Offensive Developer && Red Teamer @ Outflank

The Netherlands
Joined January 2019
Dima van de Wouw retweeted
New video: basic reversing of a Windows kernel driver. WESP, the new endpoint security driver in Insider builds, has no device objects and no dispatch routines. Its imports tell you how it really talks to user mode: a filter communication port. Full write-up: trainsec.net/library/malware…
3
113
563
17,129
Dima van de Wouw retweeted
Your MCP server works fine, but the agent can't find a tool, ignores your constraints, or misses key output. Why? The client decides what the model sees. We dug into Codex and Claude Code to find out what they truncate, change, or drop entirely. ow.ly/h7L750ZTvaF
8
2
17
1,972
Dima van de Wouw retweeted
Guess what... @fortraofficial / @_ZeroPointSec are looking for a new content developer to join our ranks. fortra.wd12.myworkdayjobs.co…
1
11
39
5,653
Dima van de Wouw retweeted
A quick article showing how the Jev OPSEC ranker works, and looking at how Jev can be used for identifying potentially sensitive file paths and content at speed.
2
78
2
455
27,155
Dima van de Wouw retweeted
How do you run your own service inside Svchost.exe? trainsec.net/library/malware…
3
42
263
14,426
Dima van de Wouw retweeted
Latest preview build (29661) ships wesp.sys! The long-awaited initiative that should make it easier for EDRs to move capabilities to user mode and stay more resilient against kernel-level attacks.
8
66
2
289
23,608
Dima van de Wouw retweeted
NetNTLMv1 is dead. Long live NetNTLMv1. 🌈 Today we're releasing NTLMRain: recovering NT hashes from NetNTLMv1 responses. 🌐 Browser-based cracking ⌨️ Cross-platform CLI with GPU/CPU support 💾 Searchable tables that fit on a 4 TB disk Read the blog: outflank.nl/blog/2026/09/08/…
7
160
6
450
34,415
Dima van de Wouw retweeted
Had a blast working with my buddy @max__grim creating this badge! Thanks to @OutflankNL and @MDSecLabs for the conf. It was a blast again ❤️ Looking forward to the next one!
1
4
30
1,093
Dima van de Wouw retweeted
Infosec tradecraft just became reusable by AI agents. SpecterOps just open-sourced: 79 skills. 22 reusable agents. 26 plugin families. BloodHound. Cobalt Strike. Outflank C2. Ghidra. Binary Ninja. Ghostwriter. Recon. AppSec. Code review. C2 development. Reverse engineering. Adversary simulation. Windows + macOS tradecraft. And this is NOT just for red teamers. Vulnerability researchers: These workflows could accelerate code review, patch analysis, 1-day research and potentially help with 0-day discovery when paired with real research expertise. Reverse engineers + malware analysts: Give agents structured workflows, references and tooling instead of starting every investigation from a blank prompt. Blue teams + detection engineers: Study the same offensive tradecraft, emulate attacker behavior, build better detections and start asking what telemetry survives increasingly agent-assisted operations. DFIR + threat intel: Understand what adversaries may automate next and turn repeatable investigative knowledge into reusable workflows. Red teamers: BloodHound attack paths, recon, C2 development, adversary simulation and operator tradecraft are becoming increasingly agent-assisted. This isn't another collection of AI prompts. It's practitioner knowledge being turned into reusable, reviewable security workflows. Potentially useful for everyone from CTF learners and newcomers all the way to malware analysts, reverse engineers, exploit devs, red teams, blue teams and vulnerability researchers. This is only the beginning. @SpecterOps Skills: github.com/SpecterOps/skills @OutflankNL and @kyleavery breakdown: outflank.nl/blog/2026/09/02/… #Infosec #RedTeam #ReverseEngineering
11
210
2
977
57,373
Dima van de Wouw retweeted
RedTreat #5 is a wrap, possibly the best one yet! Awesome talks, attendees and location ❤️ safe travels to all attendees from me, @MarcOverIP and @StanHacked
4
6
66
3,852
Dima van de Wouw retweeted
I just released the first public version of @BintracerLabs, a malware-analysis sandbox focused on macOS. Bintracer can: - Detonate Mach-O binaries, app bundles, and dylibs - Extract DMG and PKG files - Analyze JXA, AppleScript, Python, Perl, and shell scripts This project is still early, but I can't wait to see what y'all think!
10
24
102
6,598
Dima van de Wouw retweeted
Ever wondered how an external developer can work with Outflank to get their tool into OST? We explore the process of incorporating infraRED, which can be used for auto deployment of RT infra (c2, redir, multi cloud, domains, email).Big thanks to @dsec_net! shorturl.at/VSd8a
1
10
1,382
Dima van de Wouw retweeted
New video: Process Memory Map in Code (Part 2). MemMap now identifies the file behind a mapped or image block with GetMappedFileName. Turns out Windows hands that back as an NT path, not “DOS” path, so I build a conversion function. Full write-up: trainsec.net/library/windows…
33
1
156
12,490
Dima van de Wouw retweeted
Intel #CET killed traditional #callstack #spoofing. Here is how to bypass modern #EDRs telemetry anyway. New: CET-Compliant Callstack Spoofing via Thread Pool & Enum callbacks. Manual shadow stack resync via JMP & #INCSSPQ. Article & Rust PoC included👇 mrtiz.github.io/cet-callstac…
1
27
1
88
5,343
Dima van de Wouw retweeted
Wrote a blog post about abusing signed Google Chrome installers to achieve arbitrary code execution blog.amberwolf.com/blog/2026…
2
64
2
222
12,622
Dima van de Wouw retweeted
Microsoft’s signed Windows Defender Boot-Time Removal driver (BTR.sys) is a one-shot kernel component that decrypts an RC4-encrypted transaction list from an Alternate Data Stream and performs Ring-0 operations. An attacker with SeLoadDriverPrivilege can craft a valid encrypted config and load it early via a transient “Boot Bus Extender” service, abusing it as a trusted kernel primitive to bypass Tamper Protection, delete EDR/AV components before they start, drop malicious drivers, and gain persistence, without any vulnerability or BYOVD. No in-the-wild abuse has been observed. research.checkpoint.com/2026…
6
166
11
679
146,367
Want to run an entire Tailscale daemon from memory inside a C2 implant with zero disk artifacts, no kernel drivers, traffic indistinguishable from HTTPS to a CDN, and relay connections from the victim network back through the tailnet. Now you can. Enjoy! netspi.com/blog/technical-bl…
15
197
11
754
67,891
Dima van de Wouw retweeted
I've been fairly quiet about recent events for good reasons, but this popped up on my radar - netspi.com/mdsec-security-al… I don't have much to say except some companies will forever lack class. For anyone looking for a new pentest, red team or c2 product vendor, there are many great ones out there and do your homework - the ones I am personally familiar with and would wholeheartedly recommend are @AmberWolfSec, @remotethreat, @SpecterOps, @OutflankNL and @TrustedSec ❤️
14
22
5
186
53,805
Dima van de Wouw retweeted
New video: VMMap Basics. 128 terabytes of address space on 64-bit Windows, and almost none of it used. VMMap shows you what's actually committed and why: images, heaps, stacks, and more. Full write-up: trainsec.net/library/windows…
1
39
1
215
9,363
Dima van de Wouw retweeted
New blog Spent way too much time reverse engineering CrowdStrike Falcon. Somewhere along the way, I found a bug. It's low and not practically exploitable... but a bug is a bug :) Publishing soon 0xdbgman.github.io/posts/ins…
15
121
3
490
39,205