Jean-Michel Besnard retweeted
Bypassing LDAP signing🔥
Thanks to @snowpeacock, NetExec's enum_cve module now has a check for the patches that fix the LDAP signing bypass.
If the DC isn't patched, even enforcing signing does not prevent a relay.
Link to the blog post by @GrayHatKiller: specterops.io/blog/2026/10/2…
Jean-Michel Besnard retweeted
You Don't Need Mimikatz for DCSync Anymore (SharpDCSync)
Credit/Resource: lsecqt.github.io/Red-Teaming…
If you are in Las Vegas attending #BlackHatUSA do not miss the presentation of #ADMiner this morning by Clément at #Arsenal 10:10am-11:10am ( Arsenal Station 5, Business Hall )
144
AD Miner is coming to Las Vegas for Black Hat USA !
If you are around, meet @snowpeacock on the Arsenal floor tomorrow morning as he will be showcasing #ADMiner #BlackHatUSA
1
3
153
Watched #Canadair firefighting planes scooping water from the #Seine this morning in #Chartrettes, right by my home — heading straight to the massive wildfire ravaging the #Fontainebleau forest. Incredible and heartbreaking to see at the same time. 🔥🌲 #SeineetMarne
1
559
Jean-Michel Besnard retweeted
🚨New podcast episode!
Real life Active Directory attack paths, from real life internal pentests.
We talk:
- how to find them
- how they can be abused
- how to fix them
offsec.blog/episode-186-real…
Le challenge est up : sstic.org/2026/challenge
Jean-Michel Besnard retweeted
🔓 URH-NG is in beta; Universal Radio Hacker, Next Generation -> github.com/PentHertz/urh-ng
327 protocols. 23 automotive ciphers. New Signal Analyzer. New SDR hardware. And it plugs directly into RF Swift.
New Release of AD Miner (v1.9)🚀
This update brings the following:
⚡️ Major engine rework for speed and RAM usage
🛡️ New Entra ID + On-prem controls
📈 Scaled to 1M+ user forests in production
github.com/AD-Security/AD_Mi…
Jean-Michel Besnard retweeted
Think your guest Wi-Fi is isolated from your main network? Think again.
AirSnitch (NDSS'26) breaks client isolation on every router tested: from home APs to enterprise WPA2/3-Enterprise. Full MitM in seconds, sometimes leaking WPA2 traffic in plaintext.
Technique breakdown & tool usage: 🔗 community.penthertz.com/t/ai…
Jean-Michel Besnard retweeted
If you like BloodHound and AD Hacking let me introduce you to BloodBash
No web front end
No neo4j
No complexity
Collect your AD artifacts with Sharphound
Run `BloodBash ./pathToSharphoundOutput`
That's it!
github.com/DotNetRussell/Blo…
Jean-Michel Besnard retweeted
How to mask masks from your cracked passwords with PACK github.com/Hydraze/pack
# Get the passwords from your pot file. For simplicity I skip the HEX passwords (which have a : in them).
awk -F ':' '{print $NF}' ~/.hashcat/hashcat.potfile > /tmp/pot.plain
# Make a CSV file, you can use any plaintext password file as input, like rockyou.
python3 statsgen.py --hiderare --maxlength=14 -o pot.csv /tmp/pot.plain
# Make the mask from the CSV file. pps = passwords per second, you can also leave this out. -t / --targettime is time in seconds, 86400 is 1 day. Minlenght is minimal length you want the masks.
python3 maskgen.py -t 86400 -o pot_min8.hcmask --pps=100000000000 --minlength=8 pot.csv
# You can also generate masks with policygen. Set a policy like minimal 1 special in the masks, max 4 digits and length. The following will create a huge mask file:
python3 policygen.py -o generated_masks.hcmask --minlength=8 --maxlength=12 --mindigit=1 --maxdigit=4 --minlower=1 --minupper=1 --minspecial=1
Jean-Michel Besnard retweeted
🇫🇷🎙️ Nouvel épisode du podcast Hack'n Speak !
On lance une série spéciale de 4 épisodes sur les différents labs AD créés pour @_leHACK_ et @_barbhack_ 🔥
Préparez-vous à plonger dans l'AD ! Le premier épisode sera dédié au workshop LeHack 2024 🛡️
creators.spotify.com/pod/pro…
Jean-Michel Besnard retweeted
🛠️ ADCSDevilCOM: A C# tool for requesting certificates from ADCS using DCOM over SMB.
✅ Remotely request X.509 certificates from CA server using the MS-WCCE protocol over DCOM
github.com/7hePr0fess0r/ADCS…
Jean-Michel Besnard retweeted
If you want to extend #BloodHound a little bit and use it for other stuff such as passwordaudits, choke point detection and remediation tracking, increase your session data again etc, than this one's for you.
luemmelsec.github.io/Whos-a-…
NO OpenGraph extension - sorry fan boys
Jean-Michel Besnard retweeted
Hosts running the WebClient service are prime targets for NTLM relay attacks, and it may be possible to start the service remotely as a low-privileged user.
@0xthirteen breaks down the service startup mechanics, plus the protocols and technologies. ghst.ly/41QT7GW
Jean-Michel Besnard retweeted
dMSA are now supported by impacket (thanks fulc2um!), so its time for badsuccessordumper.py !
github.com/fortra/impacket/p…
Why're we still doing the Impacket thing when @skelsec's stuff is so sick?
gist.github.com/snovvcrash/a…
(just kidding ofc, Impacket is forever in our hearts)
Jean-Michel Besnard retweeted
I publish two blog posts today! 📝🐫
The first dives into how we're improving the way BloodHound models attack paths through AD trusts: specterops.io/blog/2025/06/2…
The second covers an attack technique I came across while exploring AD trust abuse: specterops.io/blog/2025/06/2…

























