DFIR and Adversary Simulation | All posts reflect the views and interests of the person behind this account only |
USA
Joined May 2011
- Tweets22.3K
- Following575
- Followers35.3K
- Likes97.9K
Ali Hadi | B!n@ry retweeted
🚀 Every great digital forensic investigator starts somewhere.
You don't need to know everything to take your first step. You need the right foundations and a willingness to learn.
CYBER 5W offers two certifications to help you build your digital forensics fundamentals:
🔎 CDFF — Certified Digital Forensics Foundations: Test your understanding of forensic fundamentals, evidence acquisition, file systems, timestamp analysis, and reporting.
🛡️ CCEH — Certified Digital Forensics Evidence Handler: Demonstrate your knowledge of evidence handling and acquisition through theoretical and practical assessment.
Whether you're starting your DFIR journey or strengthening your fundamentals, there's a place to begin.
🎯 Explore the exams:
academy.cyber5w.com/collecti…
Start building your skills today.
#Cyber5W #CDFF #CCEH #DigitalForensics #DFIR #CyberSecurity
Ali Hadi | B!n@ry retweeted
Week 43 - 2026 #DFIR
thisweekin4n6.com/2026/10/25…
Ali Hadi | B!n@ry retweeted
‼️ ok, this might be the first publicly documented, validated PHP2Shell RCE in the wild.
my agent did the analysis, published here: github.com/0x4D31/honeypot-d…
Ali Hadi | B!n@ry retweeted
1/ EZ Tools 2026.10 is out, all on .NET 10 (LTS)
✅ More accurate: 331K more event log records, hive logs replayed as Windows does, every test hive loads
⚡ Faster: up to 9x; EvtxECmd and Registry 2x
📉 Less memory: up to 82% less
Update with Get-ZimmermanTools 🧵 #DFIR
Ali Hadi | B!n@ry retweeted
Finding an artifact isn't the same as investigating a case.
Join Brett Shavers for a FREE live session examining how he develops questions, tests hypotheses, evaluates evidence, and makes investigative decisions in a real, ongoing case.
Oct 28 | 3:30 PM MT
suspectbehindthekeyboard.com…
Ali Hadi | B!n@ry retweeted
Exploiting Reversing (ER) Series | Article 11: Windows: Missing Bounds in the Print Spooler.
The article has 60 pages, free. A user-mode target this time instead of a kernel one, worked end to end: from a missing bound check to a SYSTEM shell, with the service still running afterwards.
Published on:
blackstormsecurity.com/resea…
What it covers:
[+] The bug: a heap overflow (CWE-122) in the Print Spooler's form-enumeration path, reached
through InternalEnumForms → CopyIniFormToFormInfo → PackStrings → memcpy.
[+] It is still unpatched. I submitted it to Microsoft in March 2026 and MSRC assessed it as below the bar for
immediate servicing, because the PoC requires administrative rights. Re-confirmed working in October against current mainstream and Canary builds.
[+] The exploitation, which is two thirds of the article, with four stages: groom, corrupt, control, execute. The process never crashes: spoolsv.exe is left running and the planted form deleted.
[+] Important note: I had already notified the MSRC months ago that I would write an article about the vulnerability and publish it.
I would like to thank Ilfak Guilfanov ( @ilfak ) and Hex-Rays SA ( @HexRaysSA ) for the continuous
support.
This article will be published on exploitreversing.com/ next week.
Hope you enjoy the read!
#Windows #PrintSpooler #VulnerabilityResearch #ExploitDevelopment #ReverseEngineering #HeapExploitation
Ali Hadi | B!n@ry retweeted
Two very useful posts on monitoring and hardening PHP services, plus an Nmap command to help find them in your environment:
1. Discovery with Nmap
Common and alternative web ports; HTTP headers that may expose PHP versions:
nmap -sT -sV --version-light -T4 --max-retries 1 --open -p 80,81,443,8000-8010,8080-8090,8181,8443,8880,8888,9000,9001,9080,9090,9443 --script http-headers --script-timeout 10s --script-args 'http-headers.path=/index.php,http-headers.useget=true' <target>
Look for X-Powered-By: PHP/.... Fast inventory check; hidden PHP deployments can be missed, and version banners don’t confirm vulnerability.
2. Huntress: Monitoring and detection
• Confirmed facts and remaining questions
• Suspicious PHP child processes, shells and downloaders
• Webshells and other post-exploitation activity
• My process-watcher for Linux process visibility
huntress.com/blog/php2shell-…
3. Vincent Schmalbach: Hardening and patching
• Temporary nginx/Apache filters and upload-progress settings
• WAF/origin bypass checks
• Package and backport verification
• PHP-FPM/worker restarts, container rebuilds
• Side effects and checks for compromise
vincentschmalbach.com/cve-20…
Temporary measures are stopgaps. Prepare to apply the official fixes as soon as available.
Ali Hadi | B!n@ry retweeted
An enterprise environment emits billions of log events every day. During an incident, the responder rarely needs all of them. They need the few hundred or thousands that tell the story: the burst of 4625 failures followed by a single 4624 success, the encoded PowerShell spawned by winword.exe, the new service installed at 03:12 on a domain controller. Logs analysis is the discipline of getting from the first number to the second fast enough to matter.
That job has become harder in two directions at once. Attackers using AI tooling generate evidence at machine speed and pad real actions with benign-looking activity. Meanwhile, the obvious shortcut of pushing logs into an LLM runs into guardrails, context-window limits and data-protection obligations. Hugging Face’s responders hit exactly that wall in July 2026, when roughly 17,000 , later to be claimed 3 billion events (still healthy daily workload) were refused by frontier models and had to be processed on a local model instead.
Below, we cover log analysis end to end, then look at LogTotal, SOC Prime’s free answer to the incident-time version of the problem. socprime.com/blog/log-analys…
Ali Hadi | B!n@ry retweeted
Week 41 - 2026 #DFIR
thisweekin4n6.com/2026/10/11…
Ali Hadi | B!n@ry retweeted
As I promised, Exploiting Reversing (ER) series: article 10 | iOS Security Research (part 01) is available on my blog now:
exploitreversing.com/2026/10…
The primary source for new articles is blackstormsecurity.com/resea…, but articles will continue to be published on my blog with a one-week delay.
Enjoy the reading and have an excellent day.
#iOS #VulnerabilityResearch #ExploitDevelopment #ReverseEngineering #KernelSecurity
Ali Hadi | B!n@ry retweeted
I'll be giving a webinar on Linux threats and going over our awesome new Sandfly 6.0 release. Check it out below and sign up to be the first to see what we have coming. We will be dropping massive threat detection upgrades that will be sending intruders running for cover!
Most Linux alerts aren't worth your time. A few are worth everything 👀
The hard part is telling which is which.
On Tue 27 Oct, Sandfly founder Craig Rowland shares 4 questions to ask before you act on any detection. Free.
ap1.hubs.ly/H01qdRl0
Ali Hadi | B!n@ry retweeted
Week 40 - 2026 #DFIR
thisweekin4n6.com/2026/10/04…
Ali Hadi | B!n@ry retweeted
Found Kevin S.' XWF (beta) X-Tension to load .DMG files!
github.com/kev365/xways-imag…
Ali Hadi | B!n@ry retweeted
Exploiting Reversing (ER) Series | Article 10: iOS Security Research (part 01)
223 pages, free. The first article in the series aimed at iOS itself, and the opening of a multi-part sequence.
Published on:
blackstormsecurity.com/resea…
This article will be published on exploitreversing.com/ next week.
I would like to thank Ilfak Guilfanov (@ilfak) and Hex-Rays SA (@HexRaysSA) for the continuous support.
Hope you enjoy the read!
#iOS #Apple #VulnerabilityResearch #ExploitDevelopment #ReverseEngineering
Ali Hadi | B!n@ry retweeted
A cool CTI project that attempts to reconstruct the "good old" ranking algorithm of Google from the 2000s - top1m.org/ - link in your agent for a fresh daily batch of ranked domains, hostnames and IPs. From @stefant
Ali Hadi | B!n@ry retweeted
* My shell script to collect data from compromised NetScalers (timelines, core dumps, etc.):
github.com/msuhanov/easy_tri…
* My NSE script to fingerprint the NetScaler TCP stack:
github.com/msuhanov/nse/blob…
Ali Hadi | B!n@ry retweeted
Week 39 - 2026 #DFIR
thisweekin4n6.com/2026/09/27…
Ali Hadi | B!n@ry retweeted
Check out the first draft of our guide "Using Windows x64 to Build IntelWinFE with AIM Remote Agent" & please let us know if you have any suggestions! ArsenalRecon.com #DFIR
Ali Hadi | B!n@ry retweeted
ARMWinFE & AIM Remote Agent in action!
Have you considered building WinFE on Arm (a/k/a ARMWinFE) or perhaps tried, but were unsuccessful? Check out the first draft of our guide "Using Windows x64 to Build ARMWinFE with AIM Remote Agent." ArsenalRecon.com #DFIR
Ali Hadi | B!n@ry retweeted
Ever remediated the ScreenConnect implant your alert fired on and moved on?
A real sample dropped two, 9 min apart. The second, self-hosted one (wonderxp[.]top:8041) shipped its own app.config:
- AccessShowUnderControlBanner = false
- AccessShowBalloonOnConnect = false
- AccessShowSystemTrayIcon = false
Every "you are being watched" cue the client shows, switched off in XML. The cloud client beside it had no app.config.
Two implants means two services. Count them before you close the case.
ALT ScreenConnect app.config with every notification setting false
