road to OSCP

#network #nmap #nse

[ Nmap Scripting Engine (NSE) - useful scripts collection ]

The Nmap Scripting Engine (NSE) is one of Nmap's most powerful and flexible features. It allows users to write (and share) simple scripts (using the Lua programming language ) to automate a wide variety of networking tasks.

We collected some of useful (and mostly unknown or not popular) scripts in one post (that will be regularly updated).

- nfs-ls -> get useful information about files from NFS exports
- ipidseq -> finding zombie hosts that can later be passed in to -sI
- broadcast-listener -> sniffs the network for incoming broadcast communication and attempts to decode the received packets
- grab_beacon_config -> simple PoC script to scan and acquire CobaltStrike Beacon configurations
- http-security-headers -> checks for the HTTP response headers related to security given in OWASP Secure Headers Project
- http-ntlm-info -> enumerates information from remote HTTP services with NTLM authentication enabled
- winrm -> WinRM service detection
- http-enum -> enumerates directories used by popular web applications and servers

Subscribe to see more: t.me/gravity_rainbow

#mobile #frida

[ Advanced Frida Series ]

📱 Ready to level up your Mobile Reversing & Dynamic Instrumentation game? Most Frida tutorials cover the basics. 8ksec.io built this Frida series for advanced instrumentation against complex iOS and Android targets.

🔎 Topics include:
🔹 Hooking Objective-C and Swift methods
🔹 Extracting secrets from encrypted iOS databases
🔹 Tracing Signal and Telegram message handling
🔹 Analyzing Android root checks across Java, native, and syscalls
🔹 Patching ARM64 instructions at runtime
🔹 Instruction-level tracing with Frida Stalker

🔗 Start the Advanced Series here: https://8ksec.io/advanced-frida-mobile

#responder #internal

[ Responder 3.2.0.0 ]

Responder 3.2.0.0 is out!
All new year updates +
- IMAP and SMTP StartTLS
- IMAPS TLS server on port 993
- DHCPv6 poisoning (pure python) using _dirkjan
mitm6 attacks
- Kerberos, DNS server updates
- Etc.

https://github.com/lgandx/Responder

[ Conditional Access bypasses ]

All Conditional Access bypasses in a single blog post. It contains not only the documented bypasses, but also the results of new research.

https://cloudbrothers.info/en/conditional-access-bypasses

#proxmox

[ Living off the Hypervisor - LOLPROX ]

Curated catalog of native Proxmox VE binaries and techniques that adversaries can abuse for post-exploitation operations.

Proxmox is at its core just a Debian image with some hypervisor tooling but the hyper visor tooling is what makes it unique from an attacker perspective.

https://lolprox.yxz.red

Blogpost: https://blog.zsec.uk/lolprox

LOLPROX - Through a Defender's Eyes

https://blog.zsec.uk/lolprox-defend

I M P O R T A N T
https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

[ DevOps Attack Surface ]

A Pentester's Cheatsheet for Modern Infrastructure hacking.

Blog: https://executiveoffense.beehiiv.com/p/devops-attack-surface

Checklist: https://arcanum-sec.github.io/devops-attack-surface

[ Living Off the Land: Windows Post-Exploitation Without Tools ]

Blog about post-exploitation using only built-in, signed Microsoft tools (PowerShell, WMI, certutil, bitsadmin, and more), without uploading any custom binaries or dropping suspicious artifacts.

https://xbz0n.sh/blog/living-off-the-land-windows

(note from admin: don't forget that PS/WMIC and other things that are described in this article will also be detected)

[ Cobalt Strike 4.12: Fix Up, Look Sharp! ]

Cobalt Strike 4.12 is LIVE, complete with a new look for the GUI! Additionally:
- A REST API
- User Defined Command and Control (UDC2)
- New process injection options
- New UAC bypasses
- and more!
Check out the release blog for details.

https://www.cobaltstrike.com/blog/cobalt-strike-412-fix-up-look-sharp

[ InfoSec Black Friday & Cyber Monday Deals — 2025 Edition ]

As always (repo is already updated):

https://github.com/0x90n/InfoSec-Black-Friday

#ssh #windows

[ Windows' Built-in OpenSSH for Offensive Security ]

Windows includes OpenSSH by default - ssh.exe. This means all those wonderful tricks we used as washed-up *nix sysadmins, we can now revisit as Offensive Security Consultants! This article shows how Windows’ OpenSSH can be used as a network proxy implant, deployed as a “remote-access trojan” for lower privileged users, and as a data exfiltration tool.

https://pulsesecurity.co.nz/articles/windows-ssh-is-awesome

#exec #lateral

[ GoExec - Remote Execution Multitool ]

GoExec is a new take on some of the methods used to gain remote execution on Windows devices. GoExec implements a number of largely unrealized execution methods and provides significant OPSEC improvements overall.

https://github.com/FalconOpsLLC/goexec

P.S. From here on, this channel is now live again. Expect more posts soon.

GODAP

A complete TUI for LDAP

Features:

• Supports authentication with password, NTLM hash, Kerberos ticket or PEM/PKCS#12 certificate
• Formats date/time, boolean and other categorical attributes into readable text
• Pretty colors & cool emojis
• LDAPS & StartTLS support
• Fast explorer that loads objects on demand
• Recursive object search bundled with useful saved searches
• Flexible group members & user groups lookups
• Supports creation, editing and removal of objects and attributes
• Supports moving and renaming objects
• Supports searching deleted & recycled objects
• Supports exporting specific subtrees of the directory into JSON files
• Interactive userAccountControl editor
• Interactive DACL viewer + editor
• Interactive ADIDNS viewer + editor (basic)
• GPO Viewer
• SOCKS support

https://github.com/Macmod/godap

Thanks to: @hybgl

A script that exploits the SeTcbPrivilege to achieve local privilege escalation on Windows.

Note: The privilege must be enabled before running the script.

https://gist.github.com/antonioCoco/19563adef860614b56d010d92e67d178

LLC (Linux Log Cleaner)

A convenient tool for modifying or deleting information in Linux log files, includes:
- /var/log/lastlog: Contains the last login of each user. Command to view: lastlog
- /var/run/utmp: Contains information about currently active login sessions. Command to view: who, w
- /var/log/wtmp: Stores the history of logins and logouts. Command to view: last
- /var/log/btmp: Records failed login attempts. Command to view: lastb


https://github.com/Macr0phag3/LLC

Tool to extract Kerberos tickets from Linux kernel keys.

https://github.com/TarlogicSecurity/tickey

A platform that provides intentionally vulnerable applications for learning source code review. Currently, 25 challenges are available.

It looks very interesting and promising

https://vulnerable.codes/

Thanks to: "Руслан 😎😎😎😎😎"

ScriptSentry is a powerful tool for automating the detection of unsafe configurations in logon scripts. It can identify issues such as:

- Unsafe UNC Folder Permissions
- Unsafe UNC File Permissions
- Unsafe Logon Script Permissions
- Unsafe GPO Logon Script Permissions
- Unsafe NETLOGON/SYSVOL Permissions
- Plaintext Credentials


This tool is described in detail in the blog post Hidde Menace: How to Identify Misconfigured and Dangerous Logon Scriptsn

https://github.com/techspence/ScriptSentry

З новим роком, далі - більше!

Happy New Year! The best is yet to come!

https://x.com/anyrun_app/status/1861024182210900357

Креативно!