Tester of Pens, Ex-Teamer of Red things, now with a more purpley shade. Biker and Recovering Eve-Online Addict. o7 Astro Instagram: https://xitter.cf/t.co/okwgH30GtJ
United Kingdom
Joined June 2010
- Tweets7.3K
- Following1.3K
- Followers1.4K
- Likes9.3K
Scriptmonkey_ retweeted
Was recently tinkering with DPAPI and CREDHIST and managed to find a way to extract hashes for old passwords and recover them in a new module written for hashcat. Blog -> lrqa.com/en/cyber-labs/crack…
Scriptmonkey_ retweeted
Just released a blog exploring python package management:
dtm.uk/badpie/
Scriptmonkey_ retweeted
Croeso BSides Aberystwyth, bydded i ni fod y cyntaf i'ch croesawu a phob lwc ym mis Tachwedd!
bsidesaberystwyth.org/
#Security #BSides #Aberystwyth #BSidesAberystwyth
Scriptmonkey_ retweeted
This is my research project in creating read, write and allocate primitives that can be turned into an injection in order to evade certain telemetry which I presented last year in RedTreat. I hope everyone likes it \m/.
trickster0.github.io/posts/P…
Scriptmonkey_ retweeted
This hack is brilliant, APT28 hopping into a target environment over wifi by compromising neighbouring companies and finding a dual-homed host within range.
volexity.com/blog/2024/11/22…
And yet... they got caught doing this!
Scriptmonkey_ retweeted
Great article with lots of details about attacks that happen irl. We should remember that many orgs don't require MFA from on-prem. Also, service accounts (i.e. entra sync account) won't have MFA. Threat Actors can also use PRTs and Access tokens to access M365/Azure.
The financially motivated cybercriminal group that Microsoft tracks as Storm-0501 has been observed exfiltrating data and deploying Embargo ransomware after moving laterally from on-premises to the cloud environment. msft.it/6013m5gnf
Scriptmonkey_ retweeted
Understanding EVERY Token in Entra ID 🔎
Not all tokens are equal. There are many different types with different uses and benefits.
In this blog, I break down each token and what they are used for and which tokens are the most "valuable" for an attacker to obtain.
Full blog here👇👇 @XintraOrg
xintra.org/blog/tokens-in-en…
Scriptmonkey_ retweeted
Teaching the Old .NET Remoting New Exploitation Tricks – read how @mwulftange developed novel techniques to exploit Apache log4net's hardened .NET Remoting service: code-white.com/blog/teaching…
Scriptmonkey_ retweeted
📢 New blog post out!
💡 I've been working on this blog for quite some time and I am honored and very happy I was given the opportunity from @alexverboon and @castello_johnny to present this in today's @KqlCafe.
➡️ Windows Linux Subsystem (WSL) by itself is a blind spot within endpoints and can be used to elevate access, build persistence even -as seen in the wild- be used straight from CnC mechanisms and threat actors. The WSL plug-in for Defender for Endpoint sheds light on this blind spot and allows building a monitoring capacity which combined with the rest of Defender XDR and Sentinel ecosystem can further fortify this attack path.
🔗 michalos.net/2024/06/25/keep…
🔗 Accompanied KQL Queries can be found here: github.com/cyb3rmik3/KQL-thr…
🔗 Keep an eye at KQL Cafe and register for future sessions: kqlcafe.github.io/website/
#Microsoft #MicrosoftSecurity #MicrosoftDefender #DefenderXDR #MicrosoftSentinel #KQL #KustoQuery #KustoQueryLanguage #ThreatHunting #DetectionEngineering #KQLCafe
Scriptmonkey_ retweeted
CTF details.
Link below for our awesome Ctf brought to you by our partners @hackrocks_ and @hacktoria.
6 awesome challenges that give you the APIs for our arena, wanna fire our flipper ??? Get registered and crack our awesome challenges @BSidesBSK infosecbattlebots.hackrocks.…
Scriptmonkey_ retweeted
I've made some long awaited updates to SQLRecon! Here's a couple of videos highlighting some of the big additions.
Tool: github.com/xforcered/SQLReco…
Check out this thread ⬇️
Scriptmonkey_ retweeted
Domain Admin credentials delivered across the network to workstations and servers
Scriptmonkey_ retweeted
little under 2 weeks till were at @BSidesCymru
if your there and wanna get involved, either bring your own bot Antweight along or borrow one of our house bots to settle old grudges on the field of battle.
Scriptmonkey_ retweeted
I had been messing with this a while back(2022), so I threw the PoCs and screenshots into a GitHub repo. It's a better way to detect canary tokens than just using a regex for *.canarytokens.org, as it will also help identify other vendors canaries.
github.com/HackingLZ/Indicat…
Scriptmonkey_ retweeted
Slides from mine and @raesene's Container Security Workshop at @AbertayHackers' SecuriTay are available at smarticu5.github.io/talks/Se…. Keen eyed among you will note they're suspiciously similar to the @Steel_Con slides, just cut down for a shorter session.
Scriptmonkey_ retweeted
I published a new @NetSPI blog today that covers the attack surface on the Azure Batch Service and a new MicroBurst function (Get-AzBatchAccountData) to automate sensitive data extraction - netspi.com/blog/technical/cl…
Scriptmonkey_ retweeted
Oof, someone was quick. Our first ticket has been sold and we've only just released the first drop.
Wait.... Read that again.... we've just released the first ticket drop 😀😀😀 Hurry!!!!
eventbrite.co.uk/e/bsides-cy…
#bsides #infosec #bsidescymru