Breaker of Stuff | Injector of 0x41 | Discoverer of Dumb Things | Creator of Glitches. Dropping shells since 0x7DC.

Joined July 2021
ret2src retweeted
Quick 'n dirty BloodHound ecosystem overview. The different ingestors, collectors, analysis tools. There might be things missing. gist.github.com/gitgotgitgot…
4
33
2
113
17,066
I made a thing that might help people: mr-r3b00t.github.io/net_draw…
22
51
5
289
39,242
I have suspected the klist.exe could be used to dump local tickets but never had time to check that out correctly. This guy did and explains it very well! Only requires local admin rights, no system, to dump all TGT's on the computer jakeotte.com/posts/klist-rev…
2
79
1
300
18,655
Introducing RelayKing. github.com/depthsecurity/Rel… Blog: depthsecurity.com/blog/intro… Automatically identify relay attack paths. No longer will you be left to manually detect a comprehensive inventory of all the relaying vectors on your engagements. It will detect signing/EPA settings on all protocols you specify, NTLM reflection CVEs, and WebDav WebClient presence. Then, produce a comprehensive report of the relaying vectors on the network in your preferred output format. This ensures that you report ALL vulnerable instances easily, without the need for manual patching together of results from various tools. Ideal usage is with a set of low-privilege AD credentials, but it also supports unauthenticated scanning (with far less coverage). See GitHub and the blog post for more details. Please note that there ARE bugs. The LDAP(S) detection has been annoying but SHOULD be mostly solid. If you get suspicious results from it, please report an issue on GitHub with the config RelayKing reported, versus the actual one. Enjoy!
3
87
1
215
18,811
Self shadow cred is back again 🔥🔥🔥🔥🔥🔥🔥🔥🥳
Replying to @Defte_
Update: Thanks to @RedTeamPT, I created a pull request for ntlmrelayx to reflect the new requirements: github.com/fortra/impacket/p… Now Shadow Creds are working again 😀
1
16
113
6,943
Replying to @Defte_
Update: Thanks to @RedTeamPT, I created a pull request for ntlmrelayx to reflect the new requirements: github.com/fortra/impacket/p… Now Shadow Creds are working again 😀
5
80
3
285
24,174
ret2src retweeted
Replying to @ShitSecure
Another way is to look for snapshots of a target VM and get the memory .vmem file. After converting the memory dump it should open in WinDbg and extract some secrets with Mimikatz extension.
1
1
25
1,909
ret2src retweeted
My colleague Mathias and I just finished our talk about "Relaying Unprivileged Users to RCE" at @MCTTP_Con. You can find our slides at github.com/svaredteam/talks/…
3
15
69
4,366
ret2src retweeted
Active Directory Pentest Mindmap v2025.03 Full view and updated map : orange-cyberdefense.github.i…
3
193
2
998
46,474
I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: dirkjanm.io/obtaining-global…
138
899
112
3,174
481,825
Here's an initial release of a LDAP browser written in python with a nice GUI and some integrations with #BloodHound github.com/ZephrFish/pyLDAPG…
Made a thing, mucking about with python and a LDAP browser concept to ingest straight into BloodHound, simple LDAP browser using PyQt as a GUI and neo4j-driver to ingest into BH. Coming Soon #itstimetobrowse
4
41
2
200
18,607
#redteam Now, you can dump the #Windows password from the LSASS process with help from the past: WerFaultSecure.exe Github: 2x7EQ13/WSASS Experimental version: Windows 11 24H2 #Blueteam
12
166
4
657
50,670
ret2src retweeted
So embarrassing
32
66
5
1,163
49,125
ret2src retweeted
the jump scare of the morning award goes to @J0R1AN (it even adapts to different native calculators using UA-based OS detection :))
4
16
3
161
30,001
The memes are on point today
38
172
44
2,863
180,148
Best Citrix Breakout ever. You can only download .ica files that provide access to certain local applications but breakout out of these applications is not possible? Just modify the .ica file before starting it and remove The InitialProgram= value -> Full Citrix Session! 🤓
10
83
1
382
34,000
The second book in my “being a professional red teamer requires more than just having kick ass technical tradecraft” series is: “Never Split the Difference” by Chris Voss. The reason I picked this book is because red teams rarely control the environments they are operating in. They don’t have the necessary authority to implement changes if they encounter a security issue; however, if certain changes aren’t understood and eventually made, future outcomes could actually be catastrophic. So, company leaders usually perk up when red teamers speak. Do we (as red teamers) leverage this influence to drive better security posture? If one wanted to get better at influence, how would they do that? This book is how. Chris Voss spent 24 years with the FBI, becoming the FBI’s lead international kidnapping and hostage negotiator. Chris shares his tactics and techniques that he used as a hostage negotiator to “create an aura of authority and trustworthiness without triggering defensiveness.” It’s red team gold. TL;DR Ever needed to drop a painful finding on your stakeholders with a costly price tag, but present everything in a way that they’re somehow thanking you at the end? This book will teach you.
3
1
32
5,242