Elevating security with expert offensive strategies
Long Beach
Joined October 2024
- Tweets330
- Following85
- Followers1.2K
- Likes3.9K
A Halloween drop: RTO is officially published! 🎃
⚔️Thank you for all the support.
Dive in, break things, and send us your feedback. We're always working to make it better for this community. 📕
training.init1security.com
Well I guess my laptop is a waste
We have C# and Powershell executing in-memory but why not JScript and VBScript Windows 11 is still using them and it's a great new alternative for enumeration, this is something we are working on last minute to integrate onto Havoc for our training just 48hr's until release!!.🎃
Init1Security retweeted
LiberNT is in active development. A free Windows-compatible Operating System. Built out of love for the NT architecture. Windows® 11 compatible, for amd64, arm64 and riscv64.
github.com/LiberNT/LiberNT
We briefly touch on Maltego in our training course, but we still wanted to bring a powerful framework to our students. After exploring the many great options available, we realized that some of the best features are locked behind a paywall. So, we started developing our own framework internally.
We’re researching multiple data sources and methods, both free and paid. Sometimes, you get more data by paying 😅, but you’ll never get all the data. Some places are well protected. 🌃
Init1Security retweeted
People are going to lose their mind when they realize its actually easier to hack things using FEATURES not CVEs.
Init1Security retweeted
Man all of them security mitigations and the funny still happens, will never stop being funny
Init1Security retweeted
We have openings on our team GM.
Senior Incident Coordinator
lnkd.in/g35U5F7R
Senior Incident Handler
lnkd.in/gs2erCpU
Senior Adversary Operations
lnkd.in/gjQQs_Uz
Init1Security retweeted
Azure API Management as a Policy-Based C2 Redirector redops.at/research/azure-api…
Init1Security retweeted
Today we released WhisperHijack, a stealthy process injection PoC that uses thread descriptions to inject payloads into remote processes, then patches a waiting thread's return address for execution.
Every memory op happens in-target via Queue APCs, with zero NtWriteVirtualMemory or NtSetContextThread calls.
Based on @hasherezade TNC + WTH research.
github.com/Maldev-Academy/Wh…
Windows account hiding 101: A $ suffix skips net user but fails against PowerShells: Get-LocalUser.
To fully automate deeper registry hiding, @wgpsec dropped this: github.com/wgpsec/CreateHidd…
To avoid standard Windows disk artifacts, we translated their logic into a BOF and C# implementation to stay strictly in-memory. Definitely adding this to our training stay tune!!🕵️♂️
Init1Security retweeted
People seem to think this post was about exploit development. It wasn’t.
You don’t need to discover a new software vulnerability to compromise 90% of organizations.
Init1Security retweeted
Kernel eviction notice: What wesp.sys reveals about the Windows Endpoint Security Platform elastic.co/security-labs/blo…
Someone shared an interesting concept about DLL's and it's interesting to be aware that some DLL have powerful capabilities such as holding full scripting engines on them, for example Chakra.dll which has the JScript engine and allows us to execute JScript commands, a small C++ proxy DLL to execute the proper JsCreateRuntime → JsCreateContext → JsRunScript headers
We are still growing the course a little more before release but we added some latest redirection techniques, sign up at training.init1security.com ready for release on 🎃⚔️🥳
SQL is still an important part of Active Directory, so we had to bring it to the training and demonstrate the powerful capabilities of powershell and how it can abuse SQL. The training will still grow even after release to catch up with the latest attacks!! Sign up release Oct 31!! 🎃
training.init1ssecurity.com
Init1Security retweeted
It has been a quieter month than usual for iPurple blogging, as I have been working on content for a number of upcoming projects and activities.
A new article will be published early next week. In the meantime, have a look at my latest post on leveraging WerEnc.dll to encrypt your implant.
Why use it?
✅ Smaller stagers by reusing encryption code already built into Windows
✅ AES-256 encryption support
✅ Trusted, signed Microsoft DLL
Living-off-the-land encryption has its advantages.
ipurple.team/2026/09/21/dump…
