@_dirkjan

Hacker at @OutsiderSec. Researches AD and Azure (AD) security. Likes to play around with Python and write tools that make work easier.

dirkjanm.io
Joined December 2017
  • Tweets2.6K
  • Following208
  • Followers30.4K
187Media
I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: dirkjanm.io/obtaining-global…

One Token to rule them all - obtaining Global Admin in every Entra ID tenant via Actor tokens

While preparing for my Black Hat and DEF CON talks in July of this year, I found the most impactful Entra ID vulnerability that I will probably ever find. One that could have allowed me to compromise...

dirkjanm.io
138
899
112
3,173
481,941
Very cool technique to bypass SMB signing, appears to be patched on recent Windows versions.
aas@aas_s3curity21h
I wrote up a way to defeat enforced SMB signing for relay. It abuses a documented SMB re-authentication behavior. I'm surely missing nuance and prior art. Corrections welcome. Writeup: blackfield.ch/blog/defeating… PoC: github.com/aas-n/reauthx

Defeating enforced SMB signing: a note

A documented SMB2/3 re-authentication behavior that keeps a reflected authentication working against a signing-required target.

blackfield.ch
5
40
2,103
I suppose using LoadLibraryA counts as a valid auth coercion technique 😄.
7
27
1
223
11,855
Back on AD security research for a change 😎.
20
5
184
8,771
Friday afternoon (vibe)coding project that was on my to-do for a while: obtaining Entra ID tokens from an endpoint by asking the WAM. This alternative to using the PRT cookie follows the legitimate SSO flow used by apps like Teams to obtain tokens. Code: github.com/dirkjanm/askWAM

GitHub - dirkjanm/askWAM: Ask the Web Account Manager (WAM) for Entra ID tokens

Ask the Web Account Manager (WAM) for Entra ID tokens - dirkjanm/askWAM

github.com
7
76
3
234
18,841
The release contains a .NET Framework, a native and a BOF version that request this token without external dependencies.
1
2
1,510
🔥 What are you bringing to #Entrypoint? New technique? Tool release? Real-world compromise? Deep technical offensive security talk? 🎤 CFP closes 20 September. 📅 19-20 March 2027 | 📍 Paris ➡️ cfp.entrypoint.fr/entrypoint…
1
11
14
2,145
Awesome work by @c3c: cracking netntlmv1 challenge/response in the browser in minutes without having to download and store TBs of tables!
Outflank@OutflankNLSep 8
NetNTLMv1 is dead. Long live NetNTLMv1. 🌈 Today we're releasing NTLMRain: recovering NT hashes from NetNTLMv1 responses. 🌐 Browser-based cracking ⌨️ Cross-platform CLI with GPU/CPU support 💾 Searchable tables that fit on a 4 TB disk Read the blog: outflank.nl/blog/2026/09/08/…
2
22
145
14,606
Also a huge thanks to @Blurbdust for the original tables. Talk for reference: content.burningrivercybercon…

Net-NTLMv1: The Easy Path for Red Teamers

This session explains the project's background, the engineering challenges of building distributed rainbow tables at scale, and the practical implications for pentesters and red teams. Attendees will...

content.burningrivercybercon.com
8
27
2,139
There seems to be some confusion about token theft via Attacker in the middle, so I made this diagram
BleepingComputer
@BleepinComputerSep 7
BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations bleepingcomputer.com/news/se… bleepingcomputer.com/news/se…

BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations

A phishing-as-a-service framework called BigBear 2.0 has been used to bypass multi-factor authentication at 258 organizations and steal more than 5,000 Microsoft 365 credentials.

bleepingcomputer.com
13
17
3
159
22,505
RedTreat day 2 😎
5
3
55
4,420
Spent way too much time figuring out why RDP with a FIDO2 key didn't work. Turns out unlike the WHFB path, using web sign-in for RDP uses a TPM bound (temp, I think) key for TLS. TPM 2.0 up to certain spec versions don't properly implement the required algos for TLS 1.3 signing, breaking it all... And of course the RDP client gives you only a vague error message that maybe your password is expired 🙄
3
7
154
11,195
Unfortunately, the only "fix" for this is to either get a newer TPM, or to disable TLS 1.3 and the schannel algorithms that break RDP on Windows. Neither is great.
1
9
1,676
📢 The next edition of my offensive Entra ID security class just opened up for registration! November 16-19 in The Hague, Netherlands. In this 4 day class we deep dive into Entra ID security, tokens, oauth2 and Conditional Access. More info and reg: events.outsidersecurity.nl/e…

Training: Offensive Entra ID (Azure AD) and Hybrid AD security

Nov. 16 – 19, 2026

events.outsidersecurity.nl
2
17
1
109
7,727
We know attackers are registering devices. They know we know🙃 So they’re getting smarter, and we need to stay one step ahead. @shahardorf & I wrote a new post on how to outsmart them, and it's pretty good! wiz.io/blog/detecting-entra-…

How to Stop AI-Generated Rogue Entra Device Joins | Wiz Blog

Learn how attackers use AI to bypass Entra ID detections with stealthy device names, and the behavioral signals needed to stop them.

wiz.io
3
44
1
143
14,466
Want to run an entire Tailscale daemon from memory inside a C2 implant with zero disk artifacts, no kernel drivers, traffic indistinguishable from HTTPS to a CDN, and relay connections from the victim network back through the tailnet. Now you can. Enjoy! netspi.com/blog/technical-bl…

BOFScale: A CDN-Fronted Tailnet from a BOF-PE

Discover how BOFScale leverages a modified Tailscale daemon compiled as a BOF-PE to seamlessly hide C2 traffic and DERP relays behind CDNs using standard WebSockets.

netspi.com
15
197
11
755
67,921
Weaponising MDM - running a fake MDM server and pwning people as SYSTEM with two clicks (if they have permission to elevate). Poc included. blog.amberwolf.com/blog/2026…

NachoMDM - Weaponising Windows MDM for UAC Bypass and SYSTEM Execution via Malicious Enrollment

AmberWolf Security Research Blog

blog.amberwolf.com
1
23
58
4,250
Dirk-jan retweeted
klez
@KlezVirusAug 14
That’s what surviving a course with Dirk-Jan looks like! An absolutely fantastic instructor teaching some obscure Microsoft Entra ID black magic. Had an absolute blast! 🔥 (And also half an heart attack to survive the jetlag) – at SeaTac, WA
3
1
57
4,781
Today I'm dropping how myself and @Haus3c got admin credentials to every Dataverse/Copilot Studio sandbox in the world! beyondtrust.com/blog/entry/c… Come see the talk at 3:30pm mainstage Track 4 tomorrow.

How Copilot Studio Sandbox Escape Gave Us Admin Access | BeyondTrust

Learn how Phantom Labs escaped the Microsoft Copilot Studio Code Interpreter sandbox, bypassed AI guardrails, and uncovered platform-wide security risks.

beyondtrust.com
1
29
2
54
11,241
Dirk-jan retweeted
Daniel@0x64616eAug 7
The latest roadtx update makes it quite easy to turn device code phishing into passkey registration. The best time to block device code auth in your tenant was yesterday.
Device Code Phishing into Passkey Registration

ALT Device Code Phishing into Passkey Registration

Dirk-jan
@_dirkjanAug 5
✈️ blog to kick off BH/DC week: Borrowing Windows Hello keys for authentication and persistence. dirkjanm.io/borrowing-window…

Borrowing Windows Hello keys for authentication and persistence

Most research into Windows Hello focuses on the mechanics in use when authenticating to the local device. As an Entra ID researcher, I’ve always been more interested in how these keys are used to...

dirkjanm.io
2
6
1
33
4,777
If you're at Black Hat, check out this booth. Probably the only one where they deliver what they say too 😅.
SkelSec@SkelSecAug 5
First time having a booth at @BlackHatEvents and the experience so far is eyeopening. Anyhow, if you are interested in internal network pentest tooling check us out at booth 6312, ppl who understand hacking really loved the demo :)
2
28
5,980
Load more