently, as of now, ISO20022 messaging only happens at the start and end (off-chain) and there is no ISO messaging on-chain whatsoever.
Further, RippleNet can provide a similar "ISO20022 compliance support" for any other chain but it needs to build the interfaces for that.
But it is a service that in principle is blockchain-agnostic.

Maybe @JoelKatz can confirm this once and for all (or debate certain points for that matter).

[SapientFlow @sapientflow]

@dobinrutis What it does NOT ever do is to allocate novel code space (RX). So we dont need to spoof stacks, do sleep masks, etc. All APIs are called with existing functionality allocating space for arguments and structures.

Suspicious behavior except API patterns is quite low imo.

[SapientFlow @sapientflow]

My first ever blog post is out:
https://t.co/cFe6Am03Al

Happy for any constructive criticism or anyone that just wants to engage on the topic.

[SapientFlow @sapientflow]

@dobinrutis Can you be a bit more specific in what you mean by "generic DLL caller" ? :)

I personally think that anything in the implant can be mangled by good margin each time. it is just a matter of writing clever code that changes every time.

[SapientFlow @sapientflow]

@GabrielLandau what's the cheapest option for me to test my implants against Elastic Endpoint detection ?
I might just be stupid but as far as I am aware, I can't just buy that for a single host for testing.

[SapientFlow @sapientflow]

@zodiacon Well deserved :)

[SapientFlow @sapientflow]

@0x64616e @C5pider Thanks - I will look into this as soon as I find more time

[SapientFlow @sapientflow]

@0x64616e @C5pider I might have tried this but felt that just passing in parameters to image-backed existing functionality was superior.
Your code/implant does not really change then.

If I missed something big here, tell me 😬

[SapientFlow @sapientflow]

@0x64616e @C5pider I roughly thought about this before I started out with the "railgun"-esque way.

But - to my understanding - your approach would require dynamic code allocation in some manner, no ?

[SapientFlow @sapientflow]

@0x64616e This look very cool !

[SapientFlow @sapientflow]

@hasherezade - Thanks a lot for the repost ! :)
Your wisdom would come quite in handy here - major pros and cons for OPSEC ?

[SapientFlow @sapientflow]

@techspence I should recap my old Red Teaming notes, but I definetely have to freshen up on the latest Azure attack methodologies as well. OST2 has some very cool low level Windows internals courses 🧐 ML ?
More custom tooling ! Got a bit rusty in web apps, should watch more James kettle 🫥

[SapientFlow @sapientflow]

@matterpreter @nostarch An absolute beauty of a book. WOW ❤️

[SapientFlow @sapientflow]

@vxunderground @necrosynthetik If two people would hack your brain, would that be considered a multiple personality disorder ?

[SapientFlow @sapientflow]

@shubakki Very cool ! I enjoyed reading it a lot.
Also kind of jealous of your neat css/website design 👏

[bakki @avx128]

first chapter of two, stay tuned 🤠

https://t.co/496BK7QbV7

[SapientFlow @sapientflow]

@GabrielLandau Could re-use the meme to show my reaction when realizing you have actually read my post 🤧

[SapientFlow @sapientflow]

@s4ntiago_p Thanks man !
But surely not so ingenious programmer haha.
There's quite some cleanup to do - professional programmer would not be thrilled ;)
Trying to improve on that but it is hard, if you never learned that during your studies. Why did I have to study electric engineering ?🙄

[SapientFlow @sapientflow]

@Octoberfest73 Thank you !
You are probably one of my favorite posters to this topic because you question it the most. This ultimately hightlights the flaws of it all. It's not all sunshine and rainbows :)

[SapientFlow @sapientflow]

@conduit0x00 @Octoberfest73 @0xTriboulet That's a good point.
The communication channel also would have to be quite well designed. Running loops for scripts individually and sending them back in a dump way would not be clever - this should entail API-blocks for code logic like that.