_Imm0 @_Imm0

Joined June 2016

Tweets

463
Followers

59
Following

310
Likes

8K

Adam Chester 🏴‍☠️ @_xpn_

2 years ago

New blog post is up... Identity Providers for RedTeamers. This follows my #SOCON2024 talk, and provides the technicals behind the presentation, looking at other IdP's and what techniques are effective beyond Okta. blog.xpnsec.com/identity-provi…

13 150 372 63K 148

Jean-Michel Besnard @jmbesnard_maz

2 years ago

New release of AD Miner (github.com/Mazars-Tech/AD…) introducing better path calculation with #Bloodhound (Smartest vs. Shortest Paths). Also published an article to explain this feature : linkedin.com/pulse/graph-th…

2 50 145 27K 82

Ptrace Security GmbH @ptracesecurity

2 years ago

Active Directory reconnaissance and exploitation for Red Teams via the Active Directory Web Services (ADWS). github.com/wh0amitz/Sharp… #Pentesting #ActiveDirectory #Exploit #WebSecurity #Infosec

0 18 41 5K 32

Download Image

Soufiane @S0ufi4n3

2 years ago

New technique to bypassing EDRs with EDR-Preloading. Tldr: blocking EDR from loading it's DLL into a process preventing the deployment of user land hooks. malwaretech.com/2024/02/bypass…

5 152 420 31K 222

Tony Gore @nullg0re

2 years ago

Entra ID Connect Arbitrary Password Overwrite nullg0re.com/2024/01/entra-…

0 10 18 3K 7

_Imm0 @_Imm0

3 years ago

I really like github.com/zyn3rgy/LdapRe… . But I always missed that it can't scan for EPA on HTTPS. So I wrote a script based on it to do just that: github.com/Immortalem/Htt…

0 0 1 155 0

James Forshaw @tiraniddo

3 years ago

Finally got around to writing a blog about the Kerberos RC4-MD4 downgrade attack, how it works, and how you can exploit it. googleprojectzero.blogspot.com/2022/10/rc4-is…

8 202 456 0 91

b33f | 🇺🇦✊ @FuzzySec

3 years ago

Here is an RCE demo for Cobalt Strike CVE-2022-39197. Like @0x09AL said the patch is not a complete fix, be careful. Also I don't want to see any more java code for a while, holy f. Maybe at some point I will post some patch analysis 🥃 youtube.com/watch?v=cjg9FJ…

3 89 186 0 28

n00py @n00py1

3 years ago

It’s back! crack.sh/get-cracking/

5 21 108 0 20

Geiseric @Geiseric4

3 years ago

Is KrbRelay dead on fully updated systems? Inspected a bit and seems that auth breaks hence it's not possible to perform modifications (nor searches. Here I just hardcoded the target) @tiraniddo @cube0x0 Do you guys know/imagine what could be happening or if MS ninja patched?

4 11 70 0 11

Download Image

Charlie Bromberg « Shutdown » @_nwodtuhs

3 years ago

Releasing a few things based on S4U2self+u2u, enjoy - SPN-less RBCD (based on @tiraniddo research 🔥) - Sapphire tickets (based on the 💎Diamond ticket approach by @SemperisTech and research by @gentilkiwi). Credits also to @agsolino @MartinGalloAr @TalBeerySec @chernymi

8 99 263 0 61

Tal Be'ery @TalBeerySec

3 years ago

NTLM relay is dead and living in AAD. An interesting @BlackHatEvents talk by @rubin_mor i.blackhat.com/USA-22/Wednesd… CC: @SteveSyfuhs @gentilkiwi #BHUSA2022

4 115 303 0 87

Download Image

Sean Metcalf @PyroTek3

3 years ago

In the past I have heard/read/thought/etc these are important when working: Good compensation including benefits Work-Life balance Have a say - what you say matters Can make a difference - able to change things for the better (internal/external) Can grow & shape your career

Lesley Carhart @hacks4pancakes

3 years ago

5 17 311 0 3

1 5 19 0 1

Crusaders of Rust @cor_ctf

3 years ago

Check out corCTF kernel writeups! FizzBuzz101's challenge shows a novel leakless + data-only technique to pwn Linux with a 6 byte overflow: willsroot.io/2022/08/revivi… D3v17's CoRJail shows a novel technique used on kctf to achieve arb free with poll_list : syst3mfailure.io/corjail

0 73 214 0 47

Nikhil Mittal @nikhil_mitt

3 years ago

ICYMI, our free course and hands-on lab 'Introduction to Azure Penetration Testing' is available at azure.enterprisesecurity.io We already have more than 5500 (you read that right) students who took the course and attempted the labs! #Azure #Pentesting #RedTeam

2 76 214 0 83

LuemmelSec @theluemmel

3 years ago

Just in case you need it automagically wrapped into PowerShell: Grab @ShitSecure and my converter: raw.githubusercontent.com/LuemmelSec/Pen… . .\convert_c#_to_ps1.ps1 invoke-convert -infile .\seatbelt.exe . .\invoke-seatbelt Invoke-Seatbelt -Command "-group=all" Thx @harmj0y #happypentesting

Will Schroeder @harmj0y

3 years ago

2 84 202 0 24

0 47 124 0 22

Download Image

PentesterLab @PentesterLab

3 years ago

🍾🪩🪅🎉🥳Giveaway time! 🥳🎉🪅🪩🍾 We are going to send a t-shirt and few goodies to one person who follows @PentesterLab and likes this tweet !! And we are going to give a 1-year voucher to someone who RT this tweet!

113 837 2K 0 3

Jonas Bülow Knudsen @Jonas_B_K

4 years ago

We found an attack vector from TRUSTING to TRUSTED domain across domain/forest trust (opposite direction of common trust attacks). Only Domain User access but might be all you need to escalate further. #activedirectory #trust #attackpath improsec.com/tech-blog/sid-…

1 66 140 0 40

PentesterLab @PentesterLab

4 years ago

Giveaway time! We are going to send a t-shirt and few goodies to one person who follows @PentesterLab and likes this tweet !! And we are going to give a 1-year voucher to someone who RT this tweet!