WirePirate @pwnf_

Red Teamer Joined April 2016

Tweets

592
Followers

54
Following

161
Likes

439

Tim @__invictus_

7 months ago

All Red Teamers should be aware of post beacon loss syndrome, and the stages that you go through. Denial - "the user has probably just gone offline for the day", "maybe my redirector is fucked", "did I crash the process".

19 69 424 28K 78

SwiftOnSecurity @SwiftOnSecurity

2 years ago

Let’s say an insider threat in IT support has an authorization level to remotely administer machines. They can, in most companies completely free of attribution, dump all the login sessions/passwords of your browser, and import it into their home computer. They don’t need MFA.

2 16 133 68K 13

Simone Margaritelli @evilsocket

2 years ago

TIL you can enumerate valid email addresses for any G Suite domain with a simple HTTP request ... pretty neat!

75 575 5K 747K 3K

Download Image

Alice Climent @AliceCliment

2 years ago

Recently, I saw many people struggling with the PEB Walk concept. So for people having a hard time with it, this little illustration could help you 😃

1 53 190 19K 56

Download Image

Tomas Pueyo @tomaspueyo

2 years ago

50% of humans live in this circle But why? It's not a coincidence It's because of a single, massive accident Why? Let's zoom in:

546 7K 38K 578 18K

Download Gif

DirectoryRanger @DirectoryRanger

2 years ago

BadZure. PowerShell to orchestrate the setup of Azure Active Directory tenants, populating them with diverse entities while also introducing common security misconfigurations to create vulnerable tenants with multiple attack paths, by @mvelazco github.com/mvelazc0/BadZu…

0 53 141 18K 65

nixCraft 🐧 @nixcraft

2 years ago

130 1K 7K 449K 280

Download Image

0xor0ne @0xor0ne

2 years ago

How to modify Meterpreter dropper to bypass EDRs Excellent blog post by @VirtualAllocEx redops.at/en/blog/meterp… #meterpreter #redteam

4 138 330 32K 139

Download Image

SEKTOR7 Institute @SEKTOR7net

2 years ago

Making your CS beacon undetectable from both on-disk and in-memory YARA scanning, by William Burgess (@joehowwolf) #redteam cobaltstrike.com/blog/cobalt-st…

0 57 172 11K 56

SEKTOR7 Institute @SEKTOR7net

2 years ago

Runtime disassembling EDR/AV hooks leading to bypass, by Christopher Vella of @signal_labs #redteam signal-labs.com/analysis-of-ed…

1 67 170 13K 63

d3d aka dead (dead, мёртв, 死了) @deadvolvo

2 years ago

My dood XaFF did a thing... Kernel Level process hollowing? 👀 🔥 github.com/XaFF-XaFF/Kern…

2 42 115 12K 44

werdhaihai @werdhaihai

2 years ago

Today I'm releasing AtlasReaper, a .NET tool designed for red teamers to interact with Confluence and Jira via C2 agents. Discover secrets and launch targeted attacks. Check out the blogpost for more details: medium.com/@werdhaihai/7a… Github Repo: github.com/werdhaihai/Atl…

2 93 214 21K 52

Jean Marsault @iansus

2 years ago

DLLProxy: after 2 years of idle time, I noticed the project did not work, due to Lief not finding anonymous exports anymore. Just revamped it using a stealthier approach: forwarded exports, anonymous (ordinal-only) export support, VS project configuration github.com/Iansus/DllProx…

1 43 108 14K 45

an0n @an0n_r0

2 years ago

Just recreated this awesome @SpecterOps (@zyn3rgy, @0xthirteen) technique for initial access by #backdooring a random #ClickOnce application with a Cobalt Strike stager. While I became a ClickOnce addict🙃, compiled a short writeup about my journey: an0n-r0.medium.com/backdooring-cl…

SpecterOps @SpecterOps

2 years ago

0 54 174 118K 50

Download Image

1 119 321 46K 96

Download Video

Alh4zr3d @Alh4zr3d

3 years ago

Red Teamers: Impacket's wmiexec.py is useful for lateral mvmt, but it gets detected. If you're wondering why, it's often b/c it writes the output of the exec'd cmd to a file on the ADMIN$ share. Change the tgt share (-share C$) or use "-silentcommand". #redteam

14 91 449 33K 133

n00py @n00py1

3 years ago

This is post-compromise technique to bypass Okta MFA over RDP on Windows. n00py.io/2023/02/bypass…

1 51 139 15K 28

Paul Seekamp @nullenc0de

3 years ago

sub enum: subfinder -d tesla(.)com |tlsx -nc -silent -so |awk '{for(i=2; i<=NF; i++) printf "%s ", $i; print ""}'| tr -d '[],' |sort -uf Use uncover to search org names in Shodan and nuclei scan them: export SHODAN_API_KEY=XXX nuclei -nc -uc -uq 'org:"Tesla Motors Inc"' -silent

11 104 360 37K 208

Download Image

Andy Robbins @_wald0

3 years ago

Azure App Service Web Apps are yet another #Azure service that supports managed identity assignments. Here's how attackers can use #BARK to abuse those assignments: