@ofekitach
Joined July 2017
  • Tweets67
  • Following486
  • Followers112
AWS: where the shadow knows your secrets. @YakirKad & @ofekitach show you how attackers find your forgotten resources. #INTENT2024 ☁️🔓
2
6
627
🚨 Thread: Six Critical AWS Vulnerabilities Found 🚨 We've uncovered serious vulnerabilities in AWS services, leading to potential remote code execution, data manipulation, and more. Here's what you need to know: 🧵[1/7]
2
2
38
4,682
🚨 Aqua Nautilus researchers have identified the infrastructure of a potentially massive campaign against #cloud native environments. In the first of a two part series, we unfold the story of how we discovered the campaign, speculate on the threat actor, and share mitigation recommendations.💡 w/@MoragAssaf and @ofekitach blog.aquasec.com/threat-aler…
2
4
580
Check out our new blog about repojacking. We show a massive dataset we used and introduce exploitation scenarios using real repoaitories examples
Aqua Security
@AquaSecTeam21 Jun 2023
Threat Alert! New research by Aqua Nautilus emphasizes the extent of #RepoJacking and exposes potentially millions of vulnerable repositories. Among the repositories found vulnerable to this attack were @Google and @lyft.  Check out the blog here to see the full research + recommended mitigations. blog.aquasec.com/github-data… #cloudnativesecurity
1
5
235
New blog about rootkit detections! File operations hooking explained :) blog.aquasec.com/detect-drov…
5
8
Ofek itach retweeted
Yuval Gordon@YuG0rd1 Mar 2022
The research I have worked on while working at @SemperisTech about a new gMSA attack was just published. Special thanks to @elad_shamir and @GuyTeverovsky for all of their help.
Elad Shamir@elad_shamir1 Mar 2022
GMSA passwords aren’t what you think. Read all about it in @YuG0rd’s post, where he dives into how gMSA passwords are generated and introduces the Golden GMSA attack. semperis.com/blog/golden-gms…

gMSA Active Directory Attacks | Semperis AD Guides

Group Managed Service Accounts (gMSAs) are vulverable to attacks called a "Golden gMSA". Learn more about GMSA Active Directory attacks on our blog.

semperis.com
1
4
2
27
lol this site is hot 0dayfans.com/

0day Fans

0dayfans.com
8
115
12
396
Ofek itach retweeted
SkelSec@SkelSec5 Jan 2021
I waited 2 years for this, rewrote impacket for this, asked cryptographers to remake algos in python for this, spent enormous time of my life to make this happen. and it's finally here this finally works and I can't find the words to express my satisfaction.
76
706
124
2,254
Excited to publish our research in which @EyalItkin and I were able to fingerprint 2 of the most active exploit developers for Windows. Together, they account for 16 Windows LPE exploits, of which 5 were 0-Days that were sold to APTs and crime groups. research.checkpoint.com/2020…

Graphology of an Exploit - Hunting for exploits by looking for the author's fingerprints - Check...

Just like programmers leave their fingerprints in their code, so do exploit developers. We were able to apply the same techniques used to track malware authors and APT groups to draw a digital...

research.checkpoint.com
4
140
14
340
Ofek itach retweeted
Samir@SBousseaden19 Jul 2020
new container, will be set to public soon :D
7
65
4
328
~409 Windows security events mapped to audit policies and monitoring recommendations. cc: @christophetd @Cyb3rWard0g @SBousseaden @olafhartong professor.bike/blog/2020/7/1…
3
57
131
Have you ever needed to get an earlier version of the Windows binary you're analyzing? Did you end up downloading Windows ISOs or update packages just for that? Not anymore! Introducing Winbindex: m417z.com/winbindex/ m417z.com/Introducing-Winbin…

Introducing Winbindex - the Windows Binaries Index

I indexed all Windows files which appear in Windows update packages, and created a website which allows to quickly view information about the files and download some of them from Microsoft servers....

m417z.com
20
594
30
1,358
Undocumented (what a surprise!) EVTX file format flag, making all internal checksums ignored. Good to have if you plan to manipulate the log content.🕵️ Simple "try this at home" #PowerShell script: github.com/gtworek/PSBits/bl…
3
121
1
285
Ofek itach retweeted
Samir@SBousseaden28 Feb 2020
sometimes you can see a detection opportunity from a short video :) [URL matches, access to ECP url & OTHERS normally is useful for Exchange Admin ppl only, from process exec flow u can monitor any susp child proc of w3wp.exe with parent_cmdline line "*-ap *MSExchangeECPAppPool*"
7
47
1
110
#vulnScanners Vulns github.com/future-architect/… lynis github.com/CISOfy/lynis Scanners-Box github.com/We5ter/Scanners-B… h4cker github.com/The-Art-of-Hackin… trivy github.com/aquasecurity/triv… xunfeng github.com/ysrc/xunfeng faraday github.com/infobyte/faraday #bugbountytips,#bugbounty

GitHub - future-architect/vuls: Agent-less vulnerability scanner for Linux, FreeBSD, Container,...

Agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices - future-architect/vuls

github.com
84
2
288
Ofek itach retweeted
Samir@SBousseaden13 Feb 2020
pivoting on rwdrv.sys (legit signed driver to discover UEFI other HW related settings) leads to Lojax/DoubleAgent UEFI rootkit. sysmon check eventid 6 with Signature: "ChongKim Chan" (cuz there are many version with diff hashes) - proper discovery for this type of TTP is a must
2
53
2
159
Useful for #redteam PENTESTING-BIBLE github.com/blaCCkHatHacEEkr/… Nishang github.com/samratashok/nisha… Awesome Red Teaming github.com/yeyintminthuhtut/… LOLBins and LOLScripts github.com/LOLBAS-Project/LO… Collection Document github.com/tom0li/collection… Venom github.com/Dliv3/Venom #bugbounty

GitHub - blaCCkHatHacEEkr/PENTESTING-BIBLE: articles

articles. Contribute to blaCCkHatHacEEkr/PENTESTING-BIBLE development by creating an account on GitHub.

github.com
1
243
3
553
“I Hunt Sys Admins” by @harmj0y harmj0y.net/blog/penetesting…
36
1
128
Ofek itach retweeted
Samir@SBousseaden23 Jan 2020
processes that use bits in windows, SCCM client, browsers, outlook, onedrive & some update programs, powershell one was for testing thus it's not that frequent to have it there and if so likely the transfer job name will be known and can be baselined.
20
44
Windows / Linux Local Privilege Escalation Workshop (Materials included !) 🥳 github.com/sagishahar/lpewor…

GitHub - sagishahar/lpeworkshop: Windows / Linux Local Privilege Escalation Workshop

Windows / Linux Local Privilege Escalation Workshop - sagishahar/lpeworkshop

github.com
120
1
314
Load more