Elevating security with expert offensive strategies
Long Beach
Joined October 2024
- Tweets295
- Following83
- Followers1.1K
- Likes3.7K
Init1Security retweeted
It has been a quieter month than usual for iPurple blogging, as I have been working on content for a number of upcoming projects and activities.
A new article will be published early next week. In the meantime, have a look at my latest post on leveraging WerEnc.dll to encrypt your implant.
Why use it?
✅ Smaller stagers by reusing encryption code already built into Windows
✅ AES-256 encryption support
✅ Trusted, signed Microsoft DLL
Living-off-the-land encryption has its advantages.
ipurple.team/2026/09/21/dump…
Init1Security retweeted
Using Crystal Palace and AdaptixC2
maorsabag.github.io/posts/ad…
Init1Security retweeted
Yo, a new Blog Post about Bypass All Sec Control in windows like (win def,applocker,WDAC,SmartScreen,ASR,PPL,Sysmon,Edrs)
0xdbgman.github.io/posts/sec…
#EDRS #Bypass #PPL #WDAC #Redteam #windowsDefender #ASR #Sysmon
Init1Security retweeted
Yo , a new blog post about persistence techniques Windows:Registry, Scheduled Tasks, WMI, DLL Hijacking
Linux:cron, SSH Keys, LKM
macOS: LaunchAgents, Dylib Hijacking
Cloud: IAM Abuse, Kubernetes
Inspired by Volt Typhoon, Lazarus Group, APT29.
0xdbgman.github.io/posts/per…
Init1Security retweeted
Can LNK files ever be trusted?
⚡ My latest blog post demonstrates several new LNK abuse methods, allowing you to fully spoof the target shown in Explorer. It also introduces tools to create your own LNKs, and detected spoofed ones yourself.
🐬 wietzebeukema.nl/blog/trust-…
Init1Security retweeted
Introducing: GhostKatz! 🐱
A Cobalt Strike BOF that lets you dump LSASS via exploitation of vulnerable drivers that offer physical memory read primitives.
Written by @EricEsquivel123 and I!! :)
github.com/RainbowDynamix/Gh…
Init1Security retweeted
List of tools and datasets for intelligence gathering
github.com/Jieyab89/OSINT-Ch…
Init1Security retweeted
Sometimes, the absence of signature match is also interesting. Here the #Chrysalis sideloaded dll, where we can quickly spot the few interesting functions.
Make sure to check "Show UNK" !
Init1Security retweeted
A short weekend read for anyone interested in the ANIMO (Azure Network Intel & Mission Ops) tool I've been working on throughout 2025. It documents a red team scenario with its capabilities and future development plans. If you'd like to send suggestions, phishing links or donations my DMs are open.
#redteam
dmcxblue.net/2026/01/04/anim…
Init1Security retweeted
Happy Halloween everyone, today in the last day of Cyber Awareness month I'd like to introduce "ANIMO":
An acronym for Azure Network Intel & Mission Ops
ANIMO is an Azure/Entra-ID red-team workbench a modular C2-style toolkit that lets you authenticate, enumerate, and interact with Microsoft 365 resources from a single, multi-session desktop UI.
Auth & Tokens: Captures/ingests access + refresh tokens (Graph/SharePoint/etc), inspects scopes.
Enumeration: Queries users, groups, roles, apps/SPNs, service principals, joined sites, drives, and permissions via Graph/Az.
Data Browsing: GUI explorers for OneDrive/SharePoint, Outlook Mail/Calendar, Teams (chats/files), with download/preview/reply/delete capabilities.
Sessions: Manages multiple targets/identities at once logs actions and results per session.
With this a full team can interact with the same Azure session, it can handle multiple sessions and each has their own powershell instance to not mix your users.
All the well known techniques are in one framework that adds the simplicity of just asking the proper tokens for the attacks with techniques ranging to Phishing, Privilege Escalation and Persistence, with also automated payloads that allow you to focus on Token Stealing it has been great in helping me understand Azure itself and now I would like to share it, currently a POC which will launch at a later date, but excited to what's to come!!
#redteam #azure #anotherc2maybe
Init1Security retweeted
My very first Crystal Palace shared library 🤗
github.com/rasta-mouse/LibTP
Init1Security retweeted
APK Tool GUI
GUI for apktool, signapk, zipalign and baksmali utilities
github.com/AndnixSH/APKToolG…
Init1Security retweeted
IRIS C2 ships with:
- FUD loaders
- Multiple evasive implants for Windows, Mac and Linux
- Windows root kit and UEFI bootkits
- Several linux rootkits
And much more
All within a modern, intuitive user interface that can run on Win, Mac or Linux
IRISC2.com
Init1Security retweeted
Matrix👨💻
while :;do echo $LINES $COLUMNS $((RANDOM%COLUMNS)) "$(printf "\U$((RANDOM%500+1000))")";sleep 0.05;done|gawk '{a[$3]=0;for(x in a){o=a[x];a[x]=a[x]+1;c=int(rand()*5);if(c==0)col="\033[1;32m";else if(c==1)col="\033[0;32m";else if(c==2)col="\033[1;36m";else if(c==3)col="\033[1;31m";else col="\033[1;37m";printf "\033[%s;%sH%s%s",o,x,col,$4;printf "\033[%s;%sH\033[0m",a[x],x;if(a[x]>=$1)a[x]=0;}}'
Init1Security retweeted
Morphing shellcode during execution.
Once a part of code is done executing, overwrite the block with new code to run.
A proof of concept by Debjeet Banerjee (@whokilleddb)
Src: github.com/whokilleddb/lordr…
#redteam #maldev #malwaredevelopment
Init1Security retweeted
💥 Wiz Research has uncovered a critical Redis vulnerability that's been hiding for 13 years
We found RediShell (CVE-2025-49844): an RCE bug in Redis that affects every version of Redis out there. It's rated CVSS 10 - the highest severity possible.
The vulnerability lets attackers send a malicious Lua script, escape the sandbox, and execute code on the host.
About 330,000 Redis instances are exposed to the internet right now. 60,000 have no authentication. Over 75% of cloud environments are running Redis.
Redis released a patch this weekend and we responsibly disclosed everything upon discovery. Huge thanks to the Redis team for their fast response and collaboration ❤️
If you're running Redis: update immediately.
Our blog has the full technical breakdown and security recommendations >> wiz.io/blog/wiz-research-red…
