Let’s get right! Tweets are my own.
Joined February 2013
- Tweets5.6K
- Following1.1K
- Followers213
- Likes2.2K
Anthropic’s whole take with safeguards and even the newly expanded CVP are severely out of whack. I’ve provided enough feedback. Cancelled. Enough fighting with tools when there are options out there.
Rick retweeted
NTLM relays failing because of EPA? 😒
@zyn3rgy & @Tw1sm break down how to enumerate EPA settings across more protocols + drop new tooling (RelayInformer) to make relays predictable.
Check out their blog for more: ghst.ly/4rqwpRs
Rick retweeted
Forgot to put the repo in the blog, my bad
github.com/garrettfoster13/C…
SCCM’s AdminService uses Entra tokens without confirming the UPN exists in AD. A crafted synced UPN can let an attacker impersonate the site server. Microsoft now requires on-prem SID matching (CVE-2025-59501).
Great deep dive by @unsigned_sh0rt!
ghst.ly/43wTzLx
Rick retweeted
I'm really excited to share my first research article related to hacking Google Gemini!
buganizer.cc/hacking-gemini-…
#bugSWAT #GoogleVRP
Rick retweeted
AdminSDHolder: the AD security feature everyone thinks they understand but probably don't. 😬
@JimSycurity went to the source code to debunk decades of misconceptions — including ones in Microsoft's own docs.
Read more ⤵️
ghst.ly/3Lpmjzv
Rick retweeted
A DNS takeover is not the same as a subdomain takeover.
DNS takeovers have become a popular but often misunderstood vulnerability.
In this blog, you will learn:
✅ The difference between a DNS and subdomain takeover: A subdomain takeover exploits a service a domain points to, while a DNS takeover gives the attacker full control over the DNS server itself, which is more severe.
✅ How to spot a vulnerable domain: Learn the two key criteria for detecting a DNS takeover, including looking for a SERVFAIL or REFUSED status and identifying a domain's authoritative nameservers.
✅ How to take control of a domain: The blog walks you through the process, from finding vulnerable DNS providers to the steps needed to claim a domain.
✅ Automated Detection: Discover how to use tools like Nuclei with specific templates to automate the detection of domains that are potentially vulnerable to a DNS takeover.
Want to master DNS takeovers and learn how to defend against them?
Read the full article for a complete guide.👇
projectdiscovery.io/blog/gui…
Rick retweeted
Credential Guard was supposed to end credential dumping. It didn't.
@bytewreck just dropped a new blog post detailing techniques for extracting credentials on fully patched Windows 11 & Server 2025 with modern protections enabled.
Read for more ⤵️ ghst.ly/4qtl2rm
Rick retweeted
Redirect any Windows TCP and UDP traffic to HTTP/Socks5 proxy github.com/InterceptSuite/Pr…
Rick retweeted
In this post, I cover the DCOM objects in the dcomexec.py , how to fix some issues, and how to bypass Defender for MMC20.
I plan to publish part two soon, focusing on new DCOM objects I discovered time ago that can be used for lateral movement
sud0ru.ghost.io/yet-another-…
Rick retweeted
Last year, I put together a @WEareTROOPERS talk I called "A Decade of Active Directory Attacks:
What We've Learned & What's Next". I created an article to capture this history.
The History of Active Directory Security:
adsecurity.org/?p=4706
This ADSecurity article includes more content than what I had in my slides and now includes attack techniques & tools from the year 2000 to the present day relevant to Active Directory security.
I tried to capture the most important and impactful elements of Active Directory Security, primarily the offensive side, but also some defensive elements as well.
#ActiveDirectorySecurity #ActiveDirectorySecurityHistory
Rick retweeted
Finally releasing Sekken-Enum, an ADWS enumeration BOF we've been using internally for a while now.
Based on the research from SOAPHound/SoaPy moving away from relying on .NET execution or proxying.
Output works with BOFHound for Bloodhound ingesting.
github.com/Nomad0x7/sekken-e…
Rick retweeted
SockTail - a small binary that joins a device to a Tailscale network and exposes a local SOCKS5 proxy on port 1080. It's meant for red team operations where you need network access into a target system without setting up port forwards or noisy tunnels. github.com/Yeeb1/SockTail
Rick retweeted
Lateral movement getting blocked by traditional methods?
@werdhaihai just dropped research on a new lateral movement technique using Windows Installer Custom Action Server, complete with working BOF code. ghst.ly/4pN03PG
Rick retweeted
🛠️ Stop running Subfinder, Nuclei, HTTPX “out of the box.”
In this walkthrough with @NahamSec, we:
• Build a VPS recon box
• Install & manage all PD tools w/ Go installer
• Chain Subfinder → AlterX → DNSX → Naboo → HTTPX → Katana
• Move from automation → methodology
Watch 👉 youtube.com/watch?v=evyxNUzl…
#BugBounty #AppSec #Recon
Rick retweeted
🆓 FREE Windows API module now available!
Learn Windows program fundamentals - perfect for beginners.
• Hands-on debugging with real examples
• Web based: no downloads, installs, or VMs
Start reversing here 👇
#ReverseEngineering #Malware
aceresponder.com/challenge/w…
Rick retweeted
Cracking Windows Kernel with HackSys Extreme Vulnerable Driver. Where do I start?
TLDR; a blog about windows kernel exploitation.
mdanilor.github.io/posts/hev…
ALT setup the debug env
Rick retweeted
Win32_Process has been the go to WMI class for remote command execution for years.
@0xthirteen explores a new WMI class that functions like Win32_Process and offers further capability. Read more ⤵️ ghst.ly/4gyPbkr
