Lover of breaking things | Cybersec researcher with a wide taste in music genres!! https://teapawt.net/t.co/AOHvviQE9r ||| chr°ᶰ1k |||
Ring3 making my way to Ring0
Joined July 2009
- Tweets16.8K
- Following1.6K
- Followers2.4K
- Likes35.6K
Labman retweeted
Coercion BOF via IPP printers 🖨️ Useful for relaying HTTP —> AD CS, LDAP, etc.
GitHub Link: github.com/sudonoodle/BOF-co…
Labman retweeted
Bypassing SMB and LDAP signing with ntlmrelayx 🔥
I added both reauthentication bypasses to Impacket, now merged! Use –reauth-bypass on unpatched systems 🚀
LDAP can also start anonymously where accepted.
Research: blackfield.ch/blog/defeating… and specterops.io/blog/2026/10/2…
Labman retweeted
Spent some time reversing wesp.sys to see how far a SYSTEM process without PPL could get with WESP.
Registration worked. I got ProcessCreate telemetry. A deny update was rejected. A higher-altitude suppressor couldn't blind another client.
s4dbrd.github.io/posts/wesp-…
Labman retweeted
Hello, Little People Living Inside Of My Computer,
I have made my second ever YouTube video briefly discussing the Chinese government trying to compromise companies in Malaysia.
It was fun.
youtu.be/ZcsVsr4rpgs
Labman retweeted
Here's my latest work. We're exploring some alternative means of initial credential access using PDFs and Websockets! Should be a good time 😎
g3tsyst3m.com/initial%20acce…
Labman retweeted
New Kerberos Abuse Path Discovery - Constrained Delegation without Protocol Transition against SPN-less accounts hunio.org/security/abusing-c…
Labman retweeted
Microsoft wants EDR out of the Windows kernel. We checked the binaries
They even come with public symbols. Full write-up from @zodiacon : go.es.io/4zcdL2U
Microsoft's answer is the Windows Endpoint Security Platform (WESP). It's undocumented, but it already ships in Windows Insider builds.
What we found:
• wesp.sys: a Microsoft-built file system mini-filter at altitude 329500
• EspFilterPort: the filter communication port it uses to reach user mode
• espclient.dll: 120 Esp* exports for rules, filters and event queues
Labman retweeted
After you finish patching your PHP, don't forget about the CA compromise from yesterday! Here is a role you can demo it in your lab: github.com/badsectorlabs/lud…
Mint an EV cert for any domain, and code sign any binary! Keep windows off the network - update is aggressive!
Labman retweeted
PHP 8.5.12 released - 90 fixes in 29 components, including security fixes (CVE-2026-109618, CVE-2026-109619).
Changelog + downloads: php-net.pro/news/php-8-5-12-…
Labman retweeted
I used Opus 5.5 on max and GPT-6 Astra for 5 days straight and I reversed engineered Elastic Security and extracted all the rules. I made them available here:
github.com/elastic/detection…
You’re welcome.
Labman retweeted
Just dropped LogonStealer!
Steal plaintext Windows passwords straight from the logon screen.
A rogue Credential Provider that hooks CredProvDataModel.dll inside logonui.exe to steal plaintext passwords at the Windows logon screen
github.com/S12cybersecurity/…
Labman retweeted
Did you know that if you have Entra ID P1 there is a new way to block your stolen refresh token from being replayed by the attacker?
Find out 🧵👇
1/7
Labman retweeted
Added alternatives to OpenProcess, OpenThread and SuspendProcess!
github.com/S12cybersecurity/…
Labman retweeted
I wrote about securing your CI pipelines on GitHub Enterprise without expensive third-party tools.
Own your security, don’t let a tool decide whether you’re secure. Set your own rules 🪂
mpgn.fr/securing-your-ci-on-…
Labman retweeted
SPOTTER now has an easier registration portal and API services entry method during registration, ScoutSuite ingestion, and some screenshots of the UI. github.com/rvrsh3ll/SPOTTER
Labman retweeted
InjectSetConsole performs process code injection by leveraging a Windows named pipe.
Unlike traditional techniques, it does not use the VirtualAllocEx and WriteProcessMemory APIs.
#securityblog #cybersecurity
zerosalarium.com/2026/09/edr…
