syro

Cybersecurity Specialist. Offensive Operator. Adversary Hunter. Crafting creative solutions for not-yet-existing problems. Hobby flag collector.

[syro @syr0_]

Thank you all for your feedback and for pushing my OSCP Guide as well as my Cybersecurity Handbooks to 1k on each repository!! Never thought that this could happen!! I am happy to see that I created something useful and giving back a little bit to the community <3
#OSCP #offsec

[Alex Neff @al3x_n3ff]

Onelogon: Taking over Active Directory Accounts via Netlogon🔑

We analyzed Netlogon, bypassed the Zerologon patch, resulting in a full auth bypass. An attacker can leverage this to compromise computer accounts, or even the entire AD. Non-standard config must be present tho 🧵

[Clandestine @akaclandestine]

GitHub - p3ta00/killshot: Polymorphic AV/AMSI bypass toolkit - Donut shellcode runner for offensive .NET/PE tools · GitHub https://t.co/tLVyNxXEko

[Nicolas Krassas @Dinosn]

GitHub - iss4cf0ng/OpenPetya: A Proof-of-Concept bootkit inspired by Petya ransomware, written in Assembly, C, and C++ https://t.co/3HeWSzO2LZ

[Andre Gironda @AndreGironda]

Windows DNS Client RCE -- CVE-2026-41096 POC -- qdcount=0, a DNS OPT resource record (type 41), and 0xff bytes via example response -- https://t.co/wzSIXuCLPo

[IT Guy @T3chFalcon]

For windows.
The second you plug that drive in, Windows logs the Volume Serial Number to the Registry.

When the Forensice analyst (or Feds) audit that machine, they see:

Device "KingstonDT" connected at 14:00.

Prefetch shows "Mimikatz.exe" ran at 14:01.

Unplugging the drive didn't scrub the Registry.

[Nicolas Krassas @Dinosn]

How I Defeat Passkeys Nearly Every Time in Phishing Assessments https://t.co/B692Xeh552

[SEKTOR7 Institute @SEKTOR7net]

Mythic C2 on EarlyBird.

Leveraging Asynchronous Procedure Calls to execute memory-only shellcode within a legitimate process to avoid detection.

A post by Ivan Spiridonov (@xbz0n)

Source: https://t.co/Ru0iTMSMyV

#redteam #blueteam #maldev #malwaredevelopment

[Wietze @Wietze]

🆕 Recent additions to https://t.co/c2bs1Aao0r:

• sigverif/odbcad32.exe for UAC bypass via GUI
• IntelliTrace/dxcap/logger.exe for proxy execution
• cmstp.exe for loading arbitrary DLLs
• cipher.exe for impairing defences

⭐ Nearly 8,500 GitHub stars - thank you all!

[Muqsit 𝕏 @mqst_]

🦺 Wifite Complete Guide: Guide to Checking Your Router’s Security with Wifite

Blog: https://t.co/97MnaBnMGQ

Author: @rdezso

[Moritz @m_r_tz]

The FLARE team now freely distributes its quality reverse engineering and malware analysis educational content at https://t.co/bGCIjBfD3C. Launched with:
- Malware Analysis Crash Course
- Go Reversing Reference
- Intro to TTD

[💻🥷 WarthogTK 🩺 @warthogtk]

A Ligolo-ng JavaScript agent working inside Chrome/Edge by leveraging Isolated Web Applications

https://t.co/h9zEVG4qPR
https://t.co/QRrDC1UTKf

[Melvin langvik @Flangvik]

**OFFICIAL** EDR Tier List for 2026! Based on nothing but the people in chat, vibes, guests, opinions and limited experience. Thanks to @EmericNasi @ShitSecure @_JohnHammond and @domchell for jumping in a guests to help me out this time around!

[Melvin langvik @Flangvik]

Only one hour away!! I have a few surprise guests lined up who will jump in with input, you don’t want to miss this one 🥳

[sender @senderend]

Developed a much-needed C2 channel for Mythic with @KingOfTheNOPs during a 24hr hackathon! *.blob.core.windows.net is often one of the only egress methods from more mature client environments.

[Steffen Buck @buck_steffen]

@Defte_ Update:
Thanks to @RedTeamPT, I created a pull request for ntlmrelayx to reflect the new requirements:
https://t.co/g42CHDxQdB
Now Shadow Creds are working again 😀

[AИDREA @cyrus_and]

GTFOBins finally has a proper domain:

https://t.co/Y1gLMCI4jL

Huge thanks to everyone who sponsored the project!

[Aurélien Chalot @Defte_]

Anyone know if Microsoft silently patch the Shadow Creds attack recently ? Looks like a computer object cannot write its own attribute anymore :D

[S3cur3Th1sSh1t @ShitSecure]

Today I had an ldap https://t.co/evbXcRdpa7 socks connection but all tools failed to query LDAP via socks5 except from certipy. But certipy only queries certificate information. Well, so I let claude code something which worked 🧐

https://t.co/ytjJOcqGX7

[solst/ICE of Astarte @IceSolst]

k8s “read only” role allows a little more than reading

[RyotaK @ryotkak]

Another vulnerability in React Server Components (CVE-2026-23864) that I reported was disclosed today.

This is separate from the one disclosed in December, so you'll need to update again.

https://t.co/k7hgEzIWDb