Aku retweeted
Release 2.2.1 of objectwalker is out! 🥳🎉
Fixes a few bugs and optimized the search!
Very useful for solving Python jails or finding Server Side Template Injection payloads in python
github.com/p0dalirius/object…
Aku retweeted
I am delighted to announce that Microsoft has awarded me the title of Microsoft MVP for my contributions in the security field.🥳
I want to thank all those with whom I have worked over the years, and in particular @_mudpak, @mpgn_x64, @NoobosaurusR3x, @HacktBack and @Akumarachi
Aku retweeted
I've just released GeoWordlists, a tool to generate wordlists of passwords containing cities at a defined distance around the client city.
This is pretty useful for spraying / bruteforcing in internal pentests on an Active directory domain for example!
➡️github.com/p0dalirius/GeoWor…
Aku retweeted
The DOJO challenge #23 is over!
We have our 3 winners! 🏆
Congrats to @PerceSecu, @Iknownaught , Aku
The swag are on their way!
Keep an eye on your mailbox 📬
You can find the solution and a write-up for the DOJO challenge on our blog 👇
blog.yeswehack.com/dojo/dojo…
#YesWeRHackers #BugBounty
Aku retweeted
(1/3) I've released publicly a new tool/library called #objectwalker that I have been working on for a few months. 🥳
ObjectWalker allows you to find paths into python objects to find interesting targets, in breadth first search or depth first search!
➡️github.com/p0dalirius/object…
Aku retweeted
Let’s goo, @EuCyberCup is over 🏴☠️
🥇 We won the bug bounty (@Wlayzz did it all)
🥉 We ended 3rd on Forensic
🥉 And we finished 3rd on general scoreboard (1st enterprise team)
We had a blast, great orgs, great challs, great teams, big improvement since 2022 ✌️
Voici le classement complet de cette #EC2 2023 ! 🏆
Un grand bravo aux ESNARCOTRAFIQUANTS pour leur victoire ! 👏
ALT Classement final de l'EC2 2023
Aku retweeted
Completed implementing built-in pass-the-hash in #BRc4 after spending a lot of time with Mimikatz and a great blog written by @ShitSecure . More interesting things are on the way. The below blog is a must read to understand the technique at code level.
s3cur3th1ssh1t.github.io/Nam…
Aku retweeted
Big up to @Fransosiche and @Wlayzz for the new "HTTP Request Smuggling" page on The Hacker Recipes 🧑🍳
thehacker.recipes/web/config…
Aku retweeted
I've just published a little #osint tool to extract all the users from a #GiTea server, with or without authentication. This is really useful to create wordlists of possible usernames in redteams for example ;)
github.com/p0dalirius/gitea-…
Aku retweeted
Last year, I tweeted about #Administrator accounts not following the #lockout policy.
Yesterday, @Microsoft issued an advisory (#KB5020282) solving this problem by adding an #account lockout to local administrators accounts: ⤵️
support.microsoft.com/en-us/…
xitter.cf/podalirius_/status/143…
Did you know that the Administrator account of a Windows domain is not subject to the lockout policy ? We tried this with @_nwodtuhs with our tool #smartbrute
This is intentional to prevent an attacker from performing a DoS by locking the Administrator account.
Aku retweeted
Tired of having to record your actions by hand during your pentest? Don't panic, Exegol 4.0.5 is here with an automatic recording of your sessions (input and output)
Also a new system of filesystem rights shared between your host user and your container.
github.com/ShutdownRepo/Exeg…
Aku retweeted
Just updated my ADCS cheatsheet with the new ESC9 & 10 attacks, and a refactor of the page : hideandsec.sh/books/cheatshe…
Additionally, I have added these ESC to The Hacker Recipes of @_nwodtuhs with more explains on this page : thehacker.recipes/ad/movemen…
Aku retweeted
TIL : Super Magic Hashes and PHP Bcrypt limitation :
PHP Bcrypt implementation truncate password when a nullbyte is encountered (and also at 72 chars).
offsec.almond.consulting/sup…
paragonie.com/blog/2015/04/s…
Aku retweeted
Just got back from #BARBHACK22 😴 it was awesome! Great talks, did one as well, played the CTF all night, met awesome people, see you all next year 😎 gg to the organisers @_barbhack_
In this thread, some of our key moments with @Capgemini
Aku retweeted
New version of #AperiSolve !
aperisolve.com/
- New Design
- New CheatSheet
- CLI support
- New domain
- Multi language support
- Replace Json with MongoDB
#CTF #Steganography #Steganlysis
Aku retweeted
We all dream of receiving #HTTP authentications to relay them to #LDAP right ?
Release 1.3 of #Coercer now adds WebDAV support to coerce remote #Windows machines to perform HTTP authentications! 🥳🎉
github.com/p0dalirius/Coerce…
Aku retweeted
Heard of #Printerbug, #PetitPotam, #ShadowCoerce and #DFSCoerce ? These are only the tip of the Iceberg and there is probably many more to find. 👀
Want to find a new call ? Here is 242 probable #RPC calls with python poc ready to be triaged! 🎉
github.com/p0dalirius/window…
Aku retweeted
Ever wanted to trigger a #NTLM authentication to a machine using every possible RPC call ? You can do this using #Coercer 🥳🎉
This tool automatically detects available pipes and protocols and call every possible functions to trigger an #authentication.
github.com/p0dalirius/Coerce…