Sean Hopkins @_seahop

Red teamer, terrible coder. Black Badge Defcon30. Joined August 2021

Tweets

634
Followers

189
Following

221
Likes

1K

SpecterOps @SpecterOps

2 months ago

Why should Microsoft's Nested App Authentication (NAA) should be on your security team's radar? @Icemoonhsv breaks down NAA and shows how attackers can pivot between Azure resources using brokered authentication. ghst.ly/45h2Zw3

0 21 63 16K 36

Rad @rad9800

2 months ago

EDR vendors secure their sales pipelines but neglect monitoring GitHub for exposed installer tokens -leaving customers vulnerable to abuse and over-licensing. Adversaries likely exploit these tokens to build sandboxes for payload testing. Here are search patterns to help…

6 52 314 29K 260

Download Image

Panos Gkatziroulis 🦄 @netbiosX

2 months ago

Beyond Beacon: Writing BOF and a Native Rust COFF Loader malware-decoded.com/rust-bof-coff-… #redteam

0 6 19 2K 10

_leon_jacobs(💥) @leonjza

6 years ago

I was today years old when I learnt that you can run ELF using ld-linux. Useful when the executable bit is not set (and you can't change it).

11 250 715 0 96

Download Image

Print3M @Print3M_

2 months ago

Solid overview of OPSEC considerations when operating with Sliver C2 by @zimnyaatishina 💪 #redteam #c2 #malware #opsec tishina.in/opsec/sliver-o…

2 32 141 7K 129

SpecterOps @SpecterOps

2 months ago

Lance Cain & Daniel Mayer shared examples of Jamf exploitation techniques available to threat actors in their #BHUSA briefing today, which included the introduction of two new tools: JamfHound & Eve.

2 12 41 4K 10

Download Image

Clandestine @akaclandestine

2 months ago

GitHub - 0pepsi/Linux-persistence: A no-reboot, in-memory Linux persistence PoC leveraging namespace joining, user-namespace elevation, and self‑deletion. github.com/0pepsi/Linux-p…

0 76 360 24K 285

Stefan Esser @i0n1c

2 months ago

There is a party at #GLx and you have been invited. Brand new training course giving you a deep dive into #SPTM, #TXM, #SK and #Exclaves antid0te.sg/blog/25-12-15-…

0 8 31 10K 19

hashcat @hashcat

2 months ago

hashcat v7.0.0 released! After nearly 3 years of development and over 900,000 lines of code changed, this is easily the largest release we have ever had. Detailed writeup is available here: hashcat.net/forum/thread-1…

22 381 1K 76K 271

Download Image

Panos Gkatziroulis 🦄 @netbiosX

2 months ago

The RPC-function RAiForceElevationPromptForCOM from the appinfo.dll library allows SYSTEM coercion. This only works on domain joined systems. This function can be called from any low privileged user to trigger SYSTEM authentication to an arbitrary location github.com/rtecCyberSec/R…

0 27 103 5K 70

S3cur3Th1sSh1t @ShitSecure

3 months ago

This is so much! 🔥🔥😎 Found two new Potato triggers just today. Not only Potato but can also be used for LPE as remote auth is done which could be relayed to LDAP without Signing enabled. Or relayed to ADCS for a certificate. github.com/warpnet/MS-RPC…

5 182 582 25K 303

James 🏴󠁧󠁢󠁷󠁬󠁳󠁿 @two06

3 months ago

Tool release form my @Steel_Con talk. Nothing ground breaking but free tools are free tools github.com/two06/LinkedIn…

5 43 222 15K 173

vx-underground @vxunderground

3 months ago

Dear Red Team nerds, If you're curious what a successful and serious malware campaign looks like (if you want to make a more serious Red Team engagement) I HIGHLY suggest reading the write up on the new malware campaign called TransferLoader zscaler.com/blogs/security…

16 287 1K 74K 1K

Panos Gkatziroulis 🦄 @netbiosX

3 months ago

DreamWalkers: Reflective shellcode loader with advanced call stack spoofing and .NET support github.com/maxDcb/DreamWa…

1 32 107 6K 66

0xor0ne @0xor0ne

3 months ago

Leveraging program entry points for process injection in Windows bohops.com/2023/06/09/no-… Credits @bohops #infosec #Windows

2 38 239 14K 110

Download Image

0xor0ne @0xor0ne

3 months ago

Windows kernel exploitation for beginners Part 1: mdanilor.github.io/posts/hevd-0/ Part 2: mdanilor.github.io/posts/hevd-1/ Part 3: mdanilor.github.io/posts/hevd-2/ Part 4: mdanilor.github.io/posts/hevd-3/ Part 5: mdanilor.github.io/posts/hevd-4/ #windows #infosec

2 229 1K 42K 1K

Download Image

TKYN @TKYNSEC

4 months ago

Windows 11 24H2 broke a popular malware evasion technique! The Lloyd Labs self-deletion method now fails because of NTFS changes, so I spent time with kernel debugging to figure out why and how to fix it. Full technical breakdown: tkyn.dev/2025-6-8-The-N…

7 106 334 36K 217

Roy Carrilho @RuiCarrilho5

4 months ago

Here's Building a Virtual Machine in C! Cobb Coding is an amazing channel, and this is a great playlist. You can learn a lot on how a computer works by building a VM, and Cobb explains it just fine! Enjoy!

7 102 953 33K 839

Download Image

Roy Carrilho @RuiCarrilho5

5 months ago

Found an amazing guide that shows you how to code a TCP/IP stack from scratch! This is written in C, and goes over every nook and cranny of networks! You can learn a lot of both C and networks just by following this, enjoy!

14 224 2K 158K 3K

Download Image

Social Engineering Community @sec_defcon

6 months ago

🚨Calling all volunteers! SE Community runs on the heart and hustle of our amazing volunteers. 💛 Apply to be a part of the team! 📆Submissions close: June 1, 2025 📬Acceptances sent: June 16, 2025 Learn more: se.community/call-for-volun…