whynotsecurity

[Ellis Springe @knavesec]

Fresh off the #WayWest2022 Toolshed, dropping my new Office365 userenum technique against Federated tenants, check it out below!
B: https://t.co/1r2s6p684S
G: https://t.co/eccS8ChtCn

[Nic Losby @Blurbdust]

Time for another tool drop. This one I wrote a couple weeks ago for converting ldapdomaindump data to Bloodhound data. Currently only the bare minimum to get data uploaded into Bloodhound works.

B: https://t.co/Rce9eWbxRm
G: https://t.co/R1CKcVn5VR

[Nic Losby @Blurbdust]

Awhile back I wrote a tool to look for Windows registry files in a given haystack of data (.tar, .vhd, .vmdk). If impacket is installed, it will automatically secretsdump the found registry files.

B: https://t.co/y6vWhdgAwm
G: https://t.co/d0gsm8gXlN

[XSS Payloads @XssPayloads]

XSS to RCE: Covert Target Websites into Payload Landing Pages, good introduction article by @knavesec
https://t.co/Qc97O1QBlp

[Ellis Springe @knavesec]

XSS to RCE: Hosting your phishing payload on your client's website, a fun technique for boosting your phishing click rate based off a real attack from a known ransomware threat group
Blog: https://t.co/6Yf88uwFfR

[whynotsecurity @whynotsecurity]

Cool new way to make eyewitness web enum more opsec friendly, designed to bypass scan prevention techniques. Check it out!

[Ellis Springe @knavesec]

EyeWitnessTheFitness: create a single Fireprox API that can pass thru to multiple web endpoints. No need to generate multiple APIs to do enum, more opsec friendly, and helps bypass scan prevention techniques that filter by IP
B: https://t.co/E9hNMkTNMi
G: https://t.co/6U69WH90gw

[Bad Sector Labs @badsectorlabs]

New APIs/syscalls for EDR bypass (@yarden_shafir), UAF browser exploit dev (@33y0re), PowerView replacement [EDD] (@FortyNorthSec), phishing banner defeat (@whynotsecurity), malware packer teardown (@fumik0_), NANDcromancy (@Atredis), and more! https://t.co/toXxXowrh9

[whynotsecurity @whynotsecurity]

Shoutout to @ldionmarcil for making it public. Phishing “external email” warning bypass POC and writeup #redteam

[Ellis Springe @knavesec]

Since it was made public, time to release! Big "External Email" phishing warnings on Outlook webapp & client can be obfuscated with some simple CSS/HTML injections into your phishing email. Writeup, Remediations & POC: https://t.co/sSqilXg4Oe #RedTeam

[Micah Van Deusen @micahvandeusen]

New blog post going into the details about the potato exploits and SeImpersonatePrivilege. https://t.co/QEJRCSppUU

[whynotsecurity @whynotsecurity]

Introducing Credmaster! Easy & anonymous password spraying suite to beat throttle detections. Based on prior work by @ustayready with just a touch of extra research and features
Tool: https://t.co/XUfTrCvllU
Blogpost: https://t.co/8ROQomJpK5

[whynotsecurity @whynotsecurity]

The BloodHound Domain Password Audit Tool, the newest feature of Max. Run cracked password analysis to identify vulnerable groups, privileges and patterns using the power and information of BloodHound. Based off previous work by @OrOneEqualsOne https://t.co/s6bT6jFHVD

[whynotsecurity @whynotsecurity]

Go check this out, new Bloodhound attack primitive plus some updates to a great tool

[Ellis Springe @knavesec]

Its national dog day, so naturally its time to release an update on Max! This update includes a new attack primitive with how it works, as well as some new features to a few of the old functions for better data extraction. Post: https://t.co/zroMYKMfuR

[whynotsecurity @whynotsecurity]

Back with a new blog post, step up your Bloodhound game with Max! Makes it far easier to extract information and interact with the database https://t.co/Q0i6keZWMR

[whynotsecurity @whynotsecurity]

@SwiftOnSecurity Correct, any user is allowed to read the keys.

[whynotsecurity @whynotsecurity]

We are announcing our new blog with a post about Teamviewer and storing user passwords encrypted and not hashed allow for easy plaintext retrieval from the Windows registry.

https://t.co/GQpaQwO6ve