POC || GTFO Red Teaming - @NetSPI Organiser - @BSidesTirana @AxiomBreach
Joined March 2015
- Tweets4.4K
- Following1.4K
- Followers6.7K
- Likes10.2K
Rio retweeted
We’re proud to join Bits & Pretzels as a Startup Exhibitor!
Part of the Grant 2026 Project, supported by Startup Albania & the Ministry of Economy and Innovation.
📍Munich | September 29
See you there!
#BitsAndPretzels #AxiomBreach
Rio retweeted
Want to run an entire Tailscale daemon from memory inside a C2 implant with zero disk artifacts, no kernel drivers, traffic indistinguishable from HTTPS to a CDN, and relay connections from the victim network back through the tailnet.
Now you can. Enjoy!
netspi.com/blog/technical-bl…
Rio retweeted
I’m excited to announce that OdinEye is now in public beta! Thanks to everyone who has tested it out so far.
I’m building OdinEye with one mission, to provide a definitive answer to the question "Is this computer compromised?"
Launch it from a one-liner and visualise the scan in real-time in your browser. No install, no setup.
Join the beta at odineye.io
Rio retweeted
Cookie theft got harder. Browser hijacking didn't.
@KingOfTheNOPs shows how enabling the Chrome DevTools Protocol inside a live Chrome/Edge process can bypass modern cookie protections, plus how to detect it with Sysmon.
Check it out! ⤵️ ghst.ly/461sfpi
Rio retweeted
Bluehammer
Privilege escalation via Microsoft Defender. No patch yet
github.com/Nightmare-Eclipse…
#0day #lpe
Rio retweeted
Today we reveal StackWarp: a new CPU vulnerability exploiting a synchronization bug in AMD’s stack engine across Zen 1–5 CPUs. It enables deterministic manipulation of Confidential VM's stack pointer, allowing RCE and privilege escalation via both control- and data-flow hijacking
Rio retweeted
Just released a new @SpecterOps blog! I discovered that during client push in SCCM env's it's possible to remotely start WebClient and coerce HTTP from site servers for a relay to LDAP resulting in hierarchy takeover when WebClient is installed! 🫠
specterops.io/blog/2026/01/1…
Rio retweeted
We hacked the AWS JavaScript SDK, a core library powering the entire @AWScloud ecosystem - including the AWS Console itself 🤯
How did we do it? Just two missing characters was all it took.
This is the story of #CodeBreach 🧵👇
Rio retweeted
.@trailofbits released our first batch of Claude Skills. Official announcement coming later.
github.com/trailofbits/skill…
Rio retweeted
Today we are disclosing the details of CVE-2025-64155, an unauth argument injection leading to root remote code execution affecting the Fortinet FortiSIEM.
Find the technical details, indicators of compromise, and proof-of-concept exploit in the blog.
horizon3.ai/attack-research/…
Rio retweeted
I wrote up a little post about OPSEC and how to learn from other people’s failures.
buttondown.com/grugq/archive…
#OPSEC
Rio retweeted
My research regarding .NET Framework HTTP client proxies and WSDL imports just dropped.
Long story short: those proxies can be forced to write HTTP body to the local files, instead of sending them over HTTP. Leads to shells 😅
Today, we’re releasing watchTowr Labs’ @chudyPB’s BlackHat .NET research, owning Barracuda, Ivanti and more solutions.
Enjoy the read as Piotr explains a new .NET Framework primitive, used to achieve pre- and post-auth RCE on numerous enterprise appliances.
labs.watchtowr.com/soapwn-pw…
Rio retweeted
My very first blog post is live: kiddo-pwn.github.io/blog/202…
During research, I've run into and documented a simple universal SQLite Injection RCE trick. Enjoy!
N-day Analysis about Synology Beestation RCE (CVE-2024-50629~50631) by legendary DEVCORE 🎃 🍊
Thanks to @u1f383 @orange_8361 for original finding and allowing to post, and to @the_emmons for the invaluable references 🔥
Enjoy the Demo!
PoC: github.com/kiddo-pwn/CVE-202…
Rio retweeted
listen up!!! the one and only @chudyPB will be givin a jaw droppin research at blackhat soon! once again pushin the .NET Exploitation scene 👑
you don't wanna miss this one
In #BHEU Briefings: SOAPwn – Pwning .NET Framework Apps via HTTP Client Proxies & WSDL discover how attackers exploit SOAP services and .NET frameworks🔐. What if we told you that HTTP client proxies are fundamentally broken?
Learn more 👉 bit.ly/48fzT0b
Rio retweeted
🔥Fire research by the team! Great talk on compromising cloud AI providers via a GPU kernel 0day by Valentina Palmiotti (@chompie1337) & Samuel Lovejoy (@_dinolover38)
youtube.com/watch?v=Lvz2_ZHj…
Rio retweeted
New blog post is up exploring a vuln I found in Claude Code (CVE-2025-64755) allowing arbitrary file write without a consent prompt. New tech is always fun to explore, hopefully this post gives you some hints as to future research :) specterops.io/blog/2025/11/2…
Rio retweeted
Brand-new admin protection bypasses by @tiraniddo As usual, awesome work! 💪💪💪
project-zero.issues.chromium… and project-zero.issues.chromium…
Rio retweeted
🚨8 months after public disclosure, @RHEL @AlmaLinux @rocky_linux are still vulnerable for a Ghostscript RCE with a reliable public exploit (CVE-2025-27835 and others)! It can be triggered by opening LibreOffice docs or through a server that uses ImageMagick for file conversion!
Rio retweeted
RPC Part 6 is live. I cover the toolset for external RPC research, demonstrate how to enumerate network interfaces without authentication using rpcmap, and show how to call custom RPC functions with Impacket to help develop an external fuzzer.
sud0ru.ghost.io/windows-inte…
