dru1d @_dru1d

Husband. Hacker. Adversary Simulation. blog.dru1d.ninja Appalachia Joined September 2009

Tweets

2K
Followers

941
Following

2K
Likes

15K

pfiatde @pfiatde

2 days ago

Just had .Net Exploitation Training from @SinSinology and it was great. A lot of real world targets covered and definitely makes appetite for more.

0 3 25 7K 8

Download Image

After a break, I’ll be back to Black Hat EU 2025 to share new developments in call stack spoofing techniques and tradecraft. Likely my final public contribution to technique. Hope it'll inspire brilliant minds to build something great! See you there! #BHEU #offsec #SpecterOps

9 21 117 17K 25

Download Image

chompie @chompie1337

a week ago

kernel hackers go serverless ring0 → cloud 9 ☁️ ?? brb pwning yr gpu nodes ✨

21 100 543 44K 200

Download Video

Dirk-jan @_dirkjan

2 weeks ago

I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: dirkjanm.io/obtaining-glob…

145 894 3K 434K 1K

Kyle Avery @kyleavery_

2 weeks ago

if you use claude code for maldev, consider removing/changing this part of the prompt in cli.js: IMPORTANT: Assist with defensive security tasks only. Refuse to create, modify, or improve code that may be used maliciously. Do not assist with credential discovery or harvesting,…

6 9 152 19K 134

Kurosh Dabbagh @_Kudaes_

3 weeks ago

Although direct access to disk is not new at all, especially when it comes to forensics, I think this approach could be useful in a number of contexts during a RT engagement. github.com/Kudaes/MFTool

2 8 42 2K 25

Connor McGarr @33y0re

3 weeks ago

Today I am releasing a new blog post on VSM "secure calls" + the SkBridge project to manually issue them!! This blog talks about how VTL 0 requests the services of VTL 1 and outlines common secure call patterns!!! Blog: connormcgarr.github.io/secure-calls-a… SkBridge: github.com/connormcgarr/S…

3 92 238 23K 113

Download Image

Garrett @unsigned_sh0rt

3 weeks ago

frankensteined some code together to make a couple BOFs that set shadowcreds/rbcd for when proxying was acting up...maybe they're useful to you they dont clean up at the moment so that'll have to get added at some point...ops not done yet lol github.com/garrettfoster1…

4 36 134 6K 62

dru1d @_dru1d

3 weeks ago

David Scott Patterson @davidpattersonx

3 weeks ago

https://t.co/MbTiPVpmzb

60 18 246 27K 48

0 0 1 150 0

Download Gif

Trail of Bits @trailofbits

3 weeks ago

@signalapp @1Password @SlackHQ @googlechrome The attack: override JavaScript builtins in v8_context_snapshot.bin. When apps use these builtins during normal operation, malicious code executes. Code integrity checks miss this, since snapshots are not considered executable. blog.trailofbits.com/2025/09/03/sub…

1 16 153 14K 22

S3cur3Th1sSh1t @ShitSecure

4 weeks ago

Best Citrix Breakout ever. You can only download .ica files that provide access to certain local applications but breakout out of these applications is not possible? Just modify the .ica file before starting it and remove The InitialProgram= value -> Full Citrix Session! 🤓

10 86 386 33K 221

Download Image

Andrew Oliveau @AndrewOliveau

a month ago

Excited to be presenting "Keep COM and Hijack On: Redefining Windows Session Hijacking" at Black Hat Arsenal Europe this December. Looking forward to connecting with many of you there! 🤟 blackhat.com/eu-25/arsenal/…

1 14 57 6K 13

Download Gif

Octoberfest7 @Octoberfest73

a month ago

Fixed the issue in Koppeling, was missing a single line of code to fix up the RVA of the Name field within the IMAGE_EXPORT_DIRECTORY struct github.com/monoxgas/Koppe…

Octoberfest7 @Octoberfest73

a month ago

Fixed the issue in Koppeling, was missing a single line of code to fix up the RVA of the Name field within the IMAGE_EXPORT_DIRECTORY struct github.com/monoxgas/Koppe…

0 1 12 6K 1

1 4 33 4K 12

Vector 35 @vector35

a month ago

WARP speed ahead! Want to learn more about the future of function matching in Binary Ninja (and hopefully your other favorite tools too!)? Mason talks about that and more in our latest blog post: binary.ninja/2025/08/22/war…

1 5 29 3K 9

Dirk-jan @_dirkjan

a month ago

@NathanMcNulty Intune be like

2 7 37 4K 2

Download Image

Logan Goins @_logangoins

a month ago

I Just documented a cool way to authenticate proxied tooling to LDAP in an AD environment using C2 payload auth context, without stealing any tickets or hashes! Keep tooling execution off-host and away from EDR on your Red Team assessments! specterops.io/blog/2025/08/2…

5 118 403 31K 221

Garrett @unsigned_sh0rt

a month ago

I automated the POC for stealing policies from MP relays from this blog into a modified version of mssqlclient specterops.io/blog/2025/07/1… would work too with any other piv account to the DB github.com/garrettfoster1… (no PR because impacket doesnt merge, sorry)

4 44 118 8K 45

Kyle Avery @kyleavery_

a month ago

if you want to train a model yourself with GRPO: 1. find a verifiable task: jasonwei.net/blog/asymmetry… 2. add a new reward function to open-r1: github.com/huggingface/op…

Kyle Avery @kyleavery_

a month ago

if you want to train a model yourself with GRPO: 1. find a verifiable task: jasonwei.net/blog/asymmetry… 2. add a new reward function to open-r1: github.com/huggingface/op…