Channel Public Channel

Alaid TechThread

@offensive_thread

Vulnerability discovery, threat intelligence, reverse engineering, AppSec

Open in Telegram

Subscribers: 1.14K
Photos: 7
Videos: 2
Links: 1.4K

Showing posts older than #1021 · Back to latest

Older Posts 20 shown

Post #1020 66 Dec 15, 2020, 08:59 UTC

Building C2 Implants in C++: A Primer

https://shogunlab.gitbook.io/building-c2-implants-in-cpp-a-primer/

shogunlab.gitbook.io Introduction | Building C2 Implants in C++: A Primer Intro to the book contents and what to expect.

Post #1019 78 Dec 10, 2020, 21:32 UTC

CVE-2020-17049: Kerberos Bronze Bit Attack - Overview

http://blog.netspi.com/cve-2020-17049-kerberos-bronze-bit-overview/

NetSPI CVE-2020-17049: Kerberos Bronze Bit Attack - Overview Read a helpful overview of the Bronze Bit attack (CVE-2020-17049) against Kerberos implementations in Windows Active Directory.

Post #1018 68 Dec 10, 2020, 21:17 UTC

4 Free easy wins that make Red Teams harder

https://www.trustedsec.com/blog/4-free-easy-wins-that-make-red-teams-harder/

TrustedSec 4 Free Easy Wins That Make Red Teams Harder This post assumes you have basic knowledge such as how to create a Group Policy Object(GPO). All you need to do is to create a GPO that disables macros by…

Post #1017 58 Dec 10, 2020, 19:02 UTC

PsExec Local Privilege Escalation

https://medium.com/tenable-techblog/psexec-local-privilege-escalation-2e8069adc9c8

Medium PsExec Local Privilege Escalation So…this one’s been here for a while: a local privilege escalation vulnerability in PsExec. This local privilege escalation allows a…

Post #1016 45 Dec 10, 2020, 11:00 UTC

holehe allows you to check if the mail is used on different sites like twitter, instagram and will retrieve information on sites with the forgotten password function.

https://github.com/megadose/holehe

GitHub GitHub - megadose/holehe: holehe allows you to check if the mail is used on different sites like twitter, instagram and will retrieve… holehe allows you to check if the mail is used on different sites like twitter, instagram and will retrieve information on sites with the forgotten password function. - megadose/holehe

Post #1015 47 Dec 8, 2020, 15:31 UTC

"Important, Spoofing" - zero-click, wormable, cross-platform remote code execution in Microsoft Teams

https://github.com/oskarsve/ms-teams-rce/blob/main/README.md

GitHub ms-teams-rce/README.md at main · oskarsve/ms-teams-rce Contribute to oskarsve/ms-teams-rce development by creating an account on GitHub.

Post #1014 60 Dec 5, 2020, 21:21 UTC

XS-Leaks wiki

http://xsleaks.dev

XS-Leaks Wiki Introduction XS-Leaks Wiki # Overview # Cross-site leaks (aka XS-Leaks, XSLeaks) are a class of vulnerabilities derived from side-channels 1 built into the web platform. They take advantage of the web’s core principle of composability, which allows websites to interact…

Post #1013 55 Dec 5, 2020, 18:45 UTC

Announcing the Atheris Python Fuzzer
https://opensource.googleblog.com/2020/12/announcing-atheris-python-fuzzer.html

Google Open Source Blog Announcing the Atheris Python Fuzzer Google has found thousands of security vulnerabilities and other bugs using Fuzzing. Now we are introducing the Atheris fuzzing engine.

Post #1012 52 Dec 4, 2020, 07:30 UTC

Forwarded from r0 Crew (Channel)

PTM - Page Table Manipulation From Usermode https://back.engineering/01/12/2020/ #exploitation #windows

Post #1011 47 Dec 3, 2020, 22:58 UTC

Forwarded from r0 Crew (Channel)

Big Match: matching open source code in binaries for fun and profit https://rev.ng/blog/big-match/post.html #reverse #dukeBarman

Post #1010 53 Nov 30, 2020, 19:39 UTC

How to run Windows 10 on ARM in Qemu with Hypervisor.framework patches on Apple Silicon Mac

https://gist.github.com/niw/e4313b9c14e968764a52375da41b4278#file-readme-md

Gist How to run Windows 10 on ARM or Ubuntu for ARM64 in QEMU on Apple Silicon Mac How to run Windows 10 on ARM or Ubuntu for ARM64 in QEMU on Apple Silicon Mac - README.en.md

Post #1009 59 Nov 29, 2020, 10:53 UTC

Lateral movement via MSSQL: a tale of CLR and socket reuse

https://www.blackarrow.net/mssqlproxy-pivoting-clr/

Tarlogic Security Lateral movement via MSSQL: a tale of CLR and socket reuse Technical details about how to pivot through a Microsoft SQL Server . Using mssql as a proxy for lateral movement

Post #1007 56 Nov 25, 2020, 09:34 UTC

Cross-site Scripting via WHOIS and DNS Records

https://medium.com/tenable-techblog/cross-site-scripting-via-whois-and-dns-records-a25c33667fff

Medium Cross-site Scripting via WHOIS and DNS Records On a whim, I tossed this into the address field of the registrant data of a domain so it’d appear in whois records…

Post #1006 54 Nov 24, 2020, 10:28 UTC

ImageMagick - Shell injection via PDF password

https://insert-script.blogspot.com/2020/11/imagemagick-shell-injection-via-pdf.html

Blogspot ImageMagick - Shell injection via PDF password "Use ImageMagick® to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) includ...

Post #1005 45 Nov 23, 2020, 19:37 UTC

Using Nim language for offensive operations

https://github.com/byt3bl33d3r/OffensiveNim

https://secbytes.net/Implant-Roulette-Part-1:-Nimplant

GitHub GitHub - byt3bl33d3r/OffensiveNim: My experiments in weaponizing Nim (https://nim-lang.org/) My experiments in weaponizing Nim (https://nim-lang.org/) - byt3bl33d3r/OffensiveNim

Post #1004 41 Nov 22, 2020, 15:53 UTC

HyperDbg debugger is an open-source, hypervisor-assisted user-mode, and kernel-mode Windows debugger with a focus on using modern hardware technologies. It is a debugger designed for analyzing, fuzzing and reversing.

https://github.com/HyperDbg/HyperDbg

GitHub GitHub - HyperDbg/HyperDbg: State-of-the-art native debugging tools State-of-the-art native debugging tools. Contribute to HyperDbg/HyperDbg development by creating an account on GitHub.

Post #1003 40 Nov 22, 2020, 15:39 UTC

A modular Jupyter notebook to automate / parse your recon to excel including:

- Subdomain Enumeration
- Cloud Enumeration
- GitHub Enumeration
- Shodan and Probing
- + more

https://github.com/obheda12/JupyterPen

GitHub GitHub - obheda12/JupyterPen: A Repository dedicated to creating modular and automated penetration testing frameworks utilizing… A Repository dedicated to creating modular and automated penetration testing frameworks utilizing Jupyter Notebooks - GitHub - obheda12/JupyterPen: A Repository dedicated to creating modular and au...

Post #1002 55 Nov 20, 2020, 18:49 UTC

BloodHound 4.0: Azure extension

https://www.youtube.com/watch?v=gAConW5P5uU

https://posts.specterops.io/introducing-bloodhound-4-0-the-azure-update-9b2b26c5e350

YouTube Six Degrees of Global Admin – Andy Robbins & Rohan Vazarkar (SO-CON 2020) In 2016 we released BloodHound, which helps attackers and defenders alike identify and execute or eliminate attack paths in Active Directory. Since then, BloodHound's collection and analysis capabilities have been limited to Active Directory and domain-joined…

Post #1001 43 Nov 19, 2020, 16:28 UTC

Duping AV with handles

https://skelsec.medium.com/duping-av-with-handles-537ef985eb03

Medium Duping AV with handles In this article I’m describing yet another way to bypass AV detection/blocking access to LSASS process for credential dumping.

Post #1000 49 Nov 16, 2020, 16:36 UTC

Hypervisor Vulnerability Research: State of the Art (with a deep focus on Hyper-V & ESXi)

https://alisa.sh/slides/HypervisorVulnerabilityResearch2020.pdf

Older posts →