Bilal retweeted
I've been seeing posts all over about the state of CTFs post-LLM. I've seen many attempts to explain why this is just a new evolution of CTFs, but I fundamentally disagree. I believe the original spirit is gone and I've written why in my blog.
kabir.au/blog/the-ctf-scene-…
Bilal retweeted
Alhamdulillah! Successfully conducted training class for the @FIRSTdotOrg conference in #Tashkent, #Uzbekistan 🇺🇿! Happy to meet my friends and colleagues in person
You are true professionals!
#hacking #conference #research #malware #purpleteam #threatintel #maldev #programming
Bilal retweeted
A small rant:
The State of Art in Red Team is whatever you want to believe
x-c3ll.github.io/posts/Rant-…
[Defeating Jiagu Android packer the wrong way]
While testing an APK, i found that it was packed using Jiagu. This article serves as a quick documentation on how i unpack it the wrong way
Article: medium.com/@0xcc00/defeating…
1
219
Bilal retweeted
She was in international waters and then kidnapped by Israel. Where are those "don't tread on me" guys at?
Bilal retweeted
Many are asking if they can move their Next.js projects from Vercel to Replit?
Yes!
- Go to Import then GitHub
- enter repo URL
- Agent will take care of the rest
It will set up the dev and deployment environments!
For companies moving lots of work, happy to help + discount.
Bilal retweeted
AdaptixC2 v0.9 is out!
github.com/Adaptix-Framework…
* New dock-based client
* Public Web-API
* New BOFs in Extension-Kit
Full changelog: adaptix-framework.gitbook.io…
Bilal retweeted
Israel murders five journalists in targeted airstrike in Gaza.
Al Jazeera journalists Anas al-Sharif and Mohammed Qreiqea, and camera operators Ibrahim Zaher, Mohammed Noufal, and Moamen Aliwa have been killed in a targeted Israeli airstrike.
Two weeks ago, UN Special Rapporteur Irene Khan warned that Israeli threats and smear campaigns were “a blatant attempt to endanger [Al-Sharif’s] life and silence his reporting on the genocide in Gaza.”
In July, the Committee to Protect Journalists said it was gravely concerned for his safety, warning he was being “targeted by an Israeli military smear campaign.”
Shortly before the strike, al-Sharif posted to X: “Non-stop bombing...For two hours now, the Israeli aggression has been intensifying on Gaza City.”
Well over 200 journalists and media workers have been killed in Gaza since October 2023.
Bilal retweeted
As Alex stated, it doesn't actually "read" the file in that way, but I do think this should be easy enough for vendors to build detections for based on raw disk reading alone. I tested this with a top 5 EDR and it did not alert, even with dumping the extracted files to disk..
You can now even dump LSA/SAM hashes from normal Windows machines using -o TARGET flag.
Dumping the NTDS.dit from disk - A new NetExec module💾
Isn't it super annoying when AV blocks your access to the SAM/SYSTEM hives?
The new "ntds_dump_raw" module made by @0xcc00 parses the disk image directly, allowing you to extract the NTDS.dit or SAM database🚀
ALT Dumping the NTDS.dit and SAM database directly from disk
My module “ntds_dump_raw” is now out in NetExec🔥
Can’t wait for your feedback.
Dumping the NTDS.dit from disk - A new NetExec module💾
Isn't it super annoying when AV blocks your access to the SAM/SYSTEM hives?
The new "ntds_dump_raw" module made by @0xcc00 parses the disk image directly, allowing you to extract the NTDS.dit or SAM database🚀
ALT Dumping the NTDS.dit and SAM database directly from disk
1
20
1,311
Bilal retweeted
“I want to eat because I haven’t eaten for five days”
Don’t ignore her voice.
she’s still hungry!
I've been playing with MCP, Releasing AdaptixC2_mcp a PoC that exposes Adaptix-C2 APIs to gemini-cli, enabling it to control a beacon and to simulate a threat actor behavior.
Code: github.com/0xb11a1/AdaptixC2…
Bilal retweeted
Drama++
The United States government is using a fork of Signal called "TM SGNL". TM SGNL is (likely) produced by an Israeli firm (Smarsh) which is (or related to in some capacity) the Israel Defense Forces' Intelligence unit. Although these claims are based on self-described biographies of the creators of TM SGNL and publicly available information. Various journalists and media outlets have reported differently.
TM SGNL is a part of the Smarsh communication suite called TeleMessage hence TeleMessage Signal.
TM SGNL is not publicly available for download.
TM SGNL source code was leaked online May 3rd when an anonymous source tipped journalist Micah Flee about TM SGNL being available for download ... by accident. Smarsh left the source code to their application exposed because they used WordPress and misconfigured directory permissions which looked like so:
/wp-content/uploads/2024/12/Signal-iOS-main.zip
/wp-content/uploads/2024/12/Signal.zip
Journalist Micah Flee has made the source code available on GitHub. The source code also includes hardcoded credentials (and got knows what else)
You can read more about the leak, the contents of the leak, and you can find the link to the source code in the attached article below.
Bilal retweeted
THIS SCHOOL WAS BOMBED TODAY BY lSRAEL
AT LEAST 30 PALESTINIANS KILLED MOST OF THEM ARE CHILDREN.
Bilal retweeted
Inspired by @0xcc00, writing a quick and dirty program to extract files directly from a NTFS volume was a great way to continue learning Nim.
It's very much a POC. Here's the link: github.com/Fudgedotdotdot/re…
New quick article, Hiding behind the library line - Go malware development
It's about exploring a technique of hiding your malicious code inside Go libraries to mislead analysts and reverse engineers.
link: medium.com/@0xcc00/hiding-be…
Bilal retweeted
Bypassing EDR NTDS.dit protection using BlueTeam tools - @0xcc00
medium.com/@0xcc00/bypassing…
