Buy High and Sell Low
Joined September 2021
- Tweets1.4K
- Following1.2K
- Followers173
- Likes1.9K
Burnout retweeted
Microsoft Graph Permissions list classified by severity and privileged impact to detect risky OAuth consents, over-privileged apps, consent phishing, apps with dangerous access, and enrich SIEM detections/app reviews.
github.com/mthcht/awesome-li…
Burnout retweeted
ran a red team
EDR detected mimikatz
blocked powershell
flagged encoded commands
caught my payload
beautiful setup
so i used the helpdesk portal
asked for a password reset
got domain admin in 11 minutes
SOC dashboard stayed green
but one gave a thought on social engineering
Burnout retweeted
labs.infoguard.ch/posts/ghos…
"When an organisation uses Exchange Online (or on-premises exchange in hybrid mode) with a third-party mail server or spam filter as its MX record, it is possible to send mail from any sender to that organisation. Outlook delivers it without warning"
Burnout retweeted
Are you still reverse engineering large JS files manually?
Save hours of manual workload. Checkout jsmon.sh
> Scan a domain at Jsmon, go to Reconnaissance
> If the app is using GraphQL, you'll see easy-to-read GraphQL operations
Burnout retweeted
shipping: WinSSHound
maps SSH access in AD as BloodHound paths. because Windows OpenSSH cheerfully ignores your "Deny Logon" GPOs (pre-2025) and on a default sshd_config every Authenticated User in the domain can walk right in. Why? Because Microsoft.
github.com/1r0BIT/WinSSHound
Burnout retweeted
CoinGecko formulas are now available in Microsoft Excel ✨
Use =CG.PRICE(...) to get live prices for your favorite coins and 37M+ crypto assets, right in your spreadsheets.
See all 5 formulas in action ⬇️
gcko.io/pcdaiwi
Bookmark this and tag your finance friends.
Burnout retweeted
Another day, another async BOF. With KeeLog, you can monitor KeePass instances and capture the master password as soon as its entered. github.com/jakobfriedl/keelo…
Burnout retweeted
Been very interested in Async BOFs lately and implemented a few for use with Conquest. The first implements Rubeus monitor as a BOF and notifies when TGTs are collected. The second monitors for clipboard changes and returns them. github.com/jakobfriedl/tgt-m… github.com/jakobfriedl/clipb…
Burnout retweeted
NTLMv1 is still out there. And now it’s easier than ever to break.
@skylerknecht walks through how Google’s rainbow tables make NT hash recovery practical, no third-party service required.
Check it out! ⤵️ ghst.ly/4vqx9Id
Burnout retweeted
Releasing one of my research tools: EVENmonitor🖥️
Inspired by LDAPmonitor, I implemented a monitoring tool for the Windows Event log in pure python. You can just attach it via the network and then filter for specific event IDs or keywords.
Available at: github.com/NeffIsBack/EVENmo…
Burnout retweeted
With Microsoft disabling RC4 for Kerberos come summer, will that affect Ntlmv2 or will it stick around for a few more iterations?
Burnout retweeted
PSA: That 'Disable NTLMv1' GPO you set years ago? It’s lying to you. LmCompatibilityLevel set to 5 is not enough. silverfort.com/blog/ntlmv1-b…
Burnout retweeted
KrbRoastParser - a tool for parsing Kerberos packets from pcap files to extract AS-REQ, AS-REP and TGS-REP hashes github.com/jalvarezz13/Krb5R…
Burnout retweeted
Every Sliver C2 Tutorial Was Outdated. So I Wrote My Own medium.com/@aviraj3868/every…
Burnout retweeted
LDAPNomNom
Can quietly and anonymously bruteforce Active Directory usernames at insane speeds from Domain Controllers by abusing LDAP Ping requests (cLDAP). No Windows audit logs generated. High speed ~ up to 50K/sec per server. You can go way beyond that with multiple servers in parallel
github.com/lkarlslund/ldapno…
Burnout retweeted
ProxyBlob. tool designed to create SOCKS proxy tunnels through Azure Storage services, by @quarkslab
github.com/quarkslab/proxybl…
Burnout retweeted
ICMP data exfiltration is underestimated.
lolexfil.github.io/#tool=ICM…
ICMP traffic is often excluded from firewall log ingestion, and on endpoints most EDRs neither alert on this exfiltration method nor expose the ICMP payload content needed to build custom detections.
