Practical cyber security materials and tools | OSCP | OSCE | #infosec #netsec #pentest #hacking #cyberdefense
Joined February 2020
- Tweets4.6K
- Following344
- Followers3K
- Likes6.2K
Pinned Tweet
Top 16 Active Directory vulnerabilities found during pentests (detailed post)
#infosec #pentest #pentesting #hack #hacking @DirectoryRanger
infosecmatter.com/top-16-act…
InfosecMatter retweeted
This is the most serious 48 hours in cybersecurity history.
"Black October" they're calling it
It seems every *hour* there's a new incident, that in a typical year, would be one of the biggest incidents of the *entire year*
SUMMARY OF THE LAST 48 HOURS:
YEAR-LEVEL INCIDENTS (In a typical year, these would be among the biggest incidents of the year):
1. PHP2Shell: a hole in the software behind ~70% of websites. Governments took sites offline.
2. eMudhra: the master keys that prove websites are real were cracked. One was the number 4.
3. California: data on every public school student since 2023 stolen, including disability status
4. Railway: hackers stole customers' secret keys from a hosting platform used by millions of developers
5. Zeabur: 321,810 accounts breached. The company is shutting down.
6. LiteLLM: an AI tool downloaded 3.4 million times a day was poisoned with a password stealer
7. GitLab: a 10-out-of-10 severity hole in every version since 2014
8. Cairn: criminals used an AI hacking tool to break into 100+ companies
9. Ahold Delhaize: hackers knocked the owner of Food Lion and Stop & Shop offline
10. Onamae: malware planted on up to 26,739 customer servers in Japan
MONTH-LEVEL INCIDENTS (In a typical month, these would be among the biggest incidents):
11. Signal: a bug could leave your mic and camera on after you hang up
12. NGINX: 3 critical holes in software running ~1/3 of websites
13. HTTP/3: a single connection can crash 7 of the 10 web server types tested
14. Plex: hackers breaking into home media servers
15. SafePay ransomware: FBI warns it has hit 600+ critical infrastructure organizations
16. Palo Alto: ransomware gangs breaking in through company firewalls
17. Bullhorn: platform used by 10,000+ companies knocked offline
18. Medi-Cal: 970,000 patients' data stolen
19. WordPress: hackers stole a plugin maker's keys and used them to plant backdoors on websites
20. AOMEI: backup software's update server handed out a backdoor
21. Meta Muse: Meta's AI agent exposed users' personal and business secrets
22. Tor: 333 relays hijacked to steal logins
23. TiDB Cloud: database company's cloud breached
Also serious:
24. State Bank of India: India's biggest bank confirms a data breach
25. OVHcloud: hackers slipped a password stealer into a cloud company's official tool
26. Siemens: a software hole being used to spread malware
27. North Korea: state hackers launch a new attack campaign on South Korea
InfosecMatter retweeted
I got hacked at 3:59 AM without clicking anything. My voicemail handed the attacker my Telegram login code.
Here is exactly how it worked, so it doesn't happen to you.
3:54 AM. My phone rings about ten times in a row, No Caller ID. That was not harassment. It was the attack: keep my line busy.
Meanwhile, the attacker asks Telegram to log in with my number and picks "send the code by phone call". My line is busy, so Telegram's robot call lands on my voicemail and reads the code out loud to it.
Carrier voicemail can often be reached remotely, with a default PIN or a spoofed caller ID. He listens to the message. At 3:59 he is in.
Fortunately, the attack was noisy. The calls woke me up. At 4 AM I only wanted to go back to sleep, but I had the presence of mind to check my notifications. Telegram was showing a new login from a device I didn't know. That check is what saved me: I ended his session within minutes. If I had rolled over, the next day would have been a mess.
In those few minutes he had already typed /balance, then /start on every old wallet bot he could find in my chats. He was hunting for funds tied to my Telegram. The bots were long dead and nothing was lost. He still had time to set his own 2FA password on my account.
What would have stopped it:
Telegram two-step verification, with a recovery email. With a password on the account, the code alone is useless.
Your voicemail. Change the PIN, block remote access, or turn it off (##002# cancels call forwarding on most carriers).
Same for WhatsApp and any service that can send a code by voice call.
No seeds, keys or passwords in Saved Messages. Ever.
A burst of masked calls at night is a signal, not a nuisance. Check your notifications and your active sessions.
I have been building in crypto for more than ten years and I had never thought about my voicemail. Check yours today.
InfosecMatter retweeted
Olvídate de DCSync y las copias de sombra de NTDS. Si quieres extraer hashes de Active Directory sin hacer ruido, este es el camino.
Timeroasting abusa del servicio de tiempo de Windows (NTP) para robar hashes de forma sigilosa. Y lo peor: pasa desapercibido en la mayoría de pipelines de detección.
🧵 ¿Cómo funciona y cómo detectarlo?
1️⃣ El protocolo olvidado: Abusa de la extensión NTP de Microsoft para recolectar hashes de cuentas de máquina (y en escenarios avanzados, cuentas manipuladas).
2️⃣ Cero alertas: El tráfico NTP es omnipresente en cualquier red corporativa, por lo que el ruido generado es prácticamente nulo comparado con otras técnicas.
3️⃣ Crackeo offline: Los hashes obtenidos se pueden tirar contra Hashcat (-m 31300) para romper contraseñas débiles.
Los defensores necesitan empezar a monitorear anomalías en peticiones MS-SNTP ya mismo.
Aprende a implementarlo paso a paso con PowerShell aquí 👇
InfosecMatter retweeted
This is how to find sql-Injection 100% of the time. 🔥
For site.com/?q=HERE
/?q=1
/?q=1'
/?q=1"
/?q=[1]
/?q[]=1
/?q=1`
/?q=1\
/?q=1/*'*/
/?q=1/*!1111'*/
/?q=1'||'asd'||' <== concat string
/?q=1' or '1'='1
/?q=1 or 1=1
/?q='or''='
#bugbountytips #bugbountytip
InfosecMatter retweeted
🚨Bypass-403 - A simple script just made for self use for bypassing 403.
✅t.me/brutsecurity/3025
✅github.com/iamj0ker/bypass-4…
#bugbounty #pentesting
InfosecMatter retweeted
ItsNotAlwaysSMB: DPAPI in other protocols🔥
SMB is monitored closely nowadays, stopping attacks like looting DPAPI secrets. Thanks to @_zblurx, NetExec got a huge upgrade, extending DPAPI credential dumping to other protocols such as WMI, WinRM and MSSQL and various modules🔑
ALT Dumping DPAPI secrets via WinRM, MSSQL and WMI
ALT Dump various credentials using DPLoot
InfosecMatter retweeted
🥷 有人把一整套渗透测试的实战方法打包成了能直接喂给 Claude 的技能库 Claude-Red，让 Claude 上手就能按专业红队的路子做授权安全测试。
GitHub 上已经 3300 多 star，作者是安全研究员 Kai Aizen，主页挂着 50 多个 CVE。
它把 SQL 注入、权限提升、活动目录攻防、云安全、EDR 绕过这些方向的经验，整理成了 78 个 SKILL.md 技能文件，分在 23 个类别里。以前这些方法散落在各种博客、笔记和清单里，做一次测试得东翻西找；现在 Claude-Red 把它们做成结构化技能，Claude 读进去就知道该按哪套流程往下走。
项目自己也写清楚了适用场景：授权的红队演练、漏洞赏金、安全研究和 CTF 准备。工具是给防守和授权测试用的，越过授权那条线就是另一回事了。
GitHub：github.com/SnailSploit/Claud…
InfosecMatter retweeted
shmexec: Zero-FD Fileless Payload Execution via System V Shared Memory
klydz.net/post.php?slug=how-…
InfosecMatter retweeted
El tradecraft de infosec ya no vive en la cabeza del operador.
Ahora lo carga un agente.
SpecterOps soltó el primer marketplace de verdad:
79 skills. 22 agentes. 26 plugin families.
BloodHound. Cobalt Strike. Outflank. Mythic. Ghidra. Binary Ninja. Ghostwriter. Recon. AppSec. C2. Reverse engineering. Windows, macOS y Linux.
Y no: esto no es para “el red teamer con ChatGPT”.
Investigadores de vulnerabilidades:
review de código, análisis de parches, 1-days y (si hay criterio detrás) acelerar caza de 0-days. El agente deja de adivinar y empieza a seguir un procedimiento.
Reverse engineers y malware analysts:
el binario ya no entra a un chat vacío. Entra a un workflow con tooling, referencias y criterios de done.
Blue teams y detection engineers:
por fin puedes emular el mismo tradecraft que el atacante va a automatizar. La pregunta ya no es “qué TTP usó un humano”. Es qué telemetría sobrevive cuando el operador también es un agente.
DFIR y threat intel:
esto es el preview de lo que el adversario va a empaquetar después. Conviértelo en playbook antes de que te lo encuentres en un incidente.
Red teamers:
attack paths, recon, C2 y simulación ya no son “arte de operador”. Son skills reutilizables, revisables e instalables.
La diferencia con el ruido de esta semana:
todo el mundo está instalando skills a ciegas, como extensiones random en 2018.
Esto no es un pack de prompts.
Es conocimiento de practitioners, con prerrequisitos, dependencias y lifecycle. Si no está revisado, está incubando. No se vende como magia.
Un prompt resuelve el problema una vez.
Una skill lo resuelve cada vez que el agente se sienta.
Repo:
github.com/SpecterOps/skills
codex plugin marketplace add SpecterOps/skills
InfosecMatter retweeted
No BloodHound? No PowerView? Query AD yourself.
SpecterOps posts break down manual LDAP enumeration with dsquery/ldapsearch, covering filters, group nesting, SPNs, UAC bitmasks, trusts, and cross-domain relationships. Know LDAP, know AD.
- specterops.io/blog/2021/06/0…
- specterops.io/blog/2024/05/0…
InfosecMatter retweeted
ADscan
Free CLI for pentesters, red teamers, and security consultants. It covers 105 Active Directory attack techniques in a single workflow: enumeration, Kerberoasting, AS-REP roasting, ADCS/ESC exploitation, DCSync, credential harvesting, and native attack-path analysis.
Resource: github.com/ADScanPro/adscan
InfosecMatter retweeted
Active Directory Attack Architecture
kypvas.github.io/ad_attack_a…
#infosec #cybersecurity #cybersecuritytips #pentesting #cybersecurityawareness
InfosecMatter retweeted
Microsoft has dropped CVE-2026-69730: a Windows DNS Server RCE with a 9.8 CVSS score.
No authentication. No user interaction. Low complexity. No mitigation. No workaround.
Basically, it doesn’t knock on the door; it lets itself in, makes a brew and starts executing code.
Patch it. 😂
InfosecMatter retweeted
Domain Controllers typically run Microsoft DNS so this RCE is effectively an Active Directory RCE. Patch ASAP!
InfosecMatter retweeted
CVE-2026-18963 · Keycloak (self-hosted)
Forgot password → unscoped tryAnotherWay → stale execution leak → UPDATE_PASSWORD without email click → ATO.
Scanner + shell:
github.com/ynsmroztas/KeySni…
Authorized testing only.
#BugBounty #InfoSec #AppSec #bugbountytip #bugbountytips #infosec #recon
🤖 Made with AI
InfosecMatter retweeted
Today we published WeWorm, our zero-click worm that spreads across iOS and Android.
All it takes is one phone call. You don't have to answer. Seconds later, your WeChat account is compromised, calling your friends and spreading the attack.
We reported the bug to Tencent, and it's now mitigated for all users.
We hope this sets an example. The US and China disagree on plenty, but keeping billions of people safe online shouldn't be one of them.
AI gives us a chance to find and fix these bugs faster than ever. We should work together to make the world safer for everyone.
Our story and demos: calif.io/research/weworm
InfosecMatter retweeted
Researchers spent 500 hours and $70,000 and found LG TVs logging plain text transcripts in standby, mapping every device in the house, and feeding it to LG's ad arm
Unplug the internet and it saves the files until you plug back in.
LG says its TVs don't record ambient conversations.
The evidence begs to differ.
216 million of these are sitting in living rooms.
Where are the regulators?
Writer: Daniel
Readers added context they thought people might want to know
The findings and video clip here are from Gamers Nexus' investigation, which receives no credit or link.
youtube.com/watch?v=6IFVTc…
x.com/gamersnexus/st…
InfosecMatter retweeted
‼️ Microsoft's patch for Windows Defender zero-day ShieldBreak (CVE-2026-69414) is still bypassable, a new PoC called ShieldCrash was published today by researcher Nightmare-Eclipse. It demonstrates arbitrary file read as SYSTEM on all supported Windows versions running the September 2026 patches.
The researcher describes it as a "skeleton PoC" and says a full SYSTEM exploit may follow.
InfosecMatter retweeted
‼️ BREAKING: Your LG TV is eavesdropping on you. It transcribes what you say, copies what is on your screen, and scans every device on your network, and researchers say the collection keeps running after you disconnect it, uploading the moment it reconnects.
LG's ad-tech arm says it out loud: "We own the glass." It pitches marketers on the ability to "own the living room," using data harvested from the TV you paid thousands for.
Gamers Nexus, working with Level1Techs and independent researchers, compromised an LG G5 and turned it into a listening device: it recorded room audio while the screen appeared off and the Ethernet cable was unplugged, then exfiltrated the file once the TV was back online.
LG has publicly said its TVs "do not collect, record, or store ambient conversations." Gamers Nexus found the TV converts speech to plain text and stores it in on-device logs, and that the mic window stays open 10 to 15 seconds after talking stops, sweeping up bystanders who never addressed the TV.
These sets are everywhere: hospitals, waiting rooms, boardrooms, hotels. ACR keeps running even when the TV is a dumb HDMI monitor, and a compromised set can pull the audio of a call off that HDMI feed. A surgeon asked Gamers Nexus where that leaves patient confidentiality.
Researchers advise disconnecting LG TVs from any network.
