@secsven

Advanced Attack Simulation Specialist @ysecurityde - running all sorts of adversary emulations & pentests. https://xitter.cf/t.co/RmM5DE1Gmg

 Essen, Germany
y-security.de
Joined December 2008
  • Tweets773
  • Following499
  • Followers488
64Media
Sven Schlüter retweeted
Y-Security@YSecurityOct 13
Old tech doesn’t mean irrelevant tech. We took a closer look at IBM iSeries and explored how modern security research techniques can be applied to a platform that’s still running in production environments today. y-security.de/news-en/hackin… #CyberSecurity #IBMi #SecurityResearch

Hacking IBM iSeries: How AI Can Be Used to Exploit Proprietary Systems

We used AI to build tools which can exploit proprietary systems from an older era of computing where security was mostly optional.

y-security.de
2
2
28
Sven Schlüter retweeted
Y-Security@YSecurityJan 12
Our security team at @YSecurity has identified multiple vulnerabilities in TIM BPM Suite/TIM FLOW, allowing authorization bypass, privilege escalation, and SQL/HQL injection. Advisory + Mitigation: y-security.de/news-en/tim-bp…

TIM BPM Suite / TIM FLOW - Multiple Vulnerabilities - Y-Security GmbH

Multiple vulnerabilities affecting the TIM BPM Suite & TIM FLOW software by TIM Solutions GmbH.

y-security.de
1
45
Sven Schlüter retweeted
Y-Security@YSecurity20 Jan 2025
Our security team at @YSecurity has identified a vulnerability in AXESS Auto Configuration Server (CVE-2024-56316) which allows unauthenticated remote attackers to trigger a permanent DoS. Advisory + Mitigation: y-security.de/news-de/axess-… #YSecurity #CVE202456316 #TR069 #ACS

AXESS Auto Configuration Server - Denial of Service (CVE-2024-56316) - Y-Security GmbH

The AXESS ACS (Auto Configuration Server) allows remote unauthenticated attackers to cause a permanent Denial of Service (CVE-2024-56316)

y-security.de
3
3
241
Between July 2023 and June 2024, Microsoft observed nation-state threat actors conduct operations for financial gain, enlist cybercriminals to collect intelligence, and make use of the same tools and frameworks favored by cybercriminals: msft.it/6018mf9Sm

Escalating Cyber Threats Demand Stronger Global Defense and Cooperation

Discover the alarming rise in cyber threats, with attacks on Microsoft customers doubling to 600 million per day. The latest Microsoft Digital Defense Report reveals the increasing collusion between...

blogs.microsoft.com
3
101
6
204
27,852
Sven Schlüter retweeted
Phrack Zine@phrack19 Aug 2024
The time has come, and with it your reading material for the week. Phrack #71 is officially released ONLINE! Let us know what you think! phrack.org/issues/71/1.html
table for contents for Phrack 71

ALT table for contents for Phrack 71

14
480
33
1,007
165,775
Sven Schlüter retweeted
Y-Security@YSecurity15 Aug 2024
We have publicly released our internal tool StealthGuardian at Black Hat USA 2024. It can be combined with adversary simulation tools to verify the resistance, detection level and behaviour detection of defence mechanisms. y-security.de/news-en/stealt… #bhusa #blackhat #redteam

StealthGuardian - Automatic TTP Analysis

This August we publicly released StealthGuardian at Black HAT USA 2024 Arsenal.

y-security.de
3
4
172
Based in Germany and looking for a remote role in pentesting and attack simulation? Come join us and let's break things!
Y-Security@YSecurity17 Jun 2024
Are you taking steps towards a career as an Attack Simulation Specialist? Maybe you already have experience as a Penetration Tester or with platforms like Hack The Box or certifications like OSCP? If so, we would love to talk to you! #job #redteam #pentest #germany
Job description for an Attack Simulation Specialist at Y-Security.

ALT Job description for an Attack Simulation Specialist at Y-Security.

2
136
Sven Schlüter retweeted
Y-Security@YSecurity4 Jun 2024
Our tool StealthGuardian has been accepted for Black Hat ARSENAL USA 2024. The Y-Security team will be in Las Vegas to present on protecting Red Team payloads from Blue Teams. y-security.de/news-en/black-… #BlackHat #BHUSA #RedTeam #VegasBaby

Y-Security @ Black Hat ARSENAL USA 2024

The Y-Security team will be at the Black Hat ARSENAL USA 2024 on the 7th and 8th of August 2024 in Las Vegas, USA.

y-security.de
3
6
225
Sven Schlüter retweeted
Dirk-jan
@_dirkjan6 May 2024
New blog: Lateral movement and on-prem NT hash dumping with Microsoft Entra Temporary Access Passes. Some tips and tricks on abusing TAPs for Windows Hello persistence and NT hash recovery over Cloud Kerberos Trust. dirkjanm.io/lateral-movement…

Lateral movement and on-prem NT hash dumping with Microsoft Entra Temporary Access Passes

Temporary Access Passes are a method for Microsoft Entra ID (formerly Azure AD) administrators to configure a temporary password for user accounts, which will also satisfy Multi Factor Authentication...

dirkjanm.io
6
246
7
514
55,080
Sven Schlüter retweeted
Y-Security@YSecurity16 Apr 2024
Our team recently took the challenge of mastering the Red Team Ops I and Red Team Ops II exam offered by @zeropointsecltd . After completion, we received both the Red Team Operator and Red Team Lead certifications. Read our recent post: y-security.de/news-en/red-te… #RedTeam #RTO

Red Team Ops I & II Review

This spring we challenged ourselves by completing both Red Team certifications by Zero Point Security.

y-security.de
2
6
148
Sven Schlüter retweeted
Y-Security@YSecurity13 Mar 2024
Recently we checked the security of a LoRaWAN implementation. In our latest post we share insights about the security of LoRaWAN, common LoRaWAN attacks and how we built a custom methodology and testing environment. y-security.de/news-en/securi… #pentest #lorawan #ysecurity

From Concept to Creation: Checking The Security Of LoRaWAN Implementations

In this post we describe the process of creating a tailored LoRaWAN Penetration Testing environment.

y-security.de
1
1
106
Polyglot template injection payloads here are pretty cool.
Hackmanit@hackmanit14 Feb 2024
Template engines are very popular in web applications. A severe threat posing a risk for the application, its data, and its users: Template Injection Vulnerabilities Detect them – manually and automatically: Blog 🌐hackmanit.de/en/blog-en/178-… Tool 🛠️ hackmanit.de/en/penetrationt…
Tinja – Template Injection Analyzer by Hackmanit

ALT Tinja – Template Injection Analyzer by Hackmanit

1
183
We started to play with censorship circumventions. Of course, we exploit our TLS skills to bypass big firewalls. In our first work, @JonSnowWhite2 shows that TLS record fragmentation is a useful technique to bypass the Great Firewall of China (GFW). upb-syssec.github.io/blog/20…
3
5
13
1,487
Sven Schlüter retweeted
Y-Security@YSecurity14 Jun 2023
Check out our blog post by Thore on our Mobile Application Testing service utilizing Apple Silicon. y-security.de/news-en/mobile… #pentest #mobile #jailbreak #apple #ios #testing #m1 #ysecurity

Mobile Application Testing on Apple Silicon

In this blog post, we will show how to perform Mobile Application Test on Apple Silicon as an alternative to jailbroken iPhones.

y-security.de
4
4
605
This Post is from a suspended account. Learn more
3
224
Classified documents are being distributed publicly from your servers.
2
12
1
53
12,541
Sven Schlüter retweeted
Chris@0xchrisb12 Apr 2023
Have you ever wondered how to start #AWS penetration testing? We have published AWS penetration testing: A step-by-step guide at the @hackthebox_eu website: hackthebox.com/blog/aws-pent… #HTB #BugBounty #Y #Security #Cloud

AWS penetration testing: A step-by-step guide

Looking to learn AWS penetration testing? Here are essential AWS pentesting techniques and tools to help you get started!

hackthebox.com
4
2
249
Sven Schlüter retweeted
Aura@SecurityAura28 Mar 2023
How do you like being blind for a whole day despite having an EDR because... the EDR is doing a maintenance? For TA, this is the time to strike Carbon Black Cloud customers I guess 🙃 status.carbonblack.com/incid…
4
8
36
10,136
Great experience using and abusing @hackthebox_eu Blizzard Lab. #htb #oldmanyellingatcloud #blizzard #blacksky
Y-Security@YSecurity16 Mar 2023
Replying to @hackthebox_eu
@hackthebox_eu's BlackSky Cloud Hacking Labs doesn't only include AWS and Azure, but also Google Cloud Platform. Read @secsven's feedback and insights on the Blizzard Lab y-security.de/news-en/hack-t… #HackTheBox #BlackSky #Cloud #GCP #Blizzard #BugBounty #htb #pentest #Y

Hack The Box BlackSky Cloud Hacking Labs - Blizzard

Read more about our feedback on the Hack The Box BlackSky Cloud Hacking Labs scenario for Google Cloud Platform aka Blizzard.

y-security.de
1
1
223
Sven Schlüter retweeted
Y-Security@YSecurity28 Feb 2023
We recently collaborated with @hackthebox_eu and took the challenge of reviewing their BlackSky Cloud Hacking Labs. Read about @0xchrisb's feedback and insights into the Hailstorm scenario at y-security.de/news-en/hack-t… #Y #HackTheBox #Cloud #AWS #Hailstorm #BugBounty

Hack The Box BlackSky Cloud Hacking Labs - Hailstorm

Read more about our feedback on the Hack The Box BlackSky Cloud Hacking Labs scenario for Amazon Web Services aka Hailstorm.

y-security.de
1
1
3
571
Load more