Public curated feed for visitors
Active view
36 of 411 entries
Notes from building a soundness linter for o1js and Noir, and finding the same bug class in four unrelated languages. submitted by /u/Witty_Process_199 [link] [comments]
We run fourteen AI agents that triage Elastic InfoSec alerts. They were taking 19 LLM calls to do work that needed 8. Here's the five-step optimization loop we run across the fleet, plus the prompt template you can use with any AI assistant.
submitted by /u/JosefumiKafka [link] [comments]
Where can i find the cracked Cobalt Strike ? submitted by /u/Narrow-Anybody1047 [link] [comments]
OffsetInspect is a PowerShell toolkit for detection-boundary analysis and binary inspection, built around a question that comes up constantly when developing tooling: you know *that* an offset triggers, but what is actually there, and are there other independently-detectable regions you'd miss by only looking at the first hit? The core (`Invoke-OffsetInspect`) maps byte offsets back to source lines and hex context — UTF-8 and UTF-16 with byte vs. character position separated — so whatever offset a boundary search returns, you immediately have the surrounding construct. `Invoke-OffsetThreatScan` is an independent implementation of the ThreatCheck-style bisection workflow (no bundled source or binaries). It reports DetectionPrefixLength with confidence and stability fields, and is explicit that the boundary is the earliest triggering prefix — not the complete signature. The part I found most useful: `Invoke-OffsetThreatScanRegion` discovers *multiple* independently-detectable regions by splitting a file into segments and scanning each through AMSI entirely in memory. Nothing detected is written to disk, so Defender real-time protection is never triggered or reconfigured. Each hit get
submitted by /u/Yonarv [link] [comments]
r/netsec r/rust r/eBPF r/blueteamsec r/AIAgents Open source, Apache-2.0. Solo build. Looking for people to break it. The problem Most agent guardrails run inside the process they are supposed to govern. Prompt injection lands, the agent calls a tool, and the policy layer is sitting in the same trust domain as the thing it is policing. An application-layer allowlist does not survive the agent shelling out. So the enforcement point moved down to the syscall boundary. Architecture (two planes) Kernel floor. BPF-LSM hooks on execve, inode_create, inode_unlink, connect, and cap_capable. Enforcement is cgroup-scoped via bpf_get_current_cgroup_id(), so only the governed agent’s cgroup is subject to allow/deny. Every other task on the host passes through untouched. That scoping is the anti-lockout guarantee and it is also why you can arm this on a working machine instead of a spare one. Requires kernel 5.16+, CONFIG_BPF_LSM=y, lsm=bpf. No VM, no Kubernetes, no sidecar. Userspace gate. A single per-host daemon over a UNIX domain socket, framed wire protocol, fails closed. Per request: 1. SO\_PEERCRED for kernel-verified PID/UID/GID. No client-declared identity is trusted. 2. HMAC-SHA256 env
Video with demonstration: https://www.youtube.com/watch?v=0jYANlHq0UA submitted by /u/lsecqt [link] [comments]
Red teams often spend most of their time improving payloads, bypassing endpoint controls, and refining post-exploitation techniques. But many operations are exposed much earlier because of weak command-and-control infrastructure. A payload can be technically strong and still fail if the surrounding infrastructure is easy to identify, block, or trace. Common mistakes include: Hosting the teamserver directly on a public VPS Leaving management ports exposed Using default framework certificates Reusing domains, IP addresses, or hosting patterns Keeping predictable URI paths, headers, and beacon behavior Forwarding every incoming request to the teamserver Connecting from identifiable operator IP addresses Using the same infrastructure across multiple engagements A stronger design separates the operator, teamserver, redirector, and target environment. The teamserver should remain behind private access controls, while public-facing redirectors handle communication from the target. Redirectors can filter expected traffic, reject unrelated scans, and reduce direct exposure of the backend infrastructure. However, simply adding a redirector does not solve everything. The backend can still be
Confirmed you're in scope for CCPA? Now comes the cybersecurity audit requirement. In Part 2 of this blog series, we cover what it entails, the phased timeline, and the penalties for non-compliance.
We tested two agentic SOC architectures in parallel across 36,822 real Agent Builder conversations. One won by 5.7x: a specialized workflow triaging alerts for $0.69 each, against $3.42 for a single agent juggling 14 Skills. The data and the decision framework are both below.
ClearFake claims the crown again and CastleLoader debuts in this month’s edition of Intelligence Insights.
[ Removed by Reddit on account of violating the content policy. ] submitted by /u/Virtual-River-6561 [link] [comments]
California updated CCPA... again. Before you do anything else, does it apply to you? In Part 1 of this blog series, we clarify who falls under scope, what data is covered, and how enforcement works.
We ran the wp2shell WordPress RCE chain end-to-end with Elastic Defend. Detection rule walkthrough, IOCs, and hunt guidance.
Elastic InfoSec tested this detection rule pattern on their own cloud fleet, filtering noisy curl and wget events with deterministic logic and LLM triage so only genuine threats reach an analyst.
submitted by /u/theotherseanRFT [link] [comments]
submitted by /u/minfrihet [link] [comments]
Havoc provides a flexible platform for command-and-control operations, but the framework itself is only one part of the tradecraft. The same deployment can be either controlled and low-noise or highly detectable depending on how it is configured and used. Important operational considerations include: Listener exposure TLS configuration Redirector placement Callback timing Sleep and jitter values Payload staging Operator access controls Logging Infrastructure reuse Cleanup after execution Default configurations may create recognizable patterns. That is why operators should understand: What network traffic the agent generates Which processes and APIs are used How tasking is delivered What artifacts remain on the host How defenders could identify the framework Which behaviors should be modified for the engagement The goal should not be to run more commands. The goal should be to complete the objective while producing the smallest necessary operational footprint. Technical guide: https://www.redfoxsec.com/blog/havoc-c2-complete-guide-for-red-teamers-installation-commands-and-operational-use What matters more when evaluating a C2 framework: extensibility, operational security, or detect
Device code phishing is quietly becoming one of the more effective techniques targeting M365 environments. In this blog, we detail how it works and the Conditional Access controls that shut it down.
submitted by /u/Cyb3r-Monk [link] [comments]
submitted by /u/Important_Map6928 [link] [comments]
New episode of The Weekly Purple Team covering Pass-the-Ticket, and I wanted to share it here since it might be useful for people working on detection coverage for T1550.003. In this episode, we are Stealing Kerberos Tickets Past Defender and Credential Guard using AutoPtT Video: https://youtu.be/s5nd8u4EKFI What's covered: Enumerating logon sessions and cached Kerberos tickets on Windows 11 Using AutoPtT to export a TGT by LogonId — it's a standalone PtT tool (C#/C++/Crystal/Python/Rust) built as an alternative to Rubeus/Mimikatz for this specific attack Taking that exported ticket and reusing it for authentication from a Linux box, not just staying inside the Windows ecosystem Detection side: what telemetry actually surfaces this LSASS access patterns, abnormal logon session behavior Reference: https://github.com/ricardojoserf/AutoPtT Also touched on Credential Guard and Defender as mitigations — Credential Guard blocks the classic LSASS-memory extraction path, but it's not comprehensive coverage for PtT broadly, and rollout consistency across a fleet is worth double-checking rather than assuming. Curious if others here are seeing PtT attempts that specifically try to pivot off-h
TLDR: AD collectors, SharpHound included, don't look at CN=Deleted Objects. That leaves tombstoned accounts invisible to BloodHound, even ones that sat in Tier Zero groups before deletion and are still recoverable for months in a Recycle Bin domain, group memberships and password hash intact. I wrote a tool that enumerates those tombstones over LDAP, works out who can reanimate each one, and emits BloodHound OpenGraph, so you can see directly in your graph who could bring a dead Tier Zero identity back. Reanimating doesn't hand you the credential though, you still need to work through it. So, after "finishing" the skewrun, i went back to work in another tool that extends the default bloodhound, but lets start with the technique :P Ad collectors (at least the default ones you see around) skip the CN=Deleted Objects, but with the AD Recycle Bin on, a deleted object becomes a tombstone that keeps its attributes for the deletedObjectLifetime window (180 days by default) until it's reanimated or garbage-collected, so with the collectors ignoring it those objects never enter the BloodHound, and paths that would be possible with them aren't computed. That's Because tombstones are recovera
I'm building an open-source vulnerability scanner in my free time, nothing special, just a single tool that orchestrates 90+ tools into a single pipeline, then uses an LLM to triage results, generate PoCs, suggest mitigations, and cluster related findings by root cause. Everything runs inside Docker (BlackArch-based image with Chaotic AUR support) to ensure a clean environment with all tools installed. Targets can be URLs, IPs, CIDRs, local paths, container images, or git repos. A few things you might find interesting: Configure nearly every aspect of the scan through a single TOML file, environment variables, or CLI flags. All three layers merge in priority order Asset discovery pipeline: subfinder, dnsx, httpx run before the main scan, turning a bare domain into a list of live subdomains automatically 90+ tools across categories: web (Dalfox, Cariddi, Kiterunner, RESTler), network (Nmap, smbmap), secrets (TruffleHog), SAST (Horusec), screenshots (GoWitness), OSINT (theHarvester), and more LLM analysis pipeline: triage, PoC generation (and execution), mitigation, and finding clustering by root cause. Works with any OpenAI-compatible endpoint (local models included) Plugin system:
🚨 One of the biggest misconceptions in cybersecurity: Red Teaming ≠ Penetration Testing Many beginners use these terms interchangeably. They're not the same. A Penetration Test asks: The goal is to identify and validate as many security weaknesses as possible. A Red Team Engagement asks: The focus shifts from finding every vulnerability to emulating a real-world attacker by combining technical attacks, stealth, persistence, and sometimes even social engineering. Think of it this way: 🔍 Penetration Testing • Find vulnerabilities • Validate impact • Produce a remediation report 🎯 Red Teaming • Simulate a real attacker • Test people, processes, and technology • Measure detection and response capabilities Neither is "better." They solve different problems. Understanding that distinction is an important step in your cybersecurity journey. Which one interests you more: Penetration Testing or Red Teaming? submitted by /u/SpiritualDog9743 [link] [comments]
Operational notes can contain far more detail than the final client report. Examples may include: Failed payload attempts Infrastructure changes Internal hypotheses Detection assumptions Operator mistakes Abandoned attack paths What should remain in internal lessons learned, and what should always be disclosed to the client? submitted by /u/redfoxsecurity [link] [comments]
DPRK-aligned hackers hid malware inside SVG flag images to backdoor developer job interview coding tests. Not one antivirus vendor caught it.
Intrinsics are functions used in code that are later replaced - typically with compiler-generated instructions. Examples of intrinsics include __movsb, which generates a rep movsb instruction; and __stosb, which generates a rep stosb instruction. Crystal Palace provides a handful of built-in intrinsics, such as __resolve_hook, __tag_x, and
A lot of people entering red teaming focus first on tools, payloads, and C2 frameworks. But during real engagements, the most valuable skills often seem to be: Understanding Active Directory deeply Identifying realistic attack paths Maintaining OPSEC Modifying tooling when defaults fail Recognizing detection opportunities Documenting evidence properly Communicating business impact Knowing when an action is too risky Running a tool can produce an alert. Understanding the environment can produce a meaningful compromise path. For experienced operators, what skill made the biggest difference when you moved from labs to real red-team engagements? submitted by /u/redfoxsecurity [link] [comments]
submitted by /u/Individual_Squash_59 [link] [comments]
Full disclosure I'm at Escape but wanted to share something we found that would be interesting to those here! Escape's security research team found a Broken Access Control flaw in Immich which let any user read photos in a locked folder without the required PIN. Immich is a self-hosted media platform with 100k+ stars on GitHub. Their "locked folder" hides sensitive assets behind a PIN-elevated session. What we found: Four of the five search endpoints enforce that; POST /search/random doesn't. If you send it with the visibility field simply omitted and it returns the caller's locked assets from a session that never entered the PIN, and, with a partner relationship, the partner's locked assets too. If you're interested in how we did it or how you can reproduce it yourself the full breakdown with reproduction instructions is linked! And if anyone has any questions we would love to answer them. submitted by /u/EscapeSecurity [link] [comments]
Hi everyone, I wanted to share a side project I've developed: SecInterview (https://secinterview.dev). It's a multi-agent architecture platform designed to simulate technical interviews for security positions with realistic, diverse scenarios. Given that this subforum has a rather technical, offensive security community, I'm especially looking forward to your feedback on our Pentest/Red Team tracks. What it does: Unlike general Q&A bots, it tests you with simulation scenarios based on your experience, dynamically delves deeper into your answers, challenges and tests you (e.g., if you mention a privilege escalation technique or AD exploit, it will guide you to the full mechanism, or it will take away your tools and give you areas where you can demonstrate what you can do). Ultimately, it creates a comprehensive technical scorecard evaluating your jargon, accuracy, and weaknesses. If you can spare a few minutes, I would love for you to run a free simulation and let me know if the questions are realistic or if the AI needs more technical depth. The first run is completely free: https://app.secinterview.dev Thank you for your time, and I look forward to your feedback! submitted by /u
Hi everyone, I've been developing CMScan, an open-source CMS security scanner. Unlike WPScan, it supports multiple CMS including WordPress, Drupal, Joomla, Magento, Shopify, TYPO3 and OpenCart. Features include: CMS fingerprinting User enumeration Plugin/theme detection Vulnerability lookup (OSV, NVD, FriendsOfPHP...) Security headers audit CSV export I'm looking for feedback and feature suggestions. GitHub: https://github.com/moloch54/CMScan submitted by /u/JackfruitFun6602 [link] [comments]