
Red/Purple/Research | Adversary Services @xforce red | ✞
The Land of Pleasant Living
Joined August 2017
- Tweets8K
- Following489
- Followers15K
- Likes13.8K
Pinned Tweet
[Blog] Abusing .NET Core CLR Diagnostic Features (+ CVE-2023-33127)
- Analysis of .NET diagnostic features and tradecraft
- Walkthrough of a .NET Cross-Session Local Priv Esc (LPE)
- Defensive Recommendations
bohops.com/2023/11/27/abusin…
bohops retweeted
New talk up OAIC 2026: Vibe Fuzzing with Sam Lovejoy @_dinolover38 of IBM X-Force Offensive Research.
Sam explores how graph-based inputs, program state, and LLM guidance come together in an AI-guided fuzzing engine- and the tradeoffs behind it.
Watch the full talk: offensiveaicon.com/vibe-fuzz…
#OAIC #OffensiveAI #Fuzzing
bohops retweeted
Reposting because it’s good (you might have seen this before but it gets updated)
”UltimateWDACBypassListPublic
A centralized resource for previously documented WDAC bypass techniques”
Author: @bohops
This is quite the sanctimonious line from inside the building.
However, I do agree with the advice to get help and leadership buy-in to address the basics. Hygiene has never been more important in cyber, and it will still be important in 18 months.
bohops retweeted
🦛🦛🦛Microsoft patched PetitPotam this October: EFSR now only resolves local paths. This means WebDAV to LDAP Coercion is fixed!
Remaining methods for clients are WSP (coercing SMB) and PrinterBug (coercing RPC), but both cannot be relayed to LDAP 💀💀💀
bohops retweeted
We're hiring a Principal Security Research Engineer (AI Security)! Looking for someone with a strong background in threat research, detection & offensive security, and a passion for detecting and preventing AI threats.
Apply here: tinyurl.com/2pd2u8sr
bohops retweeted
The context behind such tweets is that the AI companies are rejecting 40 years of cybersecurity knowledge. They are ignorant of cybersecurity and are trying to re-invent it from scratch, repeating the mistakes of bad people from 40 years ago.
Glad to see the Ravens finish strong despite early woes. Game balls for King Henry, Huntley, and Hamilton. #RavensFlock
bohops retweeted
Sometimes in the debates about AD vs Entra it is forgotten that what does and doesn't get added to both is decided by Microsoft based on its own commercial interests.
There's no law that says AD can't have X or Y.
And it's not decided by customers or markets.
bohops retweeted
It’s fun watching companies build paid pentest automation on top of open source tools and research, and give nothing back to the community they’re built on.
Historically, this space has been pretty good about crediting the original researchers and contributing back. That seems to be slipping as everyone tries to productize it.
The pullback in community contributions over the last couple of years is pretty obvious. I’m not sure many people realize what their R&D costs will look like if that continues, even with AI.
bohops retweeted
🔥 The first Three Buddy Problem from Offensive AI Con is live! Audio only.
IBM X-Force’s Valentina Palmiotti (@chompie1337) walks us through the autonomous Windows kernel exploit pipeline she built on older Claude models, which landed within a hair of Mythos for about $180 a chain.
Plus, the Pwn2Own bug Claude called unexploitable, why her Pwn2Own bugs still sit unpatched, disappearing exploit techniques, the dread of being a defender, and how Phrack found its way back into print.
open.spotify.com/episode/2wE…
bohops retweeted
vf3 (very fast fun vibe fuzzer) designed by @_dinolover38 is faster than Jackalope and libprotobuf-mutator 😳 🏃🏻♂️🔥 #OAIC
bohops retweeted
Thank you to @UnpromptedAU & @BSidesCbr for inviting me to speak. Being back down under was lovely! You can find the slides for my n-day automated pipeline talk here. I’m at OAIC this week if you want to chat about exploit dev in 2026 and beyond. beautiful.ai/player/-P2q0r-B…
bohops retweeted
I've been waiting a long time to write this.
@RemoteThreat is officially out of stealth.
For more than 20 years Chris Thompson (@retBandit) and I have worked across cybersecurity, centered on offensive security, red teaming, and building capabilities for operators.
Over that time, we have watched offensive security become incredibly capable, but increasingly fragmented. Tools, infrastructure, workflows, and operational data living across different systems—with the operator left to connect the dots. When we started RemoteThreat, we believed AI was going to fundamentally change how cyber operations are conducted. But we also believed AI alone wasn't enough.
We saw an opportunity to bring the entire operational ecosystem together, connecting capabilities, execution, infrastructure, and data into one operational picture—and giving AI the context to understand what’s happening and act on it. We also wanted to give operators the flexibility to match the platform to the mission—moving quickly when speed matters or dialing up sophistication when the operation demands it.
The result is a platform designed to help operators make better decisions, reduce cognitive load and mistakes, adapt as the operation changes, and help determine what should happen next.
From planning through execution and analysis. Start to finish. One platform.
Cyber operations for a new era.
That's the vision behind RemoteThreat.
Human expertise. Machine capability. Mission speed.
But as proud as I am of what we are building, I'm even more proud of who we're building it with.
One thing you'll hear me say constantly:
"Team beats individual every time."
Chris and I have been incredibly fortunate to assemble a group of people who believe in what we're building, push each other, and genuinely want to build something that can redefine what's possible in cyber operations.
And our team today is only the beginning.
To our team, families, investors, customers, design partners, and everyone who believed in us while we were building quietly—thank you.
We're done building in the shadows.
RemoteThreat is here.
And we're just getting started.
lnkd.in/gDY55WXj
























