Security Engineer | Gamer
Nairobi, Kenya
Joined April 2013
- Tweets3.3K
- Following403
- Followers1.3K
- Likes10K
Gabriel retweeted
You can now coerce HTTP authentication from Windows targets that are running MS-RPRN, using impacket with PR #2361!
The PR added a new opnum from the MS-RPRN spec, OPNUM 88 and an example script to make the process straight forward. Letting you now coerce and relay HTTP authentication from remote machine targets
Shoutout to sudonoodle for the BOF that inspired this and for the technique(at least I think it was them who found it) :3
Gabriel retweeted
Today @_rybaz and I are publicly releasing all the materials for our Introduction to Harness Engineering for Vulnerability Research training we gave at @unpromptedconf last week.
Our goal was to teach the concepts we've been using to do much deeper security research and make both vulnerability analysis and red team engagements far more impactful.
The workshop can be found here: grahamhelton.github.io/harne…
The slides can be found here: grahamhelton.com/talks/2026-…
Gabriel retweeted
The bypass of LDAP Signing Through Reauthentication described in @SpecterOps blog also works with pure Kerberos relay. too ;-)
Gabriel retweeted
Investigation update: Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach.
This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it. We are still gathering the facts, and will share more directly as we have them.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe.
We are still on track towards the expected timeline to resume the withdrawal service in 45 hours. Deposits remain unaffected.
The outflows ceased when we paused withdrawal service earlier. We are still working with partners to freeze many of the impacted assets, and have frozen around $3 billion thus far.
We will continue to provide further updates through official Binance channels as more verified information becomes available.
Gabriel retweeted
Crazy cool blog I saw on linkedin about an SMB signing bypass technique
TLDR: SMB re-auth reuses the original signing key and never checks the new identity matches the old. So you sign a session as a low-priv account you control, re-auth it with a relayed privileged login, and get a privileged session still signed with your original low-priv key, which btw is accepted even where signing is required, with DCs included.
blackfield.ch/blog/defeating…
Gabriel retweeted
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
Gabriel retweeted
‼️ BREAKING: The private keys of 8 certificates from Indian certificate authority eMudhra were compromised, Mozilla says. Firefox blocked them within 3 hours.
Each key should be a 116-digit number, but one was just 4.
Anyone can guess them and forge HTTPS certs for any website.
Gabriel retweeted
Hello
Unfortunately, @GitHub has banned us. They have orbital nuked the entire malware source code collection.
Gabriel retweeted
‼️ BREAKING: OpenAI was hacked by an Anthropic model. A HEIF photo uploaded to OpenAI's public support forum triggered a bug in the site's image decoder, led to code execution on the forum, and, through a second flaw in OpenAI's own login, ended with a pull request in OpenAI's internal GitHub.
The forum runs Discourse, the off-the-shelf software behind countless community sites. Discourse was still shipping an old copy of libheif, the library that decodes iPhone-style photos. The bug in it had already been fixed upstream.
But the fix was never labelled a security fix, so nobody treated it as urgent.
Hacktron's researchers uploaded a HEIF image and got their own code running on community[.]openai[.]com.
Then came the second bug, in OpenAI's own single sign-on, the "log in with OpenAI" button the forum uses. It turned that forum foothold into the actual ChatGPT and Codex accounts of people who had signed in there. OpenAI employees among them.
And a ChatGPT account is no longer just a chatbot. Through Codex, users wire in Gmail, Outlook, Drive, Slack, GitHub.
To prove the access was real, they used one employee account to have Codex open a harmless pull request in OpenAI's internal repo. They say they read no sensitive code.
OpenAI patched the SSO flaw roughly 14 hours after the report and paid a $6,500 bug bounty.
The team says Anthropic's Opus 4.8 found the libheif bug, and Opus 5 turned it into a working exploit.
Slack, Meta, GitHub Ent, Rails, Next.js, ImageMagick, and many more were also vulnerable and compromised by the same team of researchers.
Gabriel retweeted
For all the the IT admins asking, how do I make Active Directory MORE defensible. This is how…
Jerry Devore’s awesome series on Active Directory hardening.
Part 1 - Disabling NTLMv1
Part 2 - Removing SMBv1
Part 3 - Enforcing LDAP Signing
Part 4 - Enforcing AES for Kerberos
Part 5 - Enforcing LDAP Channel Binding
Part 6 - Enforcing SMB Signing
Part 7 - Implementing Least Privilege
Links for each one👇
techcommunity.microsoft.com/…
Gabriel retweeted
ItsNotAlwaysSMB: DPAPI in other protocols🔥
SMB is monitored closely nowadays, stopping attacks like looting DPAPI secrets. Thanks to @_zblurx, NetExec got a huge upgrade, extending DPAPI credential dumping to other protocols such as WMI, WinRM and MSSQL and various modules🔑
ALT Dumping DPAPI secrets via WinRM, MSSQL and WMI
ALT Dump various credentials using DPLoot
Gabriel retweeted
The cybersecurity section of this report is wild. APT operators used Claude for nearly everything: coding tools, testing against security products, building capture platforms, and processing victim data. Its like Anthropic was looking over their shoulder!
We're publishing our most detailed threat intelligence report to date.
It covers how people tried to misuse Claude—for cyberattacks, influence operations, surveillance, biology, and building weapons—and how we found and stopped them.
We disrupted every operation in the report, and used the lessons from them to strengthen our safeguards. Where appropriate, we also shared what we found with authorities and other AI companies.
These cases are not typical: we’re highlighting some of the most sophisticated misuse we’ve seen. But they’re especially important to discuss, because they show us where AI misuse is headed, where our safeguards work, and where they need to improve.
We’re publishing this report so others can spot the same activity on their own platforms, and so we can give the public a clearer view of how emerging threats develop.
Read the report: anthropic.com/threat-intelli…
Gabriel retweeted
We're publishing our most detailed threat intelligence report to date.
It covers how people tried to misuse Claude—for cyberattacks, influence operations, surveillance, biology, and building weapons—and how we found and stopped them.
We disrupted every operation in the report, and used the lessons from them to strengthen our safeguards. Where appropriate, we also shared what we found with authorities and other AI companies.
These cases are not typical: we’re highlighting some of the most sophisticated misuse we’ve seen. But they’re especially important to discuss, because they show us where AI misuse is headed, where our safeguards work, and where they need to improve.
We’re publishing this report so others can spot the same activity on their own platforms, and so we can give the public a clearer view of how emerging threats develop.
Read the report: anthropic.com/threat-intelli…
Gabriel retweeted
NetNTLMv1 is dead. Long live NetNTLMv1. 🌈
Today we're releasing NTLMRain: recovering NT hashes from NetNTLMv1 responses.
🌐 Browser-based cracking
⌨️ Cross-platform CLI with GPU/CPU support
💾 Searchable tables that fit on a 4 TB disk
Read the blog: outflank.nl/blog/2026/09/08/…
Gabriel retweeted
Weekend project: I added IAKerb support to Rubeus. My god, this is going to open the floodgates.
Phase 2 of Microsoft's NTLM deprecation is targeted for H2 2026. IAKerb ships for Server 2025 / Win11 24H2 and is already on by default in the June Canary preview. It proxies Kerberos auth through exposed services via SSPI when a client can't directly reach a KDC.
Which means anonymous user enum via AP-REQs with no preauth (zero telemetry), kerberoasting over the open internet, Entra lateral movement through AZUREADSSO tickets and more. All against public facing services.
Blog post soon with potential abuse vectors.
Gabriel retweeted
GPOHound - Offensive GPO dumping and analysis tool that leverages and enriches BloodHound data
github.com/cogiceo/GPOHound
Gabriel retweeted
From an analyst perspective, ransomware late-stage intrusions gets f-ing boring fast. I’ve analyzed a billion of those.
Same pattern for years now.
ADFind → BloodHound → Impacket/RDP → find data → Rclone → done.
Don’t get me wrong, boring ≠ ineffective. It clearly works.
But if you want to learn new execution and evasion tradecraft, spend more time investigating initial access malware and infostealers.