ꜱᴇɴɪᴏʀ ꜱᴇᴄᴜʀɪᴛʏ ᴄᴏɴꜱᴜʟᴛᴀɴᴛ / ᴘᴇɴᴇᴛʀᴀᴛɪᴏɴ ᴛᴇꜱᴛᴇʀ | ᴏꜱᴄᴇ³ | ᴏꜱᴇᴘ | ᴏꜱᴄᴘ | ᴏꜱwᴘ | ᴏꜱwᴇ | ᴄʀᴛ | ᴄʀᴛᴘ | ᴄʀᴛᴇ | ᴄʀᴛᴏ | ᴇᴡᴘᴛxᴠ2 | ᴇᴄᴛᴘxᴠ2 - ᴡᴀɴɴᴀʙᴇ ʀᴇᴅ ᴛᴇᴀᴍᴇʀ
Joined January 2020
- Tweets92
- Following570
- Followers980
- Likes303
Edo Maland retweeted
@screetsec maps a full intrusion lifecycle built entirely around AI-assisted IDEs, initial access to covert C2, live demos included. If your devs live in an AI code editor, you need to see what that surface actually looks like. 👀
Edo Maland retweeted
This tool called #Sudomy created by @screetsec , I use it to find hidden live subdomains that are even still under production lol. To my surprise, those subdomains are vulnerable despite WAF protecting the main domain.
#Please use this tool: github.com/screetsec/Sudomy
Edo Maland retweeted
Built-in≠safe. @ScreetSec shows how PowerShell goes full red team: recon, exploit, escalate, move laterally — all fileless, all stealth. Real offensive tricks, amsi/etw bypasses, and defense evasion that hits where it hurts. #PHTalks, Jakarta 🇮🇩, 23 Jul: phtalks.ptsecurity.com/jakar…
Edo Maland retweeted
Working on a new tool that will be ready soon. One thing I can say from the research.... if your environment leverages Windows Hello without TPM's, DO NOT allow the default setting of a digit only based pin. Windows stores the pin length and can be brute forced in seconds.
Edo Maland retweeted
Quick POC this evening looking at how LAPS (v2) passwords are stored and decrypted on Active Directory (tl;dr, msLAPS-EncryptedPassword attr and NCryptStreamUpdate for crypto) gist.github.com/xpn/23dc5b6c…
Edo Maland retweeted
If you're a read teamer and want your work to have a higher impact, I recommend the following:
1. put yourself in the perspective of a defender for a while
2. understand their methods, learn about their detections
3. learn to read YARA, Sigma, Snort signatures
...
🧵
Edo Maland retweeted
Bypassing CrowdStrike, Microsoft Defender for Endpoint etc. for fun.. not profit vanmieghem.io/blueprint-for-…
Edo Maland retweeted
(10/10) Read about the full discovery here > orca.security/resources/blog…
Edo Maland retweeted
Great blog on Azure SAS Token privilege abuse: netspi.com/blog/technical/we…
Edo Maland retweeted
This repo contains almost everything about appsec. Refer this and you should have enough idea about appsec:)
github.com/paragonie/awesome…
Edo Maland retweeted
I created a #CyberChef recipe to ease the extraction of URLs from the word document (.doc & .docm) which download #Emotet. It is not completely foolproof, but it worked 99% of the time for me.
tinyurl.com/zexbjxcd
Edo Maland retweeted
Rubeus is a great command line tool for performing various Kerberos attacks: github.com/GhostPack/Rubeus
But I don't use it often enough to remember the syntax and the help text is 300 lines long. So I've started making a GUI for myself and other equally lazy people
Edo Maland retweeted
Red-Teamers:
[lazy]People like me use Notepad++ as a note-taking thing. We create a 'new', then never get around to saving them.
They get cached here:
C:\Users\{username}\AppData\Roaming\Notepad++\backup
If you hit a dev/sysadmin, you'll find all kinds of crazy stuff.
Edo Maland retweeted
I'm proud to release my recon suites review. Again, thanks to all the developers who make it easy for all hackers and researchers. This time thanks to @harshbothra_ @KathanP19 @eslam3kll @screetsec @j3ssie @thewhiteh4t @ojhayogesh11 @SilverPoision 1/2 six2dez.gitbook.io/pentest-b…
Edo Maland retweeted
(1/5) Here's my last #FF and "best of" list for 2020:
Best defense-oriented blog post: Restricting SMB-based lateral movement by @duff22b: medium.com/palantir/restrict…
Edo Maland retweeted
✨New Article: Vulnerabilities in McAfee ePolicy Orchestrator
🐞Unauth RCE chain via CSRF + SSRF + MSSQL MiTM server
🐞Post-auth RCE via ZipSlip with Windows Defender bypass
🐞Reflected XSS
CVE-2020-7318 assigned, research by Mikhail Klyuchnikov
swarm.ptsecurity.com/vulnera…
