FT Purple-Teamer @ A Place You've Heard Of. | Early Career | Windows Focus | 🏳️🌈 - I share Atk+Def resources, and adore obscure/intricate attack chains.
Texas, USA
Joined October 2018
- Tweets3.3K
- Following278
- Followers56
- Likes3.4K
Saint_I_Aint retweeted
Microsoft Edge loads all your saved passwords into memory in cleartext — even when you’re not using them.
Saint_I_Aint retweeted
Open-source cybersecurity skills library for AI agents
github.com/mukul975/Anthropi…
Saint_I_Aint retweeted
"Minor update"
+82125 -35463 lines changed
😅
Just pushed a minor update to #mimikatz 2 🥝(no - it's *NOT* the version 3) to support specific GMSA DPAPI passwords in LSA secrets to be able to to decrypt Masterkeys
> github.com/gentilkiwi/mimika…
Only for @topotam77 convenience ;)
Saint_I_Aint retweeted
Back in 2021, "Certified Pre-Owned" by @tifkin_ & @harmj0y aimed to fix this class of issues. But these misconfigs still everywhere?
The reason isn’t just technical; it’s abt guidance, incentives, & responsibility.
Read up before Martin's talk! ghst.ly/4cOQoDL
🧵: 2/2
Saint_I_Aint retweeted
swarmer. tool for sneakily adding registry keys to HKCU without EDR/AV being able to see what's happening even if you don't have administrator access
github.com/praetorian-inc/sw…
Saint_I_Aint retweeted
We successfully used winget as a PowerShell execution proxy for initial access. While in that setting you can't get around the exe invocation itself, it works well if the feature isn't disabled.
blog.compass-security.com/20…
Next usecase: lateral movement? 👀
I just dropped some research: DSCourier and would love for your opinion and to check it out!!
It’s a novel post-exploitation technique abusing WinGet’s COM API to execute code through Microsoft-signed binaries.
GitHub: github.com/DylanDavis1/DSCou…
Blog: dylansec.com/DSCourier/
Saint_I_Aint retweeted
SilentHarvest BOF
This is a BOF implementation of SilentNimvest project, which is in turn based on the SilentHarvest research. It's another registry-only credential dumper, replicating hashdump capabilities as well as retrieving secrets stored in the HKLM\SECURITY\Policy\Secrets subkeys. Old capabilities with a "new" "sneaky" way of delivering. Only requires SeBackupPrivilege (e.g. Administrator, doesn't require SYSTEM as it would normally)
github.com/Octoberfest7/Sile…
Saint_I_Aint retweeted
How well do you really understand what's happening inside a #Kerberos exchange? In our latest blog, @codewhisperer84 breaks down the full authentication flow and demonstrates how to interact with every stage using the #Titanis toolset. Read it now! hubs.la/Q04dcFgv0
Saint_I_Aint retweeted
Some time ago I found an interesting living of the land technique (if you can call it that) while doing some source analysis of Windows Terminal that gives you "persistence" over "cmd"
Read the research here - research.nasbench.dev/resear…
You can set specific values in the HKCU\Console\%%Startup registry key, namely DelegationConsole and DelegationTerminal to define a custom console handoff.
Which effectively lets a standard user point the normal default-terminal handoff flow at a custom COM local server when a visible console session starts.
Saint_I_Aint retweeted
While I was trying to evade cloud-based EDRs, I accidentally found a way to temporarily block a client's machine network with a POC running as a Normal user.
Not using the Windows Filtering Platform (WFP) which requires Admin priv
I haven't thought of exploitation scenarios for this tool yet, it might be a dead-end #antimalware research direction 🤔
#redteam
ALT block a client's machine network with a POC running as a Normal user
Saint_I_Aint retweeted
. @mubix shared this on LinkedIn and thought some of you might find it useful: “A Practical Reprioritization Guide for CISOs Entering the AI Vulnerability Era”
linkedin.com/posts/mubix_the…
Saint_I_Aint retweeted
Abusing BadSuccessor (dMSA): Stealthy Privilege Escalation
🔥 Telegram: t.me/hackinarticles
✴ Twitter: nitter.cf/hackinarticles
BadSuccessor (dMSA) is a dangerous vulnerability in Windows Active Directory that allows attackers to achieve domain admin access through privilege escalation.
🧾 Overview the Badsuccessor dMSA Abuse
🧰 Prerequisites
🧪 Lab Setup
🔍 Enumeration & Exploitation
🛡️ Mitigation
hackingarticles.in/abusing-b…
#infosec #cybersecurity #cybersecuritytips #microsoft #redteam #informationsecurity #CyberSec #ai #offensivesecurity #infosecurity #cyberattacks #security #oscp #cybersecurityawareness #bugbounty #bugbountytips
Saint_I_Aint retweeted
A critical 9.8 CVSS flaw (CVE-2026-27944) in Nginx UI lets hackers download and decrypt full system backups via an open API. A proof-of-concept exploit for this flaw is available. Update and rotate secrets!
securityonline.info/unauthen…
Saint_I_Aint retweeted
My infosec/mixed tech RSS feed:
- Bleeping Computer (some sponsored slop gets through)
- 404 Media
- MIT Technology Review
- Detect FYI (shoutout @ateixei)
- TrustedSec
- BadSectorLabs
- DFIR Report
- Kostas on Medium
- Lucy (goblinloot.net / @LucyIsZombie)
- MS tech community - Sentinel/Defender stuff
Any recs I should add on?
Saint_I_Aint retweeted
ADPulse. Active Directory security auditing tool that connects to a domain controller via LDAP(S), runs 35 automated security checks, and produces detailed reports in console, JSON, and HTML formats
github.com/dievus/ADPulse
Saint_I_Aint retweeted
An interesting piece of research on stopping arbitrary ETW traces using an undocumented “Stop Trace” flag
originhq.com/blog/securitytr…
#ThreatHunting #blueteam #redteam #pentesting
Saint_I_Aint retweeted
SysWhispers4 just dropped !!!
github.com/JoasASantos/SysWh…
Saint_I_Aint retweeted
Homelab with Active Directory and SIEM for security training
github.com/0xMR007/Lab4Purpl…
