Penetration Tester | Adaptable Adversary | https://xitter.cf/t.co/hHYXI8KHIg | Thoughts and tweets are my own
Minnesota, USA
Joined July 2009
- Tweets568
- Following450
- Followers1.3K
- Likes842
After trying LangChain, then Haystack, Rigging has been the best option so far. Removes all the unnecessary abstractions and allows you to focus on building an LLM powered toolset.
Rigging continues to be a core part of our toolkits - new docs here: rigging.dreadnode.io/
If you want information/tutorials on the roadmap - let us know.
Leo Loobeek retweeted
Welcome to my 2023 Irreverant Red Team TTP Wrap Up (Trends, Trolls, Predictions)
It's likely some of these will ruffle feathers, but hackers break things right? 😁
🧵👇
Leo Loobeek retweeted
@Vikings @KevOC7 @PhilMackey @DustBaker Season over. 24 hours after the most devastating event of his career, OUR quarterback doesn’t sit home feeling sorry for himself. No, he attends the Kids Club Trick-Or-Treat Trail in Egan. That’s our QB. #Vikings
Leo Loobeek retweeted
Before NVIDIA, I was lucky enough to work with @ram_ssk and @drhyrum at Microsoft. We got to write tooling, risk assessments, and attacks IRL. MLSec seems new, but their work on this topic is all over the Security community.
If you’re looking to orient yourself to the current state of ML Security, this is it.
amazon.com/Not-Bug-But-Stick…
Leo Loobeek retweeted
I wrote a blog post that talks about how we can abuse yet another Chrome Remote Debugging feature to "stalk" end users. posts.specterops.io/stalking…
Leo Loobeek retweeted
In this post, I discuss one key difference in the thinking between sophisticated adversaries and many of the red teams that try to simulate them, as well as what that means for tradecraft and tooling.
jackson_t.gitlab.io/it-depen…
Leo Loobeek retweeted
I am sharing the slides from my latest presentation: “0-Day Up Your Sleeve – Attacking macOS Environments” I gave at @nullcon
👉securing.pl/en/presentation/…
Leo Loobeek retweeted
An interesting post about Kernel Callback used by EDR. It’s a nice article to read if you want to dive into EDR Kernel Callbacks bypass.
Thanks @synzack21 for the blogpost ! :)
The part about @fdiskyou evil.sys driver and experiments is really nice ! :)
synzack.github.io/Blinding-E…
Leo Loobeek retweeted
Packt currently has a few books (including Penetration Testing Azure for Ethical Hackers) on sale on Amazon. Use code “20SECURITY” to get the 20% off discount - packt.link/NEBPw
Leo Loobeek retweeted
New post is up on the @trustedsec blog, this time looking at how to use ProcessDeviceMap to load arbitrary DLL's into a process on start. trustedsec.com/blog/object-o…
Leo Loobeek retweeted
Introducing Ivy a unique, stealthy method of executing shellcode using VBA and COM objects without dropping office macro documents to disk. Ivy also allows for the unhooking EDRs from the VBA environment. Check it out: github.com/optiv/Ivy 👀 #netsec #redteam #EDR #evasion
Leo Loobeek retweeted
AccChecker is a pretty interesting #lolbin (+ AppLocker Bypass) from the Win SDK. Load a managed DLL with this cmd:
AccCheckConsole.exe -window "Untitled - Notepad" C:\path\to\your\lolbas.dll
More info in this gist: gist.github.com/bohops/24441…
![AccChecker LOLBIN [AccCheckConsole.exe]](https://pbs.twimg.com/card_img/2117564677823639552/x4zOCZFa?format=png&name=800x419)
Leo Loobeek retweeted
github.com/jonaslyk/temp/blo…
My webdav based reflective loader/per process devicemap based dll injector POC is by now usable.
I would really like to have a OOP wrapper for NT- designing such is surprisingly difficult, but this approach shows potential especially considering simple
Leo Loobeek retweeted
[New Tool] RogueAssemblyHunter 🛡️
Rogue Assembly Hunter is a utility for discovering 'interesting' .NET CLR modules in running processes
github.com/bohops/RogueAssem…
#BlueTeam #ThreatHunting
Leo Loobeek retweeted
New blog post: how we created a phishing document signed by Microsoft - from Microsoft with love 😉
CVE-2021-28449 h/t @ptrpieter @OutflankNL
outflank.nl/blog/2021/12/09/…
Leo Loobeek retweeted
Arbitrary shellcode injection in Perl for MacOS. I never formalized it, but assume it might be helpful to someone.
gist.github.com/monoxgas/c0b…
Leo Loobeek retweeted
SharpMapExec update
* Minor logic improvements
* /system now gives stdout/stderr and disables AMSI
* /delegwalk executes in a delegated process context sorted by unique users (useful for shared workstations/servers)
* /comsvcs automatically parses LSASS
github.com/cube0x0/SharpMapE…
Leo Loobeek retweeted
🧠 Mental models are useful for developing solutions and stimulating thinking. In this post, I discuss some personal mental models I've found useful for offensive capability R&D, which can also generalize to understanding opponent processes in InfoSec.
jackson-t.ca/operational-men…
Leo Loobeek retweeted
For those that missed my @defcon @cloudvillage_dc talk - Here’s the recording
Here's our Day 2 talks for @defcon - youtube.com/playlist?list=PL…
Hope you enjoyed watching the Day 1 talks and this new playlist for Day 2 makes into your viewing queue!
Cheers!
#defcon29 #cloudvillage
