Reigning Shells @ReigningShells

Red Team Operator / Penetration Tester blog.reigningshells.com Well Traveled Joined August 2015

Tweets

1K
Followers

222
Following

1K
Likes

1K

Dirk-jan @_dirkjan

2 weeks ago

I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: dirkjanm.io/obtaining-glob…

145 897 3K 436K 1K

Cybersecurity and Infrastructure Security Agency @CISAgov

7 months ago

Contrary to inaccurate reporting, CISA’s Red Teams are defending our critical infrastructure without interruption. Our Red Team is among the best in the world & remain laser focused helping identify & mitigate significant vulnerabilities & weaknesses. go.dhs.gov/wcB

28 89 405 42K 45

Dirk-jan @_dirkjan

a year ago

A few weeks ago I gave a talk at @a41con on how to phish for PRTs and phishing resistant authentication methods 👀. The slides, plus a demo video on how to do this with credential phishing are now on my blog: dirkjanm.io/talks

2 126 329 34K 140

James Forshaw @tiraniddo

a year ago

Just because you get access denied accessing a folder, it doesn't mean you can't get access. A quick look at bypassing the security on the WindowsApps folder. tiraniddo.dev/2024/06/workin…

6 180 515 64K 296

DebugPrivilege @DebugPrivilege

2 years ago

Quick preview of my ETW write-up that I did on the 'Microsoft-Windows-DotNETRuntime' Provider. Here I'm showing how certain EDR vendors are using this telemetry to build detections when .NET assemblies are reflective loaded from byte arrays.

6 39 170 21K 61

Download Image

5pider @C5pider

2 years ago

Modern implant design: position independent malware development. A small blog post on how to design "modern" malware with features like global variables, raw strings, and compile-time hashing. 5pider.net/blog/2024/01/2… Repo: github.com/Cracked5pider/…

25 308 983 137K 559

MrBeast @MrBeast

2 years ago

I’m gonna give 10 random people that repost this and follow me $25,000 for fun (the $250,000 my X video made) I’ll pick the winners in 72 hours

402K 2.7M 1.9M 275.2M 65K

hackerfantastic.x @hackerfantastic

2 years ago

CIA Vault7 describes Stinger as a "UAC bypass that obtains the token from an auto-elevated process, modifies it, and reuses it to execute as administrator". Here is my implementation that runs a command with SYSTEM privileges from a UAC restricted process github.com/hackerhouse-op…

5 169 524 66K 262

S3cur3Th1sSh1t @ShitSecure

2 years ago

My talk “Playing Chess as Red Teams” from @MCTTP_Con got published now: youtube.com/watch?v=XAvAVK… 🔥🙂

0 46 150 16K 58

Nasreddine Bencherchali @nas_bench

2 years ago

Did you know that when you disable "Real-time protection" on defender, its true that you won't receive events on the Defender Event log anymore (related to that feature). But if you actually subscribe to the AMSI ETW {2A576B87-09A7-520E-C21A-4942F0271D67} provider you'd still…

3 51 205 82K 96

Download Image

SpecterOps @SpecterOps

2 years ago

Have you ever wanted to write a better reflective loader? What about a perfect one? Learn how to do exactly that in our latest blog post from @mcbroom_evan: ghst.ly/3Q6HMgu

1 91 260 34K 103

Download Image

Maxime Meignan @th3m4ks

2 years ago

How to disable some parts of EDR’s telemetry on Windows 10? Just ask nicely! See riskinsight-wavestone.com/en/2023/10/a-u… for more info about an interesting logic bug we found on Win10 that affects all EDRs 😉

2 118 308 48K 131

n00py @n00py1

2 years ago

Another new twist on the .zip TLD. Fascinating.

pfiatde @pfiatde

2 years ago

Another new twist on the .zip TLD. Fascinating.

3 117 322 76K 95

Download Gif

1 20 67 11K 12

Kyle Avery @kyleavery_

2 years ago

Last week I ported TinyNuke HVNC to a Cobalt Strike BOF: github.com/WKL-Sec/Hidden…

11 156 432 49K 134

5pider @C5pider

2 years ago

An amazing talk was given by @rad9800 in his OnlyMalware (discord.gg/onlymalware) discord server. check it out. youtube.com/watch?v=L9SI-P…

0 56 193 34K 69

an0n @an0n_r0

3 years ago

detecting EDR services remotely without admin privs. indicators: - installed services: [MS-LSAT] LsarLookupNames() - running processes: named pipes (there are some characteristic to EDRs) needs some more testing and cleanup before release, but looks like promising.

21 226 809 191K 227

Download Image

Mike Felch (Stay Ready) @ustayready

3 years ago

Found this pretty useful cheatsheet/deep-dive that explains firewalls by referencing the ufw wrapper for iptables. Figured I'd share since it brought me some value. blog.kanbach.org/post/firewalls…

1 19 81 0 28

Mike Felch (Stay Ready) @ustayready

3 years ago

On an AWS pentest, I found cleartext passwords in CloudFormation Stack Outputs. Here's an easy way to check: for region in {"us-east-1","us-east-2"}; do aws --region $region cloudformation describe-stacks --query 'Stacks[*].[StackName, Description, Parameters, Outputs]'; done

3 43 190 0 64

Adam Chester 🏴‍☠️ @_xpn_

3 years ago

For those hyped at some of the AI chat stuff and want to pull this into tooling, might be worth looking again at Github Copilot.. it already offers some neat stuff and AFAIK is built on OpenAI tech. Below is a simple C shellcode stub translated into C# and explained pretty well.

4 16 96 0 28

Download Image

Mike Felch (Stay Ready) @ustayready

3 years ago

Want to create great phishing links using an open-redirect on google.com? While they don't last forever, they are a great way to trick unsuspecting victims into clicking a legit looking URL before expiring! gist.github.com/ustayready/3ba… Follow the 🧵for how it works..