Red Team & Offensive Security Research @AmberWolfSec
Joined May 2011
- Tweets1.6K
- Following672
- Followers10.6K
- Likes3.7K
Rich Warren retweeted
I wrote a blog post about exploiting Logi Options+ for SYSTEM shells.
blog.amberwolf.com/blog/2026…
Rich Warren retweeted
Weaponising MDM - running a fake MDM server and pwning people as SYSTEM with two clicks (if they have permission to elevate). Poc included.
blog.amberwolf.com/blog/2026…
Rich Warren retweeted
AmberWolf and @MDSecLabs are jointly disclosing technical details on CVE-2026-40639, a weakness found in how some Dell platforms store BIOS passwords.
Rich Warren retweeted
"You need to be admin to run the installer anyway."
A common pushback that misses an entire class of attack. New research from @buffaloverflow on exploiting NSIS installer bugs to escalate from a standard user to SYSTEM in Zscaler Client Connector.
Rich Warren retweeted
A CheckPoint Harmony priv esc that @buffaloverflow and I found last year:
blog.amberwolf.com/blog/2026…
Rich Warren retweeted
Zero Trust is not a product it is an approach - at the @NCSC we have just released demystifying zero trust which addresses common misconceptions, and provides practical advice on when and how it should be adopted.
ncsc.gov.uk/collection/zero-…
Rich Warren retweeted
A special shoutout to the many 🇪🇺European cyber researchers presenting their work at #DEFCON, you were awesome.
🇳🇱@_dirkjan @John_Fokker
🇮🇹@Van1sh_BSidesIT
🇫🇷@christophetd @fr0gger_ @kalimer0x00
🇧🇪@RedByte1337
🇨🇿@marektoth
🇬🇧@_mattmuir @johnnyspandex @buffaloverflow
+many others
Rich Warren retweeted
CVE-2025-3831 Log files uploaded during troubleshooting by the Harmony SASE agent may have been accessible to unauthorized parties. cve.org/CVERecord?id=CVE-202…
Rich Warren retweeted
You can read about our overall research project at blog.amberwolf.com/blog/2025… and learn about a SAML Authentication bypass in Zscaler (CVE-2025-54982) at blog.amberwolf.com/blog/2025…
Rich Warren retweeted
Breaking Into Your Network? Zer0 Effort. - DEF CON 33 Overview and Advisory - Zscaler SAML Authentication Bypass (CVE-2025-54982). Following on from our DEF CON 33 presentation, the first two blog posts in our series on Zero Trust Network access abuse are now live.
Rich Warren retweeted
Maybe some info at #defcon33 on Saturday, Track 3, 15:30 "Zero Trust, Total Bust - Breaking into thousands of cloud-based VPNs with one bug"
not much info about it but:
🟥 CVE-2025-54982, CVSS: 9.6 (#Critical)
Zscaler SAML Authentication
A critical vulnerability due to improper verification of cryptographic signatures in Zscaler's SAML authentication mechanism, allowing authentication abuse.
#CyberSecurity #CVE #Vulnerability #Zscaler #SAML
help.zscaler.com/zia/about-i…
Rich Warren retweeted
My first CVE with AmberWolf has recently been resolved by Dell. Memory dumps on ThinOS Wyse terminals are not stored encrypted despite the use of FDE.
blog.amberwolf.com/blog/2025…
Rich Warren retweeted
Digging into how the latest Windows Kubernetes vuln works was a fun way to spend a couple of hours. We've just published some of my notes here: blog.amberwolf.com/blog/2025…
Rich Warren retweeted
Today, AmberWolf released two blog posts and our tool "NachoVPN" to target vulnerabilities in major VPNs, including CVE-2024-29014 (SonicWall NetExtender SYSTEM RCE) and CVE-2024-5921 (Palo Alto GlobalProtect RCE and Priv Esc), after our SANS HackFest presentation.🧵
Rich Warren retweeted
AmberWolf is hiring experienced Red Team operators! Join our fun, supportive team if you have (or have had) CCSAS/CCSAM certs and a passion for delivering world-class engagements. Apply now: lnkd.in/eWM255Bk #hiring #RedTeam
Rich Warren retweeted
🚨New Vulnerability: Authenticated RCE in Ivanti Connect Secure (CVE-2024-37404).
Discovered by @buffaloverflow , this exploit grants root access via RCE. Read about the discovery, exploit method, and vendor mitigations here:
blog.amberwolf.com/blog/2024…
Rich Warren retweeted
🚨AmberWolf Security Researchers have discovered an auth bypass vulnerability in One Identity Safeguard for Privileged Passwords (CVE-2024-45488), allowing attackers full access to the Password Safe. Summary on our blog: blog.amberwolf.com/blog/2024… Full technical blog coming soon!
Rich Warren retweeted
📣 The #SANSHackFest Agenda is LIVE & packed w/ highly technical talks from @dwizzzleMSFT @yarden_shafir @buffaloverflow & David Cash @33y0re & more!
Join us in Hollywood for exclusive access to ALL talks, workshops, & challenges.
➡️ Agenda: sans.org/u/1vBt
#PenTest
