Snowscan

Load "$",8; Red Team

[SpecterOps @SpecterOps]

Relayed NTLM creds are powerful, if you can use them.

@senderend shows why browsers fail through ntlmrelayx SOCKS and introduces ghostsurf to make NTLM-authenticated web apps accessible.

Read more ⤵️ https://t.co/BdtzoKquD1

[Snowscan @snowscan]

@b13bs_ AWS explicitly prohibits using Amazon API Gateway for outbound pentesting now: See prohibited activities -> https://t.co/mLijd1DUIu

[hasherezade @hasherezade]

And the source code: https://t.co/vUVnuoSoDv

[hasherezade @hasherezade]

My new blog for Check Point Research - check it out! 💙 // #ProcessInjection : #WaitingThreadHijacking

[SkelSec @SkelSec]

#pypykatz new version 0.6.11 is out on github and pip.
Big thanks to all awesome contributors!!
Besides the fixes, the two important things in this version:
- Kerberos aes keys extraction is now supported
- !!!!Windows 24H2 support is here!!!!!
https://t.co/BFvq0VMkWD

[NetSPI @NetSPI]

Introducing PowerHuntShares 2.0 Release!

NetSPI VP of Research @_nullbind introduces new insights, charts, graphs, & LLM capabilities that can be used to map the relationships & risks being exposed through the network shares: https://t.co/t04BNLmuot

[Snowscan @snowscan]

@Bell Is this a standard fiber cabling installation? Running the fiber over my neighbor's driveway?

[Snowscan @snowscan]

Just got some nice swag from @vulnlab_eu 😄

[Andrew Oliveau @AndrewOliveau]

CcmPwn is equipped with various modules. The “exec” module runs an AppDomainManager Injection payload for every logged-in user. The “coerce” module coerces SMB/HTTP authentications, which can then be used for password cracking or relay attacks. 👇

https://t.co/QrfZr4VGKB

[adamm @adamsimuntis]

Found a flaw in NetBSD's utmp_update allowing injection of ASCII escape sequences into utmpx logs, leading to unexpected terminal emulator behavior and utmpx database integrity concerns.

https://t.co/tNbdfD3zT3 #NetBSD #Security

[CODE WHITE GmbH @codewhitesec]

Struggeling to get those precious certificates with #certipy and AD CS instances that do not support web enrollment and do not expose CertSvc via RPC? @qtc_de has you covered and added functionality to use DCOM instead of good old RPC #redteaming https://t.co/uyeXu8XeBQ

[Snowscan @snowscan]

@MarcOverIP @podalirius_ @OutflankNL @msftsecresponse Pretty sure this is using the Windows Search Service. My own implementation here: https://t.co/qKeUfdaKB8

[Dirk-jan @_dirkjan]

It's been quiet for a while around bloodhound Python, however I'm happy to share that I am now maintaining the project at my personal GitHub. The latest version fixes many bugs/issues, also thanks to the many PRs that were submitted (thanks all!). https://t.co/biBprRdgJj

[Antonio Cocomazzi @splinter_code]

Do you want to start the RemoteRegistry service without Admin privileges?
Just write into the "winreg" named pipe 👇

[Snowscan @snowscan]

@splinter_code I think this only works if the service start type is not disabled, otherwise triggers are inactive.

[Snowscan @snowscan]

@reversebrain congrats!

[Snowscan @snowscan]

Did Bethesda hire the Microsoft UX team to work on Starfield? This is so shit. Really disappointed with the game so far.

[Snowscan @snowscan]

Thanks to the generous folks @bcsecurity @hackthebox_eu @SANSOffensive @sektor7net and @nostarch for sponsoring prizes at the DEF CON Red Team Village CTF!

[Snowscan @snowscan]

@rootsecdev @infosecdoc For sure that's at least 20$ right there