I spend a significant amount of time reading security stuff. Co-Founder/Partner @CoastlineCyber https://xitter.cf/t.co/ZQT5L8q2RO
ɴ̵̢̧̮̮̹̖̳͍̳̣̻̰̯̜̰̰̭̑̌̊̿̀̾͑̆̀̈́
Joined January 2012
- Tweets5.6K
- Following638
- Followers17.5K
- Likes4.1K
Paul Seekamp retweeted
It seems that MS update prevents coercion and relaying via WebDAV.
Defeating SMB signing as described in QT will most likely be patched as well.
There is a PR for a module in NetExec
I wrote up a way to defeat enforced SMB signing for relay.
It abuses a documented SMB re-authentication behavior.
I'm surely missing nuance and prior art. Corrections welcome.
Writeup:
blackfield.ch/blog/defeating…
PoC:
github.com/aas-n/reauthx
Paul Seekamp retweeted
Did anyone say Shadow Credentials?🔑
A common alternative to RBCD is to add a certificate to a computer acc. However, inspecting or removing them later on was not possible with NetExec so far. Heavily inspired by pyWhisker, I wrote a module to interact with these Shadow Creds
ALT Manipulating Shadow Credentials using NetExec
Paul Seekamp retweeted
The @OWASP_AISVS 1.0 is now released and live!
github.com/OWASP/AISVS/blob/…
cc @ottosulin @ricokomenda Russ Memisyazici and Raza Sharif
Paul Seekamp retweeted
🔓 CVE-2025-33073: Any domain user → SYSTEM → DC TGT → domain compromise. No admin needed.
SMB signing on DCs won’t save you.
praetorian.com/blog/cve-2025…
#theguardplatform #offensivesecurity
Paul Seekamp retweeted
Let's start 2026 with a major Responder update!
It now supports:
- CLDAP ping pong to SMB auth.
- SNMPv3 authentication and hashes.
- New rogue Kerberos server forcing AS-REQ when receiving TGS-REQ + support for Kerberos type 17/18 hashes.
- IMAP support for NTLM authentication.
- SMTP support for AUTH PLAIN LOGIN CRAM-MD5 DIGEST-MD5 NTLM authentication.
- DCE-RPC server now supports SAMR, SRVSVC, WKSSVC, WINREG, SVCCTL, ATSVC, DNSSERVER
- DNS server now supports SOA, MX, SRV, ANY, etc
-> SOA -> Appear as the authoritative DNS server
-> MX poisoning → Email client connects to rogue SMTP/IMAP → capture credentials
-> SRV poisoning → Domain services connect to rogue SMB/LDAP/Kerberos → capture NTLM/AS-REQ
- LDAP GSSAPI, GSS-SPNEGO, NTLM, DIGEST-MD5
git pull
or
git clone github.com/lgandx/Responder.…
Happy new year to everyone!
Paul Seekamp retweeted
[Tool]
github.com/zyn3rgy/RelayInfo…
[Blog]
specterops.io/blog/2025/11/2…
Paul Seekamp retweeted
ShareHound: An OpenGraph Collector for Network Shares - @podalirius_
specterops.io/blog/2025/10/3…
Paul Seekamp retweeted
Even with patches provided with bug reports, AI makes too much human work in prioritizing & testing. Commercial closed source faces similar bottlenecks & diminishing security returns. Vuln handling can’t keep up even if using AI validation. Security is being DoSed by AI right now
Paul Seekamp retweeted
Credential Guard was supposed to end credential dumping. It didn't.
@bytewreck just dropped a new blog post detailing techniques for extracting credentials on fully patched Windows 11 & Server 2025 with modern protections enabled.
Read for more ⤵️ ghst.ly/4qtl2rm
Paul Seekamp retweeted
Trust Issues – Attacking Trust in Active Directory
TLDR; this blog covers attack chains abusing Trust account TDO in One-Way Outbound & Bidirectional Trusts. What the TDO can/can't do and Compromise shura.lab via shared CA trust in kapla.lab
lorenzomeacci.com/trust-issu…
Paul Seekamp retweeted
Can we eliminate the C2 server entirely and create truly autonomous malware?
On the Dreadnode blog, Principal Security Researcher @0xdab0 details how we developed an entirely local, C2-less malware that can autonomously discover and exploit one type of privilege escalation vulnerability.
A future where fully autonomous red team assessments are powered by nothing more than a pre-installed local model and a Lua interpreter may be closer than you’d imagine.
Read about it here: dreadnode.io/blog/lolmil-liv…
Paul Seekamp retweeted
I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: dirkjanm.io/obtaining-global…
Paul Seekamp retweeted
The GroupPolicyBackdoor tool, presented at #DEFCON 2025, is now available on Synacktiv's GitHub: github.com/synacktiv/GroupPo…
This python utility offers a stable, modular and stealthy exploitation framework targeting Group Policy Objects in Active Directory!
Paul Seekamp retweeted
Microsoft isn’t disclosing this so: M365 Copilot allowed users to access files without producing an audit log. All you had to do was ask Copilot to not link to the file. You don’t even have to ask; it sometimes just happens. If your org uses Copilot your audit log is likely wrong
Paul Seekamp retweeted
🛡️ AI-Powered SQL Injection Just Got Real - 𝗦𝗤𝗟𝗠𝗮𝗽 𝗔𝗜 𝗔𝘀𝘀𝗶𝘀𝘁𝗮𝗻𝘁
An SQL Injection testing assistant powered by AI.
Came across a powerful tool blending LLMs with offensive security.
🔗 github.com/atiilla/sqlmap-ai
#CyberSecurity
