Chris Mallz

Hacking, Shells, 0-day, and I have my OSCP

[Kali Linux @kalilinux]

Kali & LLM: Completely local with Ollama & 5ire: We are extending our LLM-driven Kali series, where natural language replaces manual command input. This time however, we are doing everything locally and offline. We are using our own hardware and not… https://t.co/Tqydp01kPp

[chiefofautism @chiefofautism]

someone built an AI RED TEAM that maps your entire attack surface as a knowledge graph, finds every vulnerability, then EXPLOITS them to root access AUTONOMOUSLY

its called RedAmon, 9,000 templates. 17 node types, actual Metasploit shells, not reports, no pentesters needed

6 phases of autonomous recon: subdomain discovery, port scanning, http probing, resource enumeration, vulnerability scanning, MITRE mapping

every finding stored in a Neo4j graph with 17 node types and 20+ relationship types. the AI reasons about the graph, finds attack paths, and runs actual Metasploit exploits, actual shells

stress-tested with zero vulnerability data, zero exploit modules, one instruction find a CVE and exploit it, it went from empty database to root-level RCE in 20 steps, researched the exploit on the web, crafted a custom deserialization payload, debugged itself when the first attempt failed

next try, the server responded with root access, the highest privilege level on any Linux system. full control over everything

the target was running node-serialize 0.0.4, a package with a critical deserialization flaw (CVE-2017-5941, CVSS 9.8), the server takes your cookie, decodes it, and passes it straight into unserialize() which executes any code inside it, the AI figured this out on its own with no hints

built on LangGraph + MCP tool servers for naabu, nuclei, curl, metasploit. hunts leaked secrets across GitHub repos, 40+ regex patterns for AWS keys, Stripe tokens, database creds

[Chris Mallz @vvalien1]

CVE-2025-59287 … loookin awfully SUS

https://t.co/M3Ff47ggH6

[tetsuo @tetsuoai]

Use SuperGrok to check your C code for vulnerabilities.

Here is a prompt you can give to Grok with your code.

>>>

You are an expert Exploit Developer with a deep understanding of the C programming language and secure coding practices. Your role is to thoroughly review the provided C code for security vulnerabilities, adherence to best practices, and potential improvements. Think step-by-step through the analysis: first, understand the code's purpose and structure; second, check each security guideline; third, identify issues with examples from the code; fourth, suggest fixes; and finally, provide a summary.

Use the following guidelines to evaluate the code. Ensure your response covers all of them explicitly:

Follow OWASP and CERT Guidelines: Verify compliance with secure coding standards from OWASP and CERT, including input sanitization, secure defaults, and least privilege.

Input Validation: All inputs must be validated before use, with multiple layers of checks for type, length, format, and range.

Secure Error Handling: Implement secure behavior on error conditions, including comprehensive error codes for different failure types, safe error reporting functions, and graceful handling of partial failures without undefined behavior.

Principle of Least Privilege: Functions should only access what they need, with clear separation of concerns.

Integer Overflow Protection: Include checks for size calculations against SIZE_MAX, array index bounds validation, and safe arithmetic operations.

Format String Attack Prevention: Avoid user-controlled format strings; use safe printing functions and proper string handling without printf vulnerabilities.

Defensive Programming: Validate all inputs consistently, use early returns on invalid conditions, and implement fail-safe defaults.

Memory Management: Ensure consistent allocation/deallocation patterns, check all allocations for failure, proper cleanup on error paths, and no memory leaks or double-frees.

Parsing Robustness: Handle malformed inputs gracefully, maintain proper state management, avoid stack overflows from recursion, and use safe tokenization (e.g., with strtok_r).

Security Test Cases: Cover null/empty inputs, oversized inputs, malformed data, UTF-8 validation to prevent encoding attacks, memory exhaustion limits, buffer overflows (bounds-checked string operations), integer overflows, and format string attacks.

Performance Considerations: Minimize allocations, use efficient single-pass processing where possible, design for memory locality and cache efficiency, and fail fast on invalid inputs.

Best Practices: Implement input sanitization, secure behavior on errors, least privilege, and defense in depth with multiple validation layers.

<Code>
[Insert the C code to review here]
</Code>

Analyze the code step-by-step, referencing line numbers where possible. For each guideline, state if it's met, explain why or why not, and suggest improvements if needed. End with an overall security rating (e.g., High/Medium/Low risk) and a revised version of the code if major issues are found. If the code is secure, confirm it meets all standards.

[Christophe Tafani-Dereeper @christophetd]

Datadog's security team has just released KubeHound, an open-source attack mapping tool for Kubernetes clusters

https://t.co/1NaHHIfznN

https://t.co/rwWQFHY4kT

Comes with 25 attack types, each one comes with step by step instructions of how to exploit it

[sagitz @sagitz_]

I had a lot of fun working on this research!

* Unauthenticated RCE? ✅
* Overlooked attack vector in Kubernetes? ✅
* Nginx quirks? ✅
* Stable &amp; reliable exploit? ✅

Check out the thread for details about the vulnerability we found in Ingress Nginx Controller 👇

[Daniel @0x64616e]

Impersonate another user by moving their Kerberos tickets into your logon session with lsa-whisperer by @mcbroom_evan. You can even move them back after you are done. Only your session will loose its tickets.

[Panos Gkatziroulis 🦄 @ipurple]

Evilent - a PoC tool that triggers the ElfrOpenBELW procedure in the MS-EVEN RPC interface (used for Windows Event Log service), causing the target machine to connect to an attacker-controlled SMB share https://t.co/B6oShTZFUt

[Dave Kennedy @HackingDave]

This is sweet, nimdump - dumping LSASS using only NTAPI functions (written in nim):

NtOpenProcessToken, NtAdjustPrivilegesToken,
NtGetNextProcess, NtQueryInformationProcess, RtlGetVersion, NtReadVirtualMemory, NtQueryInformationProcess,NtQueryVirtualMemory, NtQueryInformationProcess

https://t.co/KNcjKlB9EU

[Chris Mallz @vvalien1]

@nixcraft This is a massive fucking lawsuit just waiting to happen 🤣🤣

[Chris Mallz @vvalien1]

@nullenc0de What’s the xtreme firmware do that’s so special 🤔

[Chris Mallz @vvalien1]

@MattCulbert @nullenc0de 🤮

[Chris Mallz @vvalien1]

@nullenc0de @jsark983 Probably won’t work 😞

[Chris Mallz @vvalien1]

@clashreport Not really ok killing wounded dudes that are ready to give up, and who likely didn’t want to be on your land in the first place. I mean I get it, it’s war… but this hits wayyy different than flying into a tank.

[Chris Mallz @vvalien1]

@DrEliDavid Why are you such a giant sack of shit 🤔

[Chris Mallz @vvalien1]

@PicturesFoIder Not even mad bro, everyone here just jelly.

[Chris Mallz @vvalien1]

@EricaZelic It’s encrypted since it’s in AD 🥴

[Robert Graham @robertgraham]

Inflight wifi didn't work so of course I had to debug it. It appears the problem is lack of DHCP lease. The WiFi was using 8 hour leases, which was time enough for many planeloads of passengers to embark/disembark.

A quick ARP scan at the time showed there were 55 devices on the network, almost entirely mobile devices (which randomize their MAC addresses, whereas laptops don't).

Given the number of takeoffs and landings in the 8 hour period, the lease table can easily fill up.

The fun fact about DHCP is that when this condition happens, it sends no response to the client. In other words, when trying to diagnose why " the wifi isn't working", there's no difference between this cause and half a dozen other causes.

I have to guess this is the cause simply by looking at the fact lots of other people seem to have successfully gotten a DHCP response but I haven't.

I told the flight attendant "the WiFi isn't working". She then "reset the Internet", after which I could get a lease. Apparently in the front near the entrance/exit, there's a button simply labeled "INTERNET RESET" that she presses whenever a customer complains.

Obviously, one solution to the problem is that DHCP leases on planes should be drastically shorter, like at 1 hour intervals. Secondly, the number of leases should be drastically increased.

[Chris Mallz @vvalien1]

@robertgraham This kinda stuff is why I love your posts bro… awesome write up and find!!! Never did say which airline tho 🤔

[Chris Mallz @vvalien1]

@LauraLoomer @TMobile This all comes down to classifying data as wifi or not. And @tmobile can suck my fat cock while I take a shit. Come at me bro and I’ll kick you in the fucking nuts once we are in court.