Labman (@Amarjit_Labu) header
Labman (@Amarjit_Labu) profile picture

Labman

@Amarjit_Labu

Lover of breaking things | Cybersec researcher with a wide taste in music genres!! https://nitter.cf/t.co/AOHvviQE9r ||| chr°ᶰ1k |||

 Ring3 making my way to Ring0
mixcloud.com/amarjitlabu/
Joined July 2009
  • Tweets16.8K
  • Following1.6K
  • Followers2.4K
1.1KMedia
Photo by Labman (@Amarjit_Labu)Photo by Labman (@Amarjit_Labu)Photo by Labman (@Amarjit_Labu)Photo by Labman (@Amarjit_Labu)Photo by Labman (@Amarjit_Labu)Photo by Labman (@Amarjit_Labu)Photo by Labman (@Amarjit_Labu)Photo by Labman (@Amarjit_Labu)Photo by Labman (@Amarjit_Labu)
Hopefully coming to Mythic v4 soon. Direct RDP and VNC functionality via Guacamole. No rportfwd involved, just a direct feed to Guacamole via a new interactive streaming mode from the mythic agent. Might be a tough watch from a mobile device, so I'd recommend a larger screen.
5
26
141
4,484
Labman retweeted
🕳 (@sekurlsa_pw) profile picture
🕳@sekurlsa_pwNov 6
WebClientRelayUp “an universal no-fix local privilege escalation in domain-joined windows workstations in default configuration.” github.com/Hack0ura/WebClien… Not sure if this is the account from the author: @Hack0ura
2
65
185
7,110
Labman retweeted
mpgn (@mpgn_x64) profile picture
mpgn@mpgn_x64Nov 5
netexec-mcp 1.0.8 is out, with a few bug fixes found by benchmarking LLM agents on an Active Directory lab. Article coming soon on the method: differential replay and decision-point evals 😎 pipx upgrade netexec-mcp github.com/mpgn/NetExec-mcp
GitHub - mpgn/NetExec-mcp: NetExec MCP

GitHub - mpgn/NetExec-mcp: NetExec MCP

NetExec MCP. Contribute to mpgn/NetExec-mcp development by creating an account on GitHub.

github.com
11
53
2
190
7,027
Short post on an alternative method for obtaining Microsoft Entra refresh tokens via Beacon. Proof of concept BOF is available on my GitHub 🙂 infosecnoodle.com/p/obtainin…
Obtaining Microsoft Entra Refresh Tokens via Beacon

Obtaining Microsoft Entra Refresh Tokens via Beacon

An alternative technique for obtaining Microsoft Entra refresh tokens (and "family refresh tokens") using beacon on a compromised endpoint.

infosecnoodle.com
1
96
1
242
13,933
Coercion BOF via IPP printers 🖨️ Useful for relaying HTTP —> AD CS, LDAP, etc. GitHub Link: github.com/sudonoodle/BOF-co…
Image from noodlearms (@infosecnoodle)
3
64
288
10,310
Good morning to everyone who used Winamp
Image from ⭕ Brock Pierson (@brockpierson)
1,270
4,205
740
52,980
1,589,089
Labman retweeted
Azox (@azoxlpf) profile picture
Azox
@azoxlpfNov 2
Bypassing SMB and LDAP signing with ntlmrelayx 🔥 I added both reauthentication bypasses to Impacket, now merged! Use –reauth-bypass on unpatched systems 🚀 LDAP can also start anonymously where accepted. Research: blackfield.ch/blog/defeating… and specterops.io/blog/2026/10/2…
Image from Azox (@azoxlpf)
3
91
2
316
11,000
Labman retweeted
Adrián Díaz (@s4dbrd) profile picture
Adrián Díaz@s4dbrdNov 2
Spent some time reversing wesp.sys to see how far a SYSTEM process without PPL could get with WESP. Registration worked. I got ProcessCreate telemetry. A deny update was rejected. A higher-altitude suppressor couldn't blind another client. s4dbrd.github.io/posts/wesp-…

The Windows Endpoint Security Platform From the Outside: What SYSTEM Can Do Without PPL

The Windows Endpoint Security Platform (WESP, or ESP) changes how third-party endpoint security products hook the kernel. Instead of a minifilter that calls up to a user-mode service and blocks the...

s4dbrd.github.io
21
113
4,211
Hello, Little People Living Inside Of My Computer, I have made my second ever YouTube video briefly discussing the Chinese government trying to compromise companies in Malaysia. It was fun. youtu.be/ZcsVsr4rpgs
24
78
5
991
38,034
Labman retweeted
R.B.C. (@G3tSyst3m) profile picture
R.B.C.
@G3tSyst3mOct 30
Here's my latest work. We're exploring some alternative means of initial credential access using PDFs and Websockets! Should be a good time 😎 g3tsyst3m.com/initial%20acce…
Using PDFs and Websockets for Creative Credential Harvesting

Using PDFs and Websockets for Creative Credential Harvesting

Hey everyone! 👋 If you’ve been around the Infosec block for any length of time, you’ll remember BeEF - The Browser Exploitation Framework. Back in the day it was a very creative avenue into gaining...

g3tsyst3m.com
4
42
1
180
8,917
New Kerberos Abuse Path Discovery - Constrained Delegation without Protocol Transition against SPN-less accounts hunio.org/security/abusing-c…
Abusing Constrained Delegation without Protocol Transition against SPN-less accounts

Abusing Constrained Delegation without Protocol Transition against SPN-less accounts

A fun new Kerberos abuse path!

hunio.org
1
29
158
8,088
74
289
37
4,278
172,929
Microsoft wants EDR out of the Windows kernel. We checked the binaries They even come with public symbols. Full write-up from @zodiacon : go.es.io/4zcdL2U Microsoft's answer is the Windows Endpoint Security Platform (WESP). It's undocumented, but it already ships in Windows Insider builds. What we found: • wesp.sys: a Microsoft-built file system mini-filter at altitude 329500 • EspFilterPort: the filter communication port it uses to reach user mode • espclient.dll: 120 Esp* exports for rules, filters and event queues
Image from Elastic Security Labs (@elasticseclabs)
3
103
1
394
17,919
Labman retweeted
sysxplore (@sysxplore) profile picture
sysxplore
@sysxploreOct 25
Image from sysxplore (@sysxplore)
39
374
26
8,058
108,502
After you finish patching your PHP, don't forget about the CA compromise from yesterday! Here is a role you can demo it in your lab: github.com/badsectorlabs/lud… Mint an EV cert for any domain, and code sign any binary! Keep windows off the network - update is aggressive!
Image from Bad Sector Labs (@badsectorlabs)
Image from Bad Sector Labs (@badsectorlabs)
Image from Bad Sector Labs (@badsectorlabs)
Image from Bad Sector Labs (@badsectorlabs)
8
29
1,848
Labman retweeted
php-net (@php_net) profile picture
php-net
@php_netOct 21
PHP 8.5.12 released - 90 fixes in 29 components, including security fixes (CVE-2026-109618, CVE-2026-109619). Changelog + downloads: php-net.pro/news/php-8-5-12-…
PHP 8.5.12 released with security fixes | The Dev Dispatch

PHP 8.5.12 released with security fixes | The Dev Dispatch

The PHP project has released PHP 8.5.12: 90 fixes across 29 components of the 8.5 branch.

php-net.pro
42
2,492
214
5,376
726,331
Labman retweeted
Kostas (@Kostastsale) profile picture
Kostas
@KostastsaleOct 20
I used Opus 5.5 on max and GPT-6 Astra for 5 days straight and I reversed engineered Elastic Security and extracted all the rules. I made them available here: github.com/elastic/detection… You’re welcome.
GitHub - elastic/detection-rules

GitHub - elastic/detection-rules

Contribute to elastic/detection-rules development by creating an account on GitHub.

github.com
47
108
10
818
62,464
Just dropped LogonStealer! Steal plaintext Windows passwords straight from the logon screen. A rogue Credential Provider that hooks CredProvDataModel.dll inside logonui.exe to steal plaintext passwords at the Windows logon screen github.com/S12cybersecurity/…
Image from 0x12 Dark Development (@papadelospapas_)
2
28
1
190
8,069
Did you know that if you have Entra ID P1 there is a new way to block your stolen refresh token from being replayed by the attacker? Find out 🧵👇 1/7
Image from Merill Fernando (@merill)
13
49
4
255
26,217
Added alternatives to OpenProcess, OpenThread and SuspendProcess! github.com/S12cybersecurity/…
GitHub - S12cybersecurity/UPrimitives: Collection of custom implementations or Userland Primitives...

GitHub - S12cybersecurity/UPrimitives: Collection of custom implementations or Userland Primitives...

Collection of custom implementations or Userland Primitives about some WinAPI functions - S12cybersecurity/UPrimitives

github.com
1
16
71
3,069
Load more