Offensive Xwitter

😈 [ codewhisperer84 @codewhisperer84 ]

Check out Titanis, my new C#-based protocol library! It features implementations of SMB and various Windows RPC protocols along with Kerberos and NTLM.

🔗 https://github.com/trustedsec/Titanis/

🐥 [ tweet ]

😈 [ Aurélien Chalot @Defte_ ]

Dumping LSASS is old school. If an admin is connected on a server you are local admin on, just create a scheduled task asking for a certificate on his behalf, get the cert, get its privs. All automatized in the schtask_as module for NetExec 🥳🥳🥳

🐥 [ tweet ]

Успей заявить о себе на Standoff Talks 16 октября 🔥

Call for papers все еще открыт. Если у тебя есть крутые кейсы по OSINT, багбаунти, пентесту, редтиму или на темы TI, threat hunting, работе SOC, то это твой шанс поделиться опытом с элитой практической безопасности. Выбирай удобный формат — 40 или 10 минут — и присылай заявку!

⁉️ Важно! Мы ждем твоих докладов до 26 сентября. То есть, у тебя осталась неделя, чтобы подать заявку и стать спикером ивента.

И напоминаем, что на митап нужно не забыть зарегистрироваться. Тем, кто уже зарегистрировался мы начнем рассылать подтверждения со следующей недели!

Не упусти шанс поучаствовать в таком крутом ивенте!

😈 [ dis0rder @dis0rder_0x00 ]

New tool drop! Let me show you Obex:

🔗 https://github.com/dis0rder0x00/obex

Spawn a process and block unwanted DLLs from loading (in user mode).

Example: spawn powershell without "amsi.dll" for an easy amsi-less experience :)

🐥 [ tweet ]

😈 [ Dirk-jan @_dirkjan ]

I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog:

🔗 https://dirkjanm.io/obtaining-global-admin-in-every-entra-id-tenant-with-actor-tokens/

🐥 [ tweet ]

😈 [ kr0tt @_kr0tt ]

Wrote a blog about creating an early exception handler for hooking and threadless process injection without relying on VEH or SEH.

You can definitely use it for more than what is described in the post, enjoy :)

🔗 https://kr0tt.github.io/posts/early-exception-handling/

🐥 [ tweet ]

😈 [ @zephrfish.yxz.red @ZephrFish ]

Made a thing, mucking about with python and a LDAP browser concept to ingest straight into BloodHound, simple LDAP browser using PyQt as a GUI and neo4j-driver to ingest into BH.

🔗 https://github.com/ZephrFish/pyLDAPGui

🐥 [ tweet ]

😈 [ Unit 42 @Unit42_Intel ]

We discuss an uptick in use of the relatively unknown AdaptixC2, an open-source C2 framework, by attackers. Our research details its functionality, configuration as well as observed deployment techniques, including novel AI-assisted methods.

🔗 https://unit42.paloaltonetworks.com/adaptixc2-post-exploitation-framework/

🐥 [ tweet ]

😈 [ Kurosh Dabbagh @_Kudaes_ ]

I just released MFTool, an NTFS parser that builds an in-memory map of a volume, allowing you to:
- Read any file without opening a handle
- Get the contents of locked/deleted files (registry hives, pagefile.sys, etc)
- Perform fast, in-memory searches across the entire disk

Although direct access to disk is not new at all, especially when it comes to forensics, I think this approach could be useful in a number of contexts during a RT engagement.

🔗 https://github.com/Kudaes/MFTool

🐥 [ tweet ]

😈 [ Tijme Gommers @tijme ]

Exciting times. I'm publishing Dittobytes today after presenting it at @OrangeCon_nl !

Dittobytes is a true metamorphic cross-compiler aimed at evasion. Use Dittobytes to compile your malware. Each compilation produces unique, functional shellcode.

🔗 https://github.com/tijme/dittobytes

🐥 [ tweet ]

😈 [ Yuval Gordon @YuG0rd ]

BadSuccessor is dead… or is it?

The patch for CVE-2025-53779 fixed the priv-esc. While no longer a vulnerability, the tactic still applies in certain scenarios.
Defenders should be aware of it.

Details:

🔗 https://www.akamai.com/blog/security-research/badsuccessor-is-dead-analyzing-badsuccessor-patch

🐥 [ tweet ]

😈 [ SpecterOps @SpecterOps ]

Cookie theft has evolved 🍪

Over the last year, stealing cookies on Windows devices has changed significantly for Chromium browsers like Chrome and Edge. Andrew Gomez dives into these changes, how threat actors adapt, & new detection opportunities.

🔗 https://specterops.io/blog/2025/08/27/dough-no-revisiting-cookie-theft/

🐥 [ tweet ]

😈 [ spencer @techspence ]

A quick and easy way to find services with unquoted service paths is to open up PowerShell and run the following:

Get-WmiObject win32_service | select Name,PathName,StartMode,StartName | where {$_.StartMode -ne "Disabled" -and $_.StartName -eq "LocalSystem" -and $_.PathName

🐥 [ tweet ]

😈 [ Two Seven One Three @TwoSevenOneT ]

"clipup.exe" in System32 is very powerful. It can destroy the executable file of the EDR service 😉 Experimenting with overwriting the MsMpEng.exe file.

Proactively creating processes with Protected Process Light (PPL) protection will give you more opportunities to abuse these processes. Detailed article:

🔗 https://www.zerosalarium.com/2025/08/countering-edrs-with-backing-of-ppl-protection.html

🐥 [ tweet ]

😈 [ Daniel @0x64616e ]

I stumbled upon this tweet and dug a bit deeper into the internals of ksetup.exe:

🔗 https://pentest.party/posts/2025/ksetup-machine-password/

When you are local admin and need machine account credentials this could be a viable alternative to the good old LSA dump.

🐥 [ tweet ][ quote ]

😈 [ Steven @0xthirteen ]

I wanted to find out if you could start the WebClient service remotely, so I ended up digging into it:

🔗 https://specterops.io/blog/2025/08/19/will-webclient-start/

🐥 [ tweet ]