0x74 0x68 0x65 0x72 0x65 0x20 0x61 0x72 0x65 0x20 0x31 0x30 0x20 0x74 0x79 0x70 0x65 0x73 0x20 0x6f 0x66 0x20 0x70 0x65 0x6f 0x70 0x6c 0x65 0x74 0x68 0x6f 0x73 0x65 0x20 0x77 0x68 0x6f 0x20 0x75 0x6e 0x64 0x65 0x72 0x73 0x74 0x61 0x6e 0x64 0x20 0x62 0x69 0x6e 0x61 0x72 0x79 0x20 0x61 0x6e 0x64 0x20 0x74 0x68 0x6f 0x73 0x65 0x20 0x77 0x68 0x6f 0x20 0x64 0x6f 0x6e 0x74
01110100 01101000 01100101 01110010 01100101 00100000 01100001 01110010 01100101 00100000 00110001 00110000 00100000 01110100 01111001 01110000 01100101 01110011 0xdeadbeef 0xcafebabe 0x1337
0x74 0x68 0x6f 0x73 0x65 0x20 0x77 0x68 0x6f 0x20 0x75 0x6e 0x64 0x65 0x72 0x73 0x74 0x61 0x6e 0x64 0x20 0x62 0x69 0x6e 0x61 0x72 0x79 0x20 0x61 0x6e 0x64 0x20 0x74 0x68 0x6f 0x73 0x65 0x20 0x77 0x68 0x6f 0x20 0x64 0x6f 0x6e 0x74 0x74 0x68 0x65 0x72 0x65 0x20 0x61 0x72 0x65 0x20 0x31 0x30 0x20 0x74 0x79 0x70 0x65 0x73 0x20 0x6f 0x66 0x20 0x70 0x65 0x6f 0x70 0x6c 0x65
01010111 01100101 00100000 01101000 01100001 01100011 01101011 00100000 01110100 01101000 01100101 00100000 01110000 01101100 01100001 01101110 01100101 01110100 01100110 00110000 01111000 01100110 00110100 01100100 01100101
0xf4de logo

0xf4de Feed

Public curated feed for visitors

Sign in

Active view

All watched feeds

36 of 685 entries

RedTeamSec2026-10-25

I built a black-box Docker range for Node2Shell (CVE-2026-111497) — crash the engine 3 times to unlock the flags

Last week's Node.js buzz was the Brotli decoder OOB write the community dubbed Node2Shell. I turned it into a hands-on black-box lab. The premise: you're poking at a "PacketLedger" freight gateway. The page never mentions the CVE or the vuln class — you fingerprint the engine yourself, find the decode path, and work out what kills it. The gate is unusual: no flag until you trigger 3 recorded engine crashes (the supervisor keeps count). Full RCE exists but it's treated as a platform-dependent easter egg, so DoS-chain players get a real win too. Double flag (second one behind a path-traversal), 5-step hint ladder, difficulty ~3.5/5, full solve verified by a local LLM pentest agent. One docker compose up, no cloud calls, MIT. It's part of my *2Shell lab series (php2shell-lab is the sibling). github.com/tani2shell/node2shell-lab Curious how people approach the fingerprinting blind — how did you decide to attack the compression layer at all? submitted by /u/xiaogutongxue [link] [comments]

evasion
Read entry
RedTeamSec2026-10-24

I red-team my own AI governor in public. The inbound half shipped today — come try to get something past it

Red-teamers, this is built in your image, so I'm bringing it to you first. Full disclosure: it's my project, open source (MIT), shipped today. The Arrakis 2026 threat report found 24% of dormant production agents can be started by an unsigned webhook. The deeper problem: an agent reads data and instructions in the same stream and can't natively tell them apart. So the world hides orders inside the data — a page that says "send the credentials," a tool result with a second job tucked inside, content wearing a fake SYSTEM: header. Sentinel is the inbound half of my governor. QuietOS governs what an agent DOES; Sentinel governs what it HEARS. The law: only the owner issues instructions; everything else is data. World content is inspected before the brain sees it. Anything instruction-shaped from a non-owner source gets held for the owner with the exact content preserved verbatim, and every attempt lands in an append-only attack ledger. I red-team my own work and publish the results — the governor just survived an 18-scenario true batch against a live 120B model with zero bypasses. And the honest part: Sentinel v0.1 has four known holes (synonym-crafted exfiltration, leetspeak override

evasion
Read entry
RedTeamSec2026-10-23

KrakenHashes 3.0.0 Released - Cloud GPU and network share support

KrakenHashes 3.0.0 released - distributed hashcat with cloud GPU provisioning, self-updating agents, and a rebuilt UI For anyone who hasn't run into it: KrakenHashes is a self-hosted system for running hashcat across a fleet of machines. You point agents at a server, upload hashlists, and it handles scheduling the work across whatever GPUs you have, tracking progress, and keeping a potfile you can reuse across engagements. It's AGPLv3 and aimed at pentesters and red teams who have permission to crack what they're cracking. 3.0.0 is the biggest release since I started it. A few things I think are worth calling out: Cloud GPU provisioning. If your own agents are saturated, a job can now rent GPUs on demand and give them back when it's done. Everything is budgeted per client, the rented box gets only the files that job needs, and there are several independent paths that guarantee teardown so you don't wake up to a bill. AWS is tested end to end with real money. RunPod and Vast.ai are fully built but I haven't run real spend through them yet, so they're flagged experimental in the UI. Cloud agents have to join over a VPN, there's no option to expose them straight to the internet, and t

evasioncloud
Read entry
RedTeamSec2026-10-23

WinLPEAuditor - Windows LPE Misconfiguration Auditor in C++ with a Terminal UI

Current checks cover unquoted service paths, AlwaysInstallElevated policy, dangerous token privileges (SeImpersonate, SeDebug, etc.), modifiable service binaries via ACL parsing, Point and Print misconfigurations, writable Run/RunOnce keys, startup folder permissions, and WSL distributions defaulting to root. The architecture is modular - implement the ICheck interface, register it, done. Adding new checks doesn't touch existing code. The main reason this exists as a compiled C++ binary rather than a PowerShell script: it runs fine in environments where CLM is enforced or AMSI is catching script-based tooling. No .NET, no script engine, just Win32 API calls. More checks coming. Feedback and contributions welcome. submitted by /u/0xby7eMe [link] [comments]

Read entry
RedTeamSec2026-10-23

php2shell-lab — a black-box Docker range for PHP2Shell (CVE-2026-109618/19) with a closing heap-leak window

I built a reproducible, engine-level practice range for PHP2Shell and put it on GitHub. Not another "run the PoC" box: Black-box by design — no Server: PHP, no phpinfo, version fingerprinting must come from behavior, not headers The heap-disclosure window is time-boxed: it's open right after boot and closes. Leak first, recon second — window time spent browsing is gone until next up Two privilege paths to proof.txt, different elegance grades Honest platform matrix: RCE landing verified on x86_64; on Apple Silicon/ARM the disclosure chain is the intended solution (documented, not hidden) Calibrated against an autonomous pentest agent over multiple live-fire rounds; human expectation 2–4h > docker compose up -d --build and go. MIT licensed, full kill chain in docs/SOLUTION.md. https://github.com/tani2shell/php2shell-lab Feedback and write-ups welcome — file an issue if a step fights you. submitted by /u/xiaogutongxue [link] [comments]

evasion
Read entry
RedTeamSec2026-10-22

PHP2Shell Exposure Hunting - Do you have it across your estate and where?? An Advanced Hunting pack for Defender XDR

I know this is red team, but sharing it widely in case it even helps one person - remove if not appropriate 🖤 This hunting set seeks to fill a gap while we all respond - there are plenty of IOC hunting repos, exposurehunt aims to help surface and verify known and unknown instances of naughty PHP. I’ve spent the evening heavily developing and testing (in prod, where else) what appears to now be a relatively robust coverage set of 6 sequenced KQL/Advanced Hunting queries, 3 each across Linux and Windows. Sharing the love. Copy pasta, follow the in-line guidance - Might be useful in addition to your current methods! PRs welcome, if they don’t suck, and if my robot agrees. https://github.com/deathbydata/php2shell-exposurehunt Happy hunting! ☺️ submitted by /u/deathbydata0 [link] [comments]

evasion
Read entry
Black Hills Infosec2026-10-22

Detection Engineering: Stop Drowning in Alerts and Start Catching Bad Guys

Detection engineering is both a role and an activity. It’s the discipline of building and maintaining the logic that identifies malicious or risky behavior within your organization. It’s where security analysis meets software engineering, turning raw logs and telemetry into actionable detections that defenders can rely on.

evasion
Read entry
RedTeamSec2026-10-22

php2shell exploitation reality: why the public PoCs are not landing shells

The leaked php2shell bugs (CVE-2026-109618 / 109619) hand you an OOM-driven memory corruption primitive in PHP core, but turning that into code execution is where it stalls. The public PoCs making the rounds are lab-only. None clears ASLR on x86-64, and the read from VulnCheck, HackingLZ and MalwareTech is that a reliable chain needs a second weakness or a target without ASLR, think 32-bit or a single-worker PHP-FPM setup. We tracked how operators are handling that gap in their own open directories: straight public PoC reuse, a pentest-style assessment that judged its target not exploitable, and one mass-exploitation kit that sprayed 123 servers through a proxy farm and logged zero shells. Useful if you are calibrating how far this is from a usable capability right now. submitted by /u/Straight-Practice-99 [link] [comments]

malware
Read entry
RedTeamSec2026-10-22

CVE-2026-46633: Proving exploitability of Twig sandbox bypass

I continued researching sandbox bypasses discovered in Twig by project Glasswing. This time, I focused on CVE-2026-46633, which still had no public exploits. This writeup documents my development of payloads for the CVE-2026-46633 and the corresponding SSTImap modules. submitted by /u/vladko312 [link] [comments]

evasion
Read entry
TrustedSec2026-10-22

Trimarc, 18 Months Later at TrustedSec

Eighteen months after Trimarc joined TrustedSec, the work speaks for itself. In this blog, we reflect on Trimarc’s integration into TrustedSec and what it means for customers, services, and ongoing research.

Read entry
RedTeamSec2026-10-22

Confluence C2

Created a C2 which uses confluence API to communicate between victim and server which is again connected to confluence using api. submitted by /u/coyotegowda [link] [comments]

c2
Read entry
RedTeamSec2026-10-21

New Update — Evil Agent 📡

Introducing Evil Agent, a new payload generator for Discord and Telegram agents, supporting EXE, DLL, BIN, and HEX formats, with configurable message sizes and an alternative communication channel without requiring a dedicated listener or exposed port. The update also includes fixes to the existing Listener Payload Generator, Makefile improvements for smoother compilation, and GUI enhancements. submitted by /u/S3N4T0R-0X0 [link] [comments]

Read entry
RedTeamSec2026-10-20

CVE-2026-46633: Proving exploitability of Twig sandbox bypass

I continued researching sandbox bypasses discovered in Twig by project Glasswing. This time, I focused on CVE-2026-46633, which still had no public exploits. This writeup documents my development of payloads for the CVE-2026-46633 and the corresponding SSTImap modules. submitted by /u/vladko312 [link] [comments]

evasion
Read entry
RedTeamSec2026-10-20

Writing a Beacon Object File (BOF) from Scratch in C

Wrote a walkthrough on building a Beacon Object File from scratch in C. The post covers how Beacon acts as a minimal COFF linker/loader at runtime, how the MODULE$Function convention gets resolved via LoadLibraryA/GetProcAddress under the hood, and why BOFs produce almost no telemetry compared to execute-assembly or fork&run patterns. The example BOF enumerates privileges on the current process token using only dynamic Win32 API resolution and stack allocation - no CRT, no heap, no static imports. Also included a section on defensive considerations: in-memory COFF parsing patterns, GetProcAddress bursts, and where kernel-level telemetry still catches you. Feedback welcome - especially on patterns people have seen EDRs flag for BOF detection specifically. submitted by /u/0xby7eMe [link] [comments]

evasionc2kernelmalware
Read entry
RedTeamSec2026-10-20

Low-cost offensive tradecraft: a 5-month state-infra op built almost entirely from public PoCs

Good case study in cheap tradecraft. One operator, one rented server, a borrowed Log4Shell chain. The delivery script split the CommonsBeanutils2 payload across two serialized objects with a deliberate pause, then solved the blind-execution problem with a simple trick: sleep, tail the staging server's own access log, and watch for the target to pull the stager. The one piece of original work, a RouterOS SCEP heap overflow, never landed because they reversed the wrong binary. After execution they staged an SSH tunnel pivot with a dedicated no-shell account for port forwarding, fetched but never confirmed in use. Full teardown: https://hunt.io/blog/ukraine-state-data-exchange-graylog-log4shell submitted by /u/Straight-Practice-99 [link] [comments]

opsec
Read entry
RedTeamSec2026-10-20

Free real-time Certificate Transparency stream, no API key

I put up a free public CertStream endpoint for anyone monitoring phishing or lookalike domains wss://api.certstream.dev/ No API key or signup needed, just connect over WebSocket Python example: https://certstream.dev/free-certstream-api.html Open source: https://github.com/reloading01/certstream-server-rust submitted by /u/Swimming_History_432 [link] [comments]

Read entry
TrustedSec2026-10-20

Handling Pre-Contract FCI and CUI

CMMC requirements don’t exist before a contract does and that distinction matters. In this blog, we clarify what FCI and CUI obligations apply during the pre-contract solicitation phase, and where the line actually is.

Read entry
RedTeamSec2026-10-20

ParamTrace - A lightweight HTTP parameter discovery tool written in Rust

Hey everyone, I wanted to share an offensive utility I've been writing called "ParamTrace". It handles fast HTTP parameter discovery but is designed explicitly to address a few operational pain points found in heavier alternatives. When executing on minimal-footprint landing zones, lightweight containers, or mobile deployment setups (like Termux), deploying heavy Python environments for tools like Arjun or managing Burp/Param Miner instances isn't always ideal. Would love to get some feedback from operators on edge cases you run into during web app discovery! GitHub Repo: https://github.com/CurioTrace/paramtrace submitted by /u/This_Perception_617 [link] [comments]

evasion
Read entry
RedTeamSec2026-10-18

Building a loader

Hi all, Im trying to build a loader and reached 40% of maldev academy. I am building it in stages 1) getting your .bin from c2 2) memory allocation 3) execution after decryption with sleep Is there any framework or github repo you would suggest to build a fully educational purpose loader which I can use for company red team ? Also I saw some UDRL loader from Bobby cooke and aceLdr. Does UDRL still work when compared to PIC Loader ? submitted by /u/Cool_Beacon2605 [link] [comments]

c2malware
Read entry
RedTeamSec2026-10-18

[Pshell] [cybersecurity] Two hardening tools (AD+Windows) in ps1

Hey, i'm working on those two little tools, any feedback is appreciated. \\->>HostBadger, an open-source Windows hardening auditor in pure PowerShell. One read-only script takes a snapshot of each host, and you can push it through your EDR (CrowdStrike RTR or any tool that runs scripts) to a whole fleet in about 15 seconds per host. The analyzer then works offline and writes a clean HTML report with A–F scores, plus CSV and JSON Lines for your SIEM. \\- 138 checks: credentials, Defender and EDR, network exposure and NTLM relay paths, privilege escalation, logging, BitLocker \\- 1475 DISA STIG rules plus the CIS benchmark of each host's own Windows version, with the value found next to the value required \\- Vulnerable drivers (LOLDrivers), end-of-life and outdated software (endoflife.date), CISA KEV matches \\- Read-only by design, with a safety script that checks this from the code. No network unless you ask. What it can't read is "not evaluated", never clean. \\- Reversible fix scripts with rollback, and an optional AI summary where names become tokens before anything is sent Nothing to install (PowerShell 5.1 or 7): https://github.com/g4bri-3l3/HostBadger & ->>IDWolf: my own AD/

evasionadkernel
Read entry
0x00sec2026-10-17

ZIP Parser Differentials and Mutable Encrypted Filenames - Part I

Introduction When you password-protect a ZIP file, you probably assume the entire thing is locked. The contents are encrypted, sure, but the filenames are not. They sit in plaintext, in two separate records, and nothing stops you from editing them without the password. That is interesting on its own.

Read entry
RedTeamSec2026-10-16

Does DLL Sideloading Still Work in 2026?

Weekly Purple Team: DLL Sideloading with Adaptix Beacon (python315.dll) This week's episode covers DLL sideloading using an Adaptix Beacon payload hidden inside python315.dll, masquerading malicious code as a legitimate, signed process to establish C2 while evading process-based detection. On the blue team side, we break down detection — process and module load telemetry, DLL path/signature anomalies, unusual parent-child process relationships, and deployable detection rules to catch sideloading before the beacon establishes persistence. Covers T1574.002, T1055, and T1071 with the full red vs. blue format. Video: https://youtu.be/szXFXvaXiEs Happy to discuss the sideloading mechanics or the detection side in the comments. submitted by /u/Infosecsamurai [link] [comments]

c2
Read entry
RedTeamSec2026-10-16

TornadoC2 — pull-based C2 built for team operations

I released TornadoC2 today Repo: https://github.com/kamalx06/TornadoC2 Status: between beta and 1.0.0. Core is stable and usable end to end, but I'm still working through some transport edge cases, console polish, native commands, and doc gaps. Will tag 1.0.0 when those are closed. I'm posting because I made specific choices about how a C2 should work, and I'd like criticism from people who've actually run C2 in the field. If any of those choices are wrong, I'd rather hear it now. Three things worth reading about 1. Fully Malleable profiles that shape the whole response, not just its envelope. Where most tools shape the wrapper around a fixed payload model, TornadoC2's profile system controls what the response actually looks like, and it does so with one JSON file per profile. A profile declares the three request paths (check-in, tasks, results), the User-Agent with a separate Linux override, extra request headers and per-role request headers, the session cookie name, additional response headers a real server would send, and per-role HTTP status codes for check-in, tasks, results, and error paths. The shaping block then controls the structure of each body independently: an arbitrar

c2
Read entry
RedTeamSec2026-10-16

Showcase: OpenOsoosi (OshoosiClaw) - A 25-crate decentralized Rust EDR mesh with TPM 2.0 attestation, BFT multi-voter consensus, and multi-ring AI agent containment

Hey everyone, I have been building OpenOsoosi (OshoosiClaw), an open-source (Apache-2.0 OR MIT), 25-crate decentralized Endpoint Detection and Response (EDR) agent and AI agent containment mesh written in pure Rust. Most endpoint detection architectures follow a traditional hub-and-spoke model: agents collect telemetry on endpoints and stream it upstream to a centralized SIEM, data lake, or vendor SaaS. While centralized telemetry simplifies aggregation, it introduces well-known structural tradeoffs - single points of failure, ingestion bottlenecks, CGNAT/offline blind spots, and vulnerability to egress severance. Furthermore, with developers and enterprises increasingly running autonomous AI coding and OS agents (MCP servers, local LLMs, CLI agents) with ambient user privileges, traditional signature-based EDRs struggle to distinguish normal developer workflows from prompt-injected agent breakouts. I wanted to explore an alternative design: what would host defense, threat hunting, and AI agent containment look like if endpoints formed a self-healing peer-to-peer security mesh capable of reaching distributed consensus locally without relying on a central cloud controller? Repositor

evasionidentity
Read entry
0x00sec2026-10-15

LBOFS: Debugging and Anti-debugging fun with ptrace I

Lost Book of the Forbidden Syscalls This is the first installment of what I’ve called The Lost Book of the Forbidden Syscalls. A mysterious name for just a compendium of basic low-level offensive and defensive techniques commonly used by malware, anti-malware and other protected SW. You

kernelmalware
Read entry
RedTeamSec2026-10-15

Reverse engineering my own project

i wanted to red-team myself on my project and id like to know how to reverse engineer so i can see what can be done to defend against it. TLDR; i thought my project would have been harder to chew up. it was surprisingly low-effort. my app is aiming to be fully client-side. An implementation in javascript seems like it would relatively easy for an AI to swallow. my latest project is in rust, which would make it harder for a person, but AI can now digest binaries. i created a fairly unique p2p messaging app. a rust-based frontend with a rit-server backend, which can be used to establish a p2p connection. while this version remains close-source, i aimed to create comprehensive technical documentation (formal-verification and security audits too (all ai-slop-maxxing at scale under my guidance)). https://glitr.io https://app.glitr.io a core detail to my project is the focus on client-side cryptography and storage. i think my older iteration as a javascript webapp would be relatively easy for AI, so i thought id put a spin-on-things by having a rust wasm frontend. In practice, i dont think AI broke a sweat. i know nothing about decompiling, but i think the TUI would be the easiest for it

evasion
Read entry