Cybersecurity noob
Joined November 2019
- Tweets5.1K
- Following176
- Followers613
- Likes4.7K
Pinned Tweet
My first ever paper that got accepted at @RedTeamVillage_ !
NPPSpy and LSASS dumping are heavily monitored now. @realcaptainwoof goes beyond both, harvesting credentials through the Windows Credential Provider framework itself, a fresh path when the old ones are burned. 🚧
1
200
Can I resign from Anthropic too?
I resigned from Anthropic today. I spent the last three years doing pretraining research at both OpenAI and Anthropic. Neither company is acting responsibly. They are racing straight to self-improving superintelligence and gambling with our lives. More thoughts below.
112
Sohail Saha retweeted
i talked to a lot of people who played the defcon ctf finals to understand how llms affected them, both professionally and mentally.
i went in hoping to learn that human intuition still mattered. instead, ctfs in their current form as everyone saying is dead, players are forced to operate slot machines because anyone who refuses to token-max loses to those who do.
almost everything i learned, including how to learn, came from grinding ctfs. but the pipeline for developing that kind of skill and expertise now seems broken, juniors are rewarded for token-maxxing rather than going through the process of actually understanding things which is quiet sad and ctfs might not produce high quality security researchers any more.
this also has serious implications for people who can’t afford tokens. five years ago, i wouldn’t have been able to afford access to something like gpt-5.6, and I would have been locked out of the very competitions that helped me build my career.
anyway these are questions i asked if interesting for anyone:
did they have fun?
almost everyone was unhappy. it has largely become slot-machine operating, if they refuse to use llms, they lose to teams that do. it is not there is no fun at all, playing with friends and competing was all fun just process of solving which is main part and it isn't fun.(please let me know if you had fun)
did having a skilled human in the loop still matter?
i got mixed answers, but the leaderboard tells a fairly clear story, the top teams aggressively token-maxxed, by pooling gpt accounts and stuff. the #1 team allegedly spent around $50k on tokens xd.
how much of the outcome came from human skill versus token-maxxing?
its probably 95% token-maxxing and 5% human skill. some challenges, especially visual ones, remain difficult for llms, and human intuition to prompt mattered. but overall, the dominant strategy appears to be throwing more tokens at problems, one interesting observation, people who were better before llms were also better after the llms and they are the ones solving lot of challenges so it seems still 5% operating skill will put u in top and can't be dumb operator.
will a new generation of players simply adapt to this new kind of competition?
i thought maybe current players are just behaving like boomers who hate every new technology. but unlike previous technology stuff, there doesn’t seem to be much for the human to master here. token-maxxing is literally just token-maxxing. it doesn’t reward human ingenuity, it discourages it, and may eventually atrophies and makes us dumb
let me know if i missed something or if you have different opinions
Sohail Saha retweeted
NPPSpy and LSASS dumping are heavily monitored now. @realcaptainwoof goes beyond both, harvesting credentials through the Windows Credential Provider framework itself, a fresh path when the old ones are burned. 🚧
Next up, they're banning AWS and DigitalOcean
They can’t. Make your own vpn:
1. SSH to a host with:
ssh user@host -D 8081
2. Point your browser proxy settings to localhost port 8081, and mark it as a SOCKS v5 proxy.
3. You now are proxying your browser traffic to where that host is, like a vpn.
1
388
Sohail Saha retweeted
We’re happy to announce that our EDR Internals & Development training is now in its final stages of development.
Over the past several months, an enormous amount of work has gone into building this highly technical & detailed training. The course covers the internals of modern EDR from both user-mode and kernel-mode perspectives, including techniques like syscall hooking, filesystem minifilters, ETW telemetry, memory scanning, kernel callbacks, process instrumentation callbacks, call stack tracing, and anti-tampering mechanisms.
The course concludes with building a limited yet functional custom EDR agent and we test it against several malware techniques to gain practical experience with detection engineering and EDR internals.
This huge undertaking would not have been possible without @GigelV41464 who dedicated countless hours to analyzing different EDR products, building custom implementations, analyzing internal mechanisms, and documenting the techniques with excellent depth and clarity.
The official launch date is scheduled for June 15, 2026 but starting today, we're opening access to an early bird discount of 20% for a limited time.
EDR Internals & Development: maldevacademy.com/edr-course
Sohail Saha retweeted
This morning I have made public an internal repo on relaying available to everyone. I call it the relay bible. I still have a few more additional tweaks and techniques to add in here but for the most part. It's ready. Hope everyone enjoys my reference.
github.com/rootsecdev/relay_…
This is what I hate about AI.
It has reduced the entry barrier and allowed all kinds of lowlife idiots to enter the space and flood the environment with slop and buzzwords.
180
Can someone just.make.a.browser?
Just.
A.
Browser.
If you need help I'll join you.
#browser
Google Chrome silently installs a 4 GB AI model on your device.
> No consent dialog. No opt-out UI. Re-installs itself if the user removes it manually.
That is the true definition of malware.
125
Very well done
Publicly disclosing the bluehammer exploit, at the time of writing this, this vulnerability is still unpatched.
Full PoC source can be found here -
deadeclipse666.blogspot.com/…
221
Same concept as training to failure at gym. Your body/mind has an upper limit, and failure is your body/mind's way of telling you that it's enough for today; now it's time for recovery.
Also, try several exercises. Don't just stay on one machine for hours.
Experiencing some pretty hardcore burn out in malware.
However, a word of advice for the noobs, or less-er experienced people in cybersecurity, "burn out" is part of the natural progression of this ecosystem and it happens to everyone.
Your brain is a muscle (not literally, but brains have this dumb stuff called neuroplasticity, some nerd stuff, whatever), and just like a muscle, you need down time to heal, and science, or something.
Myself personally, I tend to go through waves of absurd productivity with little to no pacing. I get extremely excited, rip through code, ... and then lose control and crash and burn.
Then it takes me anywhere between a few days, ... or few weeks, ... or worse case a few months to recompose myself and get back in the game.
This is a good opportunity to switch it up a little bit. Instead of going schizo on malware, I've been exploring the internet, reading about current geopolitical stuff, and reading some psychology stuff.
I personally think it's important to keep "exercising" the muscle (plus I like learning), but some of my peers decompress altogether and switch to consuming high quality brain rot.
Anyway, the point being, if you've been going hard and suddenly you feel disappointed, or sad, or don't feel that "spark", or feel yourself struggling to even do a few lines of code, it is almost certainly burn out. I know some nerds are kind of hard on themselves, so don't beat yourself up if you feel this way. It happens to all of us (unless you're abusing narcotics to stay locked in).
Take this as a sign and use the opportunity to do something else. One day you'll be doing something and out of seemingly nowhere you'll feel that "spark" again and be like HOLY FUCK, I WANT TO CODE (or whatever you do).
Pic unrelated
121
Just how difficult is it to be a developer and have a security-aware mind?
It's common sense to not run shit from weird places. How can such smart people be so gullible?
‼️ The axios lead maintainer has gone public on how he was socially engineered into installing the malware behind the npm supply chain attack.
We have example images showing exactly how the attack was staged.
75
Twist: aliens arrive after extinction of humanity. They find the vault. They're confused. "If something is so useful, why hide it in a vault in such a place?". They conclude that we found cosmic horror in code and that caused extinction. They then stop using their code altogether
52
Sohail Saha retweeted
🚨 BREAKING: Someone just dropped the most advanced Steganography Platform EVER!! 😱🥚
STE.GG is an open-source toolkit that hides secrets inside ANYTHING! images, audio, text, PDFs, network packets, ZIP archives, and even emojis 😘️︎︎️️️️︎︎︎️︎︎️️︎︎︎️︎︎️️️️︎️︎️︎️️︎︎️︎︎︎️︎️︎︎️︎︎︎︎︎︎️︎️︎︎︎︎︎️︎︎️️︎︎︎️︎︎️︎︎️︎️︎︎️️️︎︎️︎️️︎︎️︎︎️️️️️︎
AND it has an AI agent built in 👀
🔍 REVEAL: drop any file and the AI agent tests every known decoding method automatically. 120 LSB combinations, DCT, PVD, chroma, palette, PNG chunks, trailing data, metadata, Unicode, and more. 50 tools running in parallel.
auto-extracts hidden payloads as downloadable artifacts. no config needed.
🔮 CONCEAL: type your secret, pick a method (or let the AI choose), upload a carrier image OR generate one with AI.
one click → encoded steg file. the agent recommends the optimal method based on your use case.
the methods:
⊰ LSB — 15 channel presets × 8 bit depths = 120 combinations. steghide has 1. st3gg has 120.
⊰ F5 — operates on JPEG DCT coefficients. SURVIVES social media compression. regular LSB is destroyed by ANY JPEG compression, even quality 99%.
⊰ PVD — encodes in pixel pair differences. statistically harder to detect than LSB.
⊰ CHROMA — hides data in color channels (Cb/Cr). human eyes are less sensitive to color than brightness.
⊰ SPECTER (unique) — data hops between RGB channels in a pattern that IS the key. like frequency hopping in radio.
⊰ MATRYOSHKA (unique) — images inside images inside images. 11 layers deep. each layer is a valid image.
⊰ GHOST MODE (unique) — AES-256-GCM (600k PBKDF2 iterations) + bit scrambling + 50% noise decoys.
13 text steganography methods (no other tool has any):
▸ ZERO-WIDTH — invisible characters between visible letters
▸ INVISIBLE INK — Unicode Tag Characters (U+E0000). renders invisible everywhere
▸ HOMOGLYPHS — 'a' → 'а' (Cyrillic). visually identical. different bytes
▸ VARIATION SELECTORS — invisible modifiers after characters
▸ COMBINING MARKS — invisible joiners after letters
▸ CONFUSABLE WHITESPACE — en-space = 01, em-space = 10, thin-space = 11. 2 bits per space. text looks normal. the spaces are "wrong"
▸ DIRECTIONAL OVERRIDES — invisible RLO/LRO bidi characters
▸ HANGUL FILLER — Korean invisible character replaces spaces
▸ MATH BOLD — 'a' becomes '𝐚'. looks like bold text. each bold letter = 1 bit
▸ BRAILLE — each byte maps to a Braille pattern character
▸ EMOJI SUBSTITUTION — 🔵 = 0, 🔴 = 1
▸ EMOJI SKIN TONE — 👍🏻👍🏼👍🏾👍🏿 four skin tone modifiers = 2 bits each. a row of thumbs-up with different skin tones looks like a diversity post. it's binary data. four emoji = one byte.
detection:
50 tools including RS Analysis (academic gold standard), Sample Pairs, chi-square, bit-plane entropy, PCAP protocol analysis, and the AI agent orchestrates all of them automatically.
for AI agents:
from steg_core import encode, decode
from analysis_tools import detect_unicode_steg, TOOL_REGISTRY
50 tools as importable functions. test prompt injection via images. detect covert agent channels. watermark outputs.
▸ 112 techniques across every modality
▸ 50 analysis tools, 568 automated tests
▸ 109 pre-encoded example files
▸ runs 100% in browser at ste.gg — zero server
▸ pip install stegg — live on PyPI right now
the README has 7 hidden secrets. the banner has 3 layers. the website has multiple easter eggs.
good luck!
⊰•-•✧•-•-⦑ ⦒-•-•✧•-•⊱
🔗 ste.gg
📦 pip install stegg
🐙 github.com/elder-plinius/st3…
*formerly known as Stegosaurus Wrecks* 🦕
This text is totally not hiding an invisible sleeper-trigger prompt-injection.
The dedication of this dude is commendable
One of the younger folks in my Cloud Sec department was asking me about Sharepoint on-prem / network shares and it reminded me of a ✨theoretical✨ shenanigan I used to pull back in early college, circa ~2005 I thought y’all would enjoy
Short story time
1/n
1
40