Relayed NTLM creds are powerful, if you can use them.
@senderend shows why browsers fail through ntlmrelayx SOCKS and introduces ghostsurf to make NTLM-authenticated web apps accessible.
Read more ⤵️ https://t.co/BdtzoKquD1
Developed a much-needed C2 channel for Mythic with @KingOfTheNOPs during a 24hr hackathon! *.blob.core.windows.net is often one of the only egress methods from more mature client environments.
New from @KingOfTheNOPs + @senderend: azureBlob, a Mythic C2 profile that uses Azure Blob Storage as transport.Supported Agents:
🐍 Medusa
🪽 Pegasus (new test agent)
❤️ Your fav agent (with simple integration guide)
https://t.co/0jNpt5978o
🧵: 1/2
WSL2 is a powerful attacker hideout because it runs as a separate Hyper-V VM, and defenders rarely monitor it.
Daniel Mayer explains how attackers pivot into WSL2 and what it took to build tooling that works across WSL2 versions.
Read more ⤵️ https://t.co/TaPsDDW4Cq
Credential Guard was supposed to end credential dumping. It didn't.
@bytewreck just dropped a new blog post detailing techniques for extracting credentials on fully patched Windows 11 & Server 2025 with modern protections enabled.
Read for more ⤵️ https://t.co/mYPHg1mTKj
MATCH (c1:Computer)-[:MemberOf*1..]->(g:Group) WHERE g.objectsid ENDS WITH '-516' WITH COLLECT(c1[.]name) AS dcs MATCH (c2:Computer) WHERE c2.enabled = true AND (c2.operatingsystem contains '2025') AND (c2[.]name IN dcs) RETURN c2[.]name
If this query hits, you're in.
Had an amazing time at @BSidesSF this weekend! Super fun and well done CTF, solved quite a few and came agonizingly close on some of the harder ones, including one that remained unsolved by anyone! I was thrilled to run into Erik from @badsectorlabs and talk Ludus.
As a follow up to my research on a GLPI command injection vulnerability, I've updated the @pdnuclei
template for this CVE to detect the more advanced RCE vectors I researched. The PR is merged and live in the latest version of Nuclei, check it out below!
https://t.co/N1G5dz71QB
📆 Mark your calendar!
We are hosting a BloodHound user group meet-up in the Seattle area on Weds., May 29. Join @_wald0, @JustinKohler10, @harmj0y & @tifkin_ at @AscendBellevue to get the latest on managing Attack Paths, AD CS & Nemesis.
Register 👉 https://t.co/kFd9V56FPe
In his new post, @jaredcatkinson examines how changing the implementation of tradecraft can have as much of an impact on detection programs as changing the behavior.
Read more ⤵️ https://t.co/gKsHNLXLLi
As a follow up to my PrivEsc Server scripts, here's another writeup with some of my most useful shell aliases and functions. These saved me lots of time and repetitive keystrokes on the #OSCP exam, and made my terminal workflow much more fun!
https://t.co/cD2fwNOHZ5
Here's my in-depth guide to the #OSCP course and exam. Check it out for all the tips and tricks I wish I had when I was studying.
https://t.co/jUlXsRcV9g
turns out, with enough finesse and research, the LSA will give you what you want if you ask nicely. all without touching LSASS memory! excellent wiki here as well.
https://t.co/UQK7l9SLV7
Today I'm releasing AtlasReaper, a .NET tool designed for red teamers to interact with Confluence and Jira via C2 agents.
Discover secrets and launch targeted attacks.
Check out the blogpost for more details:
https://t.co/PtRuXP5Fap
Github Repo:
https://t.co/cWrQLagnTJ