ret2src retweeted
Quick 'n dirty BloodHound ecosystem overview. The different ingestors, collectors, analysis tools.
There might be things missing.
gist.github.com/gitgotgitgot…
ret2src retweeted
I made a thing that might help people: mr-r3b00t.github.io/net_draw…
ret2src retweeted
medium.com/@business1sg00d/o…
Oneliners for ADCS EScx vulnerabilities.
Ghost-Sender is a misconfiguration enabling the delivery of arbitrary phishing emails against a large number of Exchange Online tenants.
labs.infoguard.ch/posts/ghos…
#infosec #cybersecurity #redteam #phishing
ret2src retweeted
Synacktiv publicly disclosed a Kerberos reflection bypass, CVE-2026-26128, with PoC exploit code. It yields SYSTEM on most Windows builds. Patch now.
#Kerberos #PoC #CVE #Windows
securityonline.info/kerberos…
ret2src retweeted
I have suspected the klist.exe could be used to dump local tickets but never had time to check that out correctly. This guy did and explains it very well! Only requires local admin rights, no system, to dump all TGT's on the computer
jakeotte.com/posts/klist-rev…
ret2src retweeted
Introducing RelayKing.
github.com/depthsecurity/Rel…
Blog: depthsecurity.com/blog/intro…
Automatically identify relay attack paths. No longer will you be left to manually detect a comprehensive inventory of all the relaying vectors on your engagements.
It will detect signing/EPA settings on all protocols you specify, NTLM reflection CVEs, and WebDav WebClient presence. Then, produce a comprehensive report of the relaying vectors on the network in your preferred output format. This ensures that you report ALL vulnerable instances easily, without the need for manual patching together of results from various tools.
Ideal usage is with a set of low-privilege AD credentials, but it also supports unauthenticated scanning (with far less coverage). See GitHub and the blog post for more details.
Please note that there ARE bugs. The LDAP(S) detection has been annoying but SHOULD be mostly solid. If you get suspicious results from it, please report an issue on GitHub with the config RelayKing reported, versus the actual one.
Enjoy!
ret2src retweeted
Self shadow cred is back again 🔥🔥🔥🔥🔥🔥🔥🔥🥳
Replying to @Defte_
Update:
Thanks to @RedTeamPT, I created a pull request for ntlmrelayx to reflect the new requirements:
github.com/fortra/impacket/p…
Now Shadow Creds are working again 😀
ret2src retweeted
Replying to @Defte_
Update:
Thanks to @RedTeamPT, I created a pull request for ntlmrelayx to reflect the new requirements:
github.com/fortra/impacket/p…
Now Shadow Creds are working again 😀
ret2src retweeted
Replying to @ShitSecure
Another way is to look for snapshots of a target VM and get the memory .vmem file. After converting the memory dump it should open in WinDbg and extract some secrets with Mimikatz extension.
ret2src retweeted
My colleague Mathias and I just finished our talk about "Relaying Unprivileged Users to RCE" at @MCTTP_Con. You can find our slides at github.com/svaredteam/talks/…
ret2src retweeted
Active Directory Pentest Mindmap v2025.03
Full view and updated map : orange-cyberdefense.github.i…
ret2src retweeted
I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: dirkjanm.io/obtaining-global…
ret2src retweeted
Here's an initial release of a LDAP browser written in python with a nice GUI and some integrations with #BloodHound
github.com/ZephrFish/pyLDAPG…
Made a thing, mucking about with python and a LDAP browser concept to ingest straight into BloodHound, simple LDAP browser using PyQt as a GUI and neo4j-driver to ingest into BH. Coming Soon #itstimetobrowse
ret2src retweeted
Best Citrix Breakout ever. You can only download .ica files that provide access to certain local applications but breakout out of these applications is not possible? Just modify the .ica file before starting it and remove The InitialProgram= value -> Full Citrix Session! 🤓
ret2src retweeted
The second book in my “being a professional red teamer requires more than just having kick ass technical tradecraft” series is: “Never Split the Difference” by Chris Voss.
The reason I picked this book is because red teams rarely control the environments they are operating in. They don’t have the necessary authority to implement changes if they encounter a security issue; however, if certain changes aren’t understood and eventually made, future outcomes could actually be catastrophic. So, company leaders usually perk up when red teamers speak. Do we (as red teamers) leverage this influence to drive better security posture? If one wanted to get better at influence, how would they do that? This book is how.
Chris Voss spent 24 years with the FBI, becoming the FBI’s lead international kidnapping and hostage negotiator. Chris shares his tactics and techniques that he used as a hostage negotiator to “create an aura of authority and trustworthiness without triggering defensiveness.” It’s red team gold.
TL;DR
Ever needed to drop a painful finding on your stakeholders with a costly price tag, but present everything in a way that they’re somehow thanking you at the end? This book will teach you.

































