2bitTech @2bitTech

Father. Dreamer. Compulsive Reader. Part time Geek. Mostly retweets, Opinions are my own and not the views of my employer. @[email protected] 2bittech.com Joined September 2010

Tweets

2K
Followers

48
Following

904
Likes

16

Craig Rowland - Agentless Linux Security @CraigHRowland

3 years ago

Did you know the file /etc/sudoers.d/README is not just documentation, but a handy place to hide valid sudo user entries?

16 172 699 0 158

Download Image

David. 🏴󠁧󠁢󠁳󠁣󠁴󠁿 @fuzz_sh

3 years ago

TIL that there is a terrifying amount of filetypes that send your NTLMv2 hash when you just open a directory with the file in 🫢 github.com/Greenwolf/ntlm… Very cool! any other suggestions for cool file related tricks I should look into today? what is your favourite techniques?

4 126 340 0 117

Germán Fernández @1ZRR4H

3 years ago

I wrote a quick Nmap script to scan for servers potentially vulnerable to #ProxyNotShell (based on Microsoft's recommended URL blocking rule) I hope it can be useful for someone :) [+] github.com/CronUp/Vulnera… #0day CVE-2022-40140 CVE-2022-41082

23 550 2K 0 451

Download Image

Sean Metcalf @PyroTek3

3 years ago

Due to breaches involving MFA bombing (attacker keeps sending MFA requests until accepted) now is the time for organizations with Office 365 to enable MFA number matching in Microsoft Authenticator. You can deploy to a group before configuring for all. docs.microsoft.com/en-us/azure/ac… 1/3

17 283 961 0 272

Download Image

Andy Robbins @_wald0

3 years ago

How to prevent Kerberoasting: Kerberoasting is an incredibly powerful and reliable attack against Active Directory. In some situations it can result in an attacker becoming Domain Admin nearly instantaneously. Here's how to prevent this attack: 🧵

43 575 2K 0 839

Download Image

Kyle Cucci @d4rksystem

3 years ago

#Malware Analysis Tip: Windows registry contains an interesting key (HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\UAC\COMAutoApprovalList) that shows all COM objects that auto-elevate, bypassing UAC. Malware may be able to modify or hijack some these to elevate privileges.

11 283 958 0 290

Download Image

Maddie Stone @maddiestone

3 years ago

3 in-the-wild 0-days patched in the last two days: * CVE-2022-2856 in Chrome discovered by @ashl3y_shen & @0xbadcafe1 of Google TAG * CVE-2022-32893 in Safari * CVE-2022-32894 in iOS/macOS kernel docs.google.com/spreadsheets/d… #itw0days

0 49 153 0 16

sn🥶vvcr💥sh @snovvcrash

3 years ago

[#HackTip ⚒] A cool technique for initial AD access during a pentest. Got a Cisco IP Phone nearby? Congrats, you’re (almost) an domain user! #pentest #ad #cisco

7 286 957 0 291

Download Image

2bitTech @2bitTech

3 years ago

Symlinks as mount portals: Abusing container mount points nns.ee/blog/2022/08/0…

0 0 0 0 0

GitHub Security Lab @GHSecurityLab

3 years ago

In this post "Corrupting memory without memory corruption" @mmolgtm is showing how a powerful kernel bug, CVE-2022-20186, can be used to root a Pixel 6 from a malicious app github.blog/2022-07-27-cor…

19 43 113 0 21

Amazon Science @AmazonScience

3 years ago

SPHINCS+, to which Amazon contributed, is among the finalists for digital-signature algorithms in @NIST’s recent standardization process. Learn how Amazon is preparing for a post-quantum cryptographic future and deploying promising technologies for customers. #PostQuantum #AWS

0 8 11 0 0

☣ KitPloit - Hacker Tools @KitPloit

3 years ago

Zenbuster - Multi-threaded URL Enumeration/Brute-Forcing Tool ift.tt/WBk7KI5

1 61 270 0 41

Download Image

HyperDbg @HyperDbg

3 years ago

If you're looking for how to begin with #HyperDbg, we made a list of examples that will give you an idea of how to start working with, HyperDbg. A thread (23 tweets) 🧵:

6 38 105 0 37

Stephan Berger @malmoeb

3 years ago

1/ IR tip: During the first conversation with the affected customer, ask for their public IP range(s). Next, check this IP range on @shodanhq (filter: "net:<ip>/<subnet>"). This has two advantages: 🧵 #CyberSecurity

11 168 689 0 281

Grzegorz Tworek @0gtweet

3 years ago

Didn't described it precisely so far: If you put 'mpnotify' value into the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, your exe will be launched by winlogon.exe when user logs on. After 30s the process will be terminated. persistence-info.github.io/Data/mpnotify.…

16 313 1K 0 297

Download Image

Shodan @shodanhq

3 years ago

The Shodan Membership is on sale now for $5 until the end of Sunday, July 17th (GMT): account.shodan.io/billing/member

208 1K 2K 0 189

Anaïs Urlichs @urlichsanais

3 years ago

I tried to map open source, cloud native security scanners. Which ones did I miss? 👀 Note that I will not include tools that are dependent on other scanners under the hood or do not fit our definition of open source e.g. restrict # of scans that can be performed.

46 90 473 0 191

Download Image

Virus Bulletin @virusbtn

3 years ago

JPCERT/CC's @shu_tom writes about the Lazarus VSingle malware that has recently been updated to retrieve C2 server information from GitHub. blogs.jpcert.or.jp/en/2022/07/vsi…

0 20 44 0 10

Download Image

David das Neves @david_das_neves

3 years ago

Good basics. [Article] Monitoring Service Comparison – AWS vs Azure vs GCP (Part 1) buff.ly/39CN80J [Article] Monitoring Service Comparison — AWS vs Azure vs GCP (Part 2) buff.ly/3y3vDA4 #Monitoring #PublicCloud #CloudComputing