I hate C++ more than I hate myself, and there's a certain degree of peace one gains from that.
hashed using strlen()
Joined February 2020
- Tweets5K
- Following1.3K
- Followers417
- Likes5K
S retweeted
Bypassing SMB and LDAP signing with ntlmrelayx 🔥
I added both reauthentication bypasses to Impacket, now merged! Use –reauth-bypass on unpatched systems 🚀
LDAP can also start anonymously where accepted.
Research: blackfield.ch/blog/defeating… and specterops.io/blog/2026/10/2…
S retweeted
this is getting f*cking dangerous...
REA creator just dropped 20 GitHub repos to build a f*cking reverse engineering studio:
[01] analysis core
> REA: a single MCP that plugs into everything github.com/morluto/rea
> Ghidra: decompiler, free github.com/NationalSecuri…
> GhidraMCP: lets your agent drive Ghidra github.com/LaurieWired/Gh…
> ida-pro-mcp: hooks your agent into IDA Pro github.com/mrexodia/ida-p…
[02] mobile & apps
> jadx: turns Android APKs back into Java github.com/skylot/jadx
> Apktool: take APKs apart and put them back together github.com/iBotPeaches/Ap…
> Frida: hook into apps while they run github.com/frida/frida
> ILSpy: decompiles .NET github.com/icsharpcode/IL…
[03] binary & low-level
> radare2: RE framework that lives in your terminal github.com/radareorg/rada…
> x64dbg: debugger for Windows github.com/x64dbg/x64dbg
> ImHex: hex editor with its own pattern language github.com/WerWolv/ImHex
> angr: symbolic execution engine github.com/angr/angr
[04] network & runtime
> mitmproxy: sits in the middle and reads the traffic github.com/mitmproxy/mitm…
> dnSpy: debug and edit .NET apps github.com/dnSpyEx/dnSpy
> rizin: the radare2 fork github.com/rizinorg/rizin
> raddebugger: the debugger from Epic Games github.com/EpicGames/radd…
[05] rebuild & verify
> awesome-ai-reverse-engineering: 122 repos, every one graded github.com/zhuyansen/awes…
> awesome-reverse-engineering: curated by the guy who made REA github.com/morluto/awesom…
> REA workflows: ready-made investigation prompts, ship with REA
> clean-room loop: SPEC.md, oracles and checks until it matches
how it runs: binary -> REA -> SPEC.md -> rebuild -> oracle -> retry
save this, point it at any app and watch it explain itself.
S retweeted
Building a Malware Development Lab, Part 1: Elastic EDR with a Self-Hosted Elastic Stack by bsdrip
Blog:- blog.bsdrip.tech/maldev-lab/…
S retweeted
Introducing ARES 🛡️⚔️
Open-source autonomous red team & security validation platform built with FastAPI + React.
Features:
• Autonomous Attack Graph (DAG)
• MITRE ATT&CK Mapping
• Scope Firewall & Instant Reports
GitHub:
github.com/Mafifrizi/ARES
#RedTeam #CyberSecurity
S retweeted
"3 random dudes”
1. hacked apple, again and again.
httpvoid.com/Apple-RCE.md
httpvoid.com/Hello-Lucee!-Le…
httpvoid.com/Hacking-Apple-w…
2. your github enterprise is our github enterprise.
httpvoid.com/GitHub-Enterpri…
3. get a discord message from me, get pwned.
hacktron.ai/blog/discord-rce
youtube.com/watch?v=R3SE4VKj…
4. oh yeah, at one point we basically had shells across the electron ecosystem. check the DEF CON research.
media.defcon.org/DEF%20CON%2…
5. your supabase database is my database.
hacktron.ai/blog/supapwn
6. we got the posthog prod database.
hacktron.ai/blog/posthog-rce
7. react2shell? vercel paid us $170k for helping secure their waf.
hacktron.ai/blog/react2shell…
8. your palo alto vpn is my vpn.
hacktron.ai/blog/cve-2026-02…
9. ai ides? we got shells for you, antigravity
hacktron.ai/blog/hacking-goo…
10. windsurf rce.
youtube.com/watch?v=23Mz7qcR…
11. turning cluely into malware.
hacktron.ai/blog/hacking-clu…
12. ai browsers? sure, uxss: your perplexity browser is my browser.
hacktron.ai/blog/perplexity-…
13. openai atlas too. kinda uxss
hacktron.ai/blog/hacking-ope…
14. hey, it’s not even our first time hacking discourse.
projectdiscovery.io/blog/dis…
15. adobe coldfusion: pre-auth rce. because apparently we needed another one.
projectdiscovery.io/blog/ado…
there’s a lot more. go dig.
anyway, yes: “3 random dudes.”
and @HacktronAI is full of more random dudes like these.
S retweeted
Learn Linux networking by doing 🔽
New hands-on challenge - practice reading the network configuration of Linux hosts: find interface names, IP and MAC addresses, the default gateway, and detect which routes a server uses to reach different destinations.
labs.iximiuz.com/challenges/…
S retweeted
Fuzzing is the first step toward finding a vulnerability and then developing an exploit!
Exploit Development: Fuzzing with American Fuzzy Lop++ (AFL++) to Find Zero-Day Vulnerabilities
First step to building your own exploit:
hackers-arise.com/exploit-de…
S retweeted
Podroid runs a real Linux desktop and container environments on Android phones without requiring root access.
github.com/ExTV/Podroid
S retweeted
Scans usernames across 840+ platforms using AI heuristics to detect profiles and extract profile data.
github.com/arxhr007/Aliens_e…
S retweeted
Dump TGTs remotely and convert Windows' klist binary output to ccache. github.com/jakeotte/klist2cc…
S retweeted
Unrestricted File Upload: Complete Guide for Pentesters
🔥 Telegram: t.me/hackinarticles
✴ Twitter: xitter.cf/hackinarticles
Unrestricted File Upload is a critical vulnerability where attackers upload malicious files (web shells, scripts) due to improper validation, leading to remote code execution and server compromise. ()
📘 Introduction to Unrestricted File Upload
❓ How File Upload Vulnerability Occurs
📂 File Upload Exploitation
📟 Basic File Upload
🧪 Content-Type Restriction Bypass
🧬 Double Extension Attack
📏 Image Size Validation Bypass
🚫 Blacklisted Extension Bypass
⚙️ Server Misconfiguration Issues
💥 Impact of Unrestricted File Upload
🛠️ Gaining Reverse Shell via Upload
🎯 Exploitation using Metasploit
🛡️ Mitigation Techniques
⚡ Improper validation allows attackers to upload malicious files, leading to full server takeover, data exposure, defacement, and backdoor access.
🔗 Read Full Guide: hackingarticles.in/comprehen…
#CyberSecurity #Pentesting #BugBounty #WebSecurity #EthicalHacking #Infosec
S retweeted
New video: logon sessions explained.
Every process has a token. Every token came from a logon session. But most developers never touch the session directly.
Covers: what logon sessions hold, why tokens exist as a separate layer, LsaEnumerateLogonSessions in C++, and the relevant structures in WinDbg.
trainsec.net/library/windows…
S retweeted
AI-Powered Active Directory Pentesting with Claude, HexStrike AI & NetExec hackingarticles.in/ai-powere…
S retweeted
Hello guys،
Do you want to Bypass all production EDR ?
Read my new research to enjoy in kicking EDRs defenses.
0xmaz.me/posts/LACUNA-Chain-…
The proof-of-concept implementation is available at github.com/MazX0p/LACUNA-Cha…
#Maldev
S retweeted
Claude Code is a very powerful tool on RE tasks. Looping it with IDA and the decompiler over MCP or idalib delivers very impressive results, especially in combination with dynamic workflows.
/goal find and list all the crypto implementations
[algo => address]
/loop use decompile but verify all the findings with disasm
S retweeted
Generates a live network map from auto-discovered services and ports
github.com/mostafa-wahied/po…
S retweeted
My Windows reverse engineering and exploit research workflow has been:
1. Pick a binary to research like tcpip.sys
2. Use github.com/joshterrill/post-… to automate seeing existing binary versions, download, and generate diffs from them
3. Load the resulting .binexport's and .bindiff into an LLM and ask it to analyze
4. Look up the build number of previous Windows version that old binary existed in from uupdump.net/ such as 26100.8328 and create a VM from it
5. Write code and test, working backwards from LLM analysis
S retweeted
Automated vulnerability research for Windows kernel drivers
github.com/416rehman/deepzer…
