Pentesting, scripting, pwning!
127.0.0.1
Joined January 2019
- Tweets3.1K
- Following344
- Followers29.3K
- Likes4.9K
S3cur3Th1sSh1t retweeted
🦛🦛🦛Microsoft patched PetitPotam this October: EFSR now only resolves local paths. This means WebDAV to LDAP Coercion is fixed!
Remaining methods for clients are WSP (coercing SMB) and PrinterBug (coercing RPC), but both cannot be relayed to LDAP 💀💀💀
S3cur3Th1sSh1t retweeted
RustPack Release 1.8.0 was shipped to our customers recently. Short Blogpost with the most relevant new features for everyone here 🔥🔥
msecops.de/blog/posts/rustpa…
#RedTeam #OST #Pentest #Maldev
S3cur3Th1sSh1t retweeted
The TL;DR of what Anthropic just said:
1.) GLM-5.3 is as good as Mythos for exploit development.
2.) Unlike Claude, GLM-5.3 gives you the results you pay for.
3.) Governments should ban AI models which are as good as theirs but are not made by them.
The funniest part is how Anthropic admitted self-reflectively that the lack of guardrails may actually be benefiting the defenders working to secure their systems. 🤪
Something they never wanted to allow, because of possible misuse.
I don't get it, but I feel Anthropic should at least put a note at the very bottom if they are doing paid advertising to promote GLM-5.3. 😜
Source:
anthropic.com/research/glm-5…
S3cur3Th1sSh1t retweeted
New Blogpost regarding to "Backdooring Open-Weight Models" just published by @ShitSecure:
msecops.de/blog/posts/backdo…
S3cur3Th1sSh1t retweeted
Can LNK files ever be trusted?
⚡ My latest blog post demonstrates several new LNK abuse methods, allowing you to fully spoof the target shown in Explorer. It also introduces tools to create your own LNKs, and detected spoofed ones yourself.
🐬 wietzebeukema.nl/blog/trust-…
S3cur3Th1sSh1t retweeted
I’m not worried about the future of pentesting and here’s why.
The automated pentesting trend is following a similar trajectory as vulnerability scanning. Organizations only interested in compliance or those who have very small environments or budget will just go the automated route.
Those who truly want to improve and who want expert guidance and consulting will go the manual or human-led route.
The good thing is the automated route has gotten better and will continue to.
But so will manual/human-led.
There’s plenty of organizations to serve and to help in both categories. 🫡
S3cur3Th1sSh1t retweeted
[TALK] Tomorrow, Fabian and I will be presenting some of our latest research on device emulation and exploitation on Windows.
Come say hi if you’re around!
mcttp.de/2026-mosch-und-magn… – at Garching bei München, Deutschland
S3cur3Th1sSh1t retweeted
New blog post “Evading machine learning based detections” - msecops.de/blog/posts/ml-eva… 🔥
S3cur3Th1sSh1t retweeted
Friday afternoon (vibe)coding project that was on my to-do for a while: obtaining Entra ID tokens from an endpoint by asking the WAM. This alternative to using the PRT cookie follows the legitimate SSO flow used by apps like Teams to obtain tokens. Code: github.com/dirkjanm/askWAM
S3cur3Th1sSh1t retweeted
NetNTLMv1 is dead. Long live NetNTLMv1. 🌈
Today we're releasing NTLMRain: recovering NT hashes from NetNTLMv1 responses.
🌐 Browser-based cracking
⌨️ Cross-platform CLI with GPU/CPU support
💾 Searchable tables that fit on a 4 TB disk
Read the blog: outflank.nl/blog/2026/09/08/…
S3cur3Th1sSh1t retweeted
🚨🚨🚨🚨🚨🚨
From Padding Oracle to Shell: Unauthenticated RCE in Telerik UI for ASP[.]NET AJAX
tantosec.com/blog/2026/09/te…
The vulnerabilities described in this post were discovered, analysed, and exploited with some AI assistance, and a lot of old-fashioned human persistence.
S3cur3Th1sSh1t retweeted
New release of DPLoot 🔥
Now DPLoot can recover secrets over multiple protocols : SMB, WMI, WinRM, MSSQL, Local and Cobalt Strike REST API.
github.com/zblurx/dploot
S3cur3Th1sSh1t retweeted
Introducing GLM-5.3-Flash
- Leading capabilities at a highly competitive price
- Natively multimodal with a 1M-token context window
- A 320B-A18B model released under the MIT License
- Previously previewed as Ox Alpha, running entirely on Chinese AI chips
Blog: z.ai/blog/glm-5.3-flash
Available now across all official platforms:
Weights: huggingface.co/zai-org/GLM-5…
API: docs.z.ai/guides/llm/glm-5.3…
Coding Plan: z.ai/subscribe
ZCode: zcode.z.ai/en
Chat: chat.z.ai
AutoClaw: autoclaw.z.ai
S3cur3Th1sSh1t retweeted
ar0x.com/posts/how-to-tunnel…
The third and probably final part of this blog series (for now), but who knows. 😅
S3cur3Th1sSh1t retweeted
My @x33fcon talk has been published. Hope you like it.
#x33fcon 2026 talks: @_ar0x4 - Tunnel Vision: What Microsoft's Secure Edge Can't See > youtu.be/S9skOBjoQKE
S3cur3Th1sSh1t retweeted
The quiet shift nobody is talking about:
Frontier labs are forced to meter, watermark, and restrict. Open-weight models keep getting stronger and cheaper to run.
Every month the gap between “what’s allowed” and “what you can actually own” gets smaller.
The builders who already moved critical systems off the public APIs will look very smart in 12 months.
The ones still fully dependent on someone else’s rate limits will feel it first.
S3cur3Th1sSh1t retweeted
Citrix admins, your weekend plans just changed.
CVE-2026-8452 was disclosed as a NetScaler memory overflow / DoS.
Now @watchtowrcyber has dropped a Pre-Auth RCE PoC.
Internet-facing edge appliances. No authentication. RCE.
github.com/watchtowrlabs/wat…
#ReverseEngineering #VulnerabilityResearch #Infosec
S3cur3Th1sSh1t retweeted
#x33fcon 2026 talks: @k3vinTell & @RWXstoned - DDD: DCOM, DotNet, Deserialization > youtu.be/lQD_Pz4IR5A
