Garrett

Research at @SpecterOps

[Hope Walker @Icemoonhsv]

I'm excited to be able to finally publish the public disclosure for CVE-2026-4387. Check out my blog on discovering the reuse of the state.kv file to get authenticated sessions with StrongDM (now fixed). https://t.co/IbS1IjPxJL

[Garrett @unsigned_sh0rt]

I guess it's dunk on MSRC day lol

[SpecterOps @SpecterOps]

Phishing sandboxes don’t play fair.

In his latest blog, @synzack21 walks through a real red team engagement against modern email sandboxes and techniques that helped keep payload redirects hidden from crawlers while preserving a familiar user experience. https://t.co/jdCGMLGNWa

[Garrett @unsigned_sh0rt]

@_xpn_ @curi0usJack man I just want a new GPU without having to sell a kidney

[Garrett @unsigned_sh0rt]

@_xpn_ @Emma_Chester Happy birthday!!

[Enno Rey @Enno_Insinuator]

It will be huge! – (mostly) full @WEareTROOPERS #TROOPERS26 agenda published:
https://t.co/Ujg1Mc33dZ
https://t.co/XGBcbRcM3L

[Garrett @unsigned_sh0rt]

👀👀

[Logan Goins @_logangoins]

Just added krb5 auth over ADWS in my tool SOAPy. I noticed since SOAPy released 2 yrs ago with the first ADWS python code nobody had implemented krb5 auth in python.

Check it out here, and stay tuned for an upcoming blog post + big release 👀

https://t.co/PvIQC4iWlh

[Pavel Yosifovich @zodiacon]

Launching a WSL process from a Windows process with WslLaunch
https://t.co/W6y9845Xo6

[SpecterOps @SpecterOps]

NTLMv1 is still out there. And now it’s easier than ever to break.

@skylerknecht walks through how Google’s rainbow tables make NT hash recovery practical, no third-party service required.

Check it out! ⤵️ https://t.co/AoC1NFBNK1

[Garrett @unsigned_sh0rt]

@4ndr3w6S

[Brett Hawkins @h4wkst3r]

I explored how privilege connects DevOps and MLOps into attack paths that are often missed in traditional threat models. I will be presenting this at #SOCON2026 next week.

@ArmadinSecurity Research here 👇
https://t.co/kG7hiH3RWZ

[Daniel Heinsen @hotnops]

Pasting API keys in an LLM makes me feel kinda gross, so I created agentcordon. It's an agentic key vault that's:
✅Agent agnostic
✅Cedar policies for clear authorization
✅Fully auditable
✅Remote MCP Support

[Garrett @unsigned_sh0rt]

@wdormann @vxunderground yeah when the hell did the video requirement become a thing?

[Logan D @relay_royalty]

I got tired of manually doing the "enum DNS -> figure out which ones are live -> request each one in the browser to populate Burp target sitemap" loop ad nauseam. I built a lightweight command line tool + Burp extension to automate this entire process.

Simply run the tool with very basic args, load the extension, and get everything into your Burp project with no hassle.

Also really nice for passive checks (--no-nmap) in the pre-sales/scoping process with prospective clients to get an idea of what all they have actually exposed from an application standpoint at a birds-eye view.

Enjoy.

https://t.co/kqr780RSFx

[Garrett @unsigned_sh0rt]

@_xpn_ @SpecterOps wtf two years already

[Garrett @unsigned_sh0rt]

@kyleavery probably right

[Garrett @unsigned_sh0rt]

Idk what happened but the end of last year MSRC was quick, responsive, and overall just better. Lately it's a ghost town with auto responses and no updates.

[Garrett @unsigned_sh0rt]

@_xpn_ I thought you might have some thoughts after using the tool 🤣

[Garrett @unsigned_sh0rt]

@_dru1d @mrgretzky has been shouting about it for weeks lol

[Garrett @unsigned_sh0rt]

everyone freaking out about quotes dropping

haven't people been warning about this for weeks? that everything was heavily subsidized and wasn't sustainable?

[Garrett @unsigned_sh0rt]

quotas*