Pentesting, scripting, pwning!
127.0.0.1
Joined January 2019
- Tweets3.1K
- Following344
- Followers29.3K
- Likes4.9K
S3cur3Th1sSh1t retweeted
🦛🦛🦛Microsoft patched PetitPotam this October: EFSR now only resolves local paths. This means WebDAV to LDAP Coercion is fixed!
Remaining methods for clients are WSP (coercing SMB) and PrinterBug (coercing RPC), but both cannot be relayed to LDAP 💀💀💀
Disclaimer: AI was used to develop the extension. UX, UI design, and minor code tweaks originated from a human brain. Code was read using human eyes. 😂
I may need to also use that phrase later.
Input payload obfuscation is a real game changer here. No AMSI or ETW bypass needed and memory scanner evasion 👀
RustPack Release 1.8.0 was shipped to our customers recently. Short Blogpost with the most relevant new features for everyone here 🔥🔥
msecops.de/blog/posts/rustpa…
#RedTeam #OST #Pentest #Maldev
S3cur3Th1sSh1t retweeted
RustPack Release 1.8.0 was shipped to our customers recently. Short Blogpost with the most relevant new features for everyone here 🔥🔥
msecops.de/blog/posts/rustpa…
#RedTeam #OST #Pentest #Maldev
Well for offensive security tasks people need to fall back to opus 4.6 depending on the task. Models that run on the sparks are similar to opus 4.8 on benchmarks. Frontier in general vs frontier in maldev for example is not the same. 🤷♂️
With API costs this is easy and fast. I compared my spark overall input output token vs API costs and same tokens for Claude Opus would have been more than 70k € already. In Subscription token that would be 10-12 Months 200€ subscription now? 24x7 usage over 6 weeks.
Exactly this is what Claude implemented got me this year in an internal WebApp. Even Opus. 🤷♂️ if the prompt didn’t mention server side validation why should it.
When your only authorization is JavaScript client side. And you can make yourself admin in 20 minutes. Than you know this was vibe coded. What is happening in 2026? 🤣
Doing an WebApp Pentest today. And this WebApp is 95% likely fully vibe coded. Authorization issues everywhere. Logical issues everywhere. Its like an CTF. And big consulting company likely won a tender because of lowest price. Happy birthday the next years will be great! 🫡🤪
Zero help fully autonomous. Custom self created harness created by Claude. Ghidra and python capstone and rizzin for reversing. Its a react loop with handover each run similar to ralph loops.