0x74 0x68 0x65 0x72 0x65 0x20 0x61 0x72 0x65 0x20 0x31 0x30 0x20 0x74 0x79 0x70 0x65 0x73 0x20 0x6f 0x66 0x20 0x70 0x65 0x6f 0x70 0x6c 0x65 0x74 0x68 0x6f 0x73 0x65 0x20 0x77 0x68 0x6f 0x20 0x75 0x6e 0x64 0x65 0x72 0x73 0x74 0x61 0x6e 0x64 0x20 0x62 0x69 0x6e 0x61 0x72 0x79 0x20 0x61 0x6e 0x64 0x20 0x74 0x68 0x6f 0x73 0x65 0x20 0x77 0x68 0x6f 0x20 0x64 0x6f 0x6e 0x74
01110100 01101000 01100101 01110010 01100101 00100000 01100001 01110010 01100101 00100000 00110001 00110000 00100000 01110100 01111001 01110000 01100101 01110011 0xdeadbeef 0xcafebabe 0x1337
0x74 0x68 0x6f 0x73 0x65 0x20 0x77 0x68 0x6f 0x20 0x75 0x6e 0x64 0x65 0x72 0x73 0x74 0x61 0x6e 0x64 0x20 0x62 0x69 0x6e 0x61 0x72 0x79 0x20 0x61 0x6e 0x64 0x20 0x74 0x68 0x6f 0x73 0x65 0x20 0x77 0x68 0x6f 0x20 0x64 0x6f 0x6e 0x74 0x74 0x68 0x65 0x72 0x65 0x20 0x61 0x72 0x65 0x20 0x31 0x30 0x20 0x74 0x79 0x70 0x65 0x73 0x20 0x6f 0x66 0x20 0x70 0x65 0x6f 0x70 0x6c 0x65
01010111 01100101 00100000 01101000 01100001 01100011 01101011 00100000 01110100 01101000 01100101 00100000 01110000 01101100 01100001 01101110 01100101 01110100 01100110 00110000 01111000 01100110 00110100 01100100 01100101
0xf4de logo

0xf4de Feed

Public curated feed for visitors

Sign in

Active view

All watched feeds

36 of 554 entries

RedTeamSec2026-09-10

SonicWall SMA1000 as an internal attack platform: SSRF to Erlang RCE, then DCSync straight off the appliance

Tradecraft from a real campaign. CVE-2026-15409 is an unauthenticated SSRF in the SMA1000 WorkPlace interface. The /wsproxy WebSocket endpoint reaches a locally bound Erlang node, you complete the distribution handshake with the hardcoded cookie, and os:cmd() gets command exec as couchdb. Rather than pivot to an internal host, the operator kept operations on the appliance. Read policy_file.xml for LDAP binds, decrypted them, dropped a Linux secretsdump build to /tmp and ran DCSync from the edge device itself. The strong version used domain-controller machine-account hashes recovered from LSA secrets for pass-the-hash, since DC computer accounts already hold replication rights. Living on the appliance means no EDR and very little logging on the box. The exploit is a refactor of Rapid7's PoC. Full chain and scripts in the post, for awareness and detection. https://hunt.io/blog/sonicwall-sma1000-uk-council-attack submitted by /u/Straight-Practice-99 [link] [comments]

evasionadopsec
Read entry
RedTeamSec2026-09-10

Exploitation 101: Exploited a blind Python eval() injection over netcat to get RCE

Just finished a walkthrough on a picoCTF challenge that turned out to be a classic eval() injection. The service only exposed one "documented" function (getRandomNumber), but by throwing unexpected input at it and reading the Python tracebacks it threw back, I was able to figure out the server was doing something like: eval(user_input + '()') From there it was a straightforward escalation — neutralize the trailing () with a comment, drop into exec(), enumerate the filesystem, and pull the flag file directly. I made a full video breaking down the blind-probing process (no source code shown until the reveal) if anyone's interested — it's a nice beginner-friendly example of why eval/exec on user input is dangerous. https://youtube.com/shorts/Tl2g9oJnl8I Happy to answer questions about the process or the payload construction. What would you do? submitted by /u/Harkins_Technology [link] [comments]

Read entry
RedTeamSec2026-09-10

VOIDSYSCALL: Go syscall-only implant framework — 4 injection methods, 13+ anti-analysis checks, EDR handle killer, polymorphic rotation. Zero WinAPI.

https://github.com/VoidSecSoftwares/voidsyscall Check it out before saying Ai slop. Built this for engagements where the target runs Crowdstrike/Sentinel/Defender with full telemetry. Every NT primitive goes through direct or indirect syscalls resolved at runtime from ntdll - no import table, no usermode hooks. What's different from SysWhispers/Alcatraz/etc : - Polymorphic injection ; rotates between section mapping, process hollowing, APC queuing, and module stomping. No two injections look the same in memory forensics. - Handle killer ; enumerates system handles via NtQuerySystemInformation, matches owner PIDs against 30+ known EDR process names, closes the monitoring handles they placed in your process. - SSN fingerprinting ; dumps all resolved syscall numbers from the current ntdll build, generates a portable fingerprint. Detects build mismatches across jumps. - Full anti-analysis suite ; CPUID hypervisor detection (7 signatures), 13 sandbox indicators, 9 debugger checks, RDTSC timing anomaly detection. Returns a scored threat report. - Vault ; in-memory XOR cipher with auto re-keying on a timer. Heap dumps between re-key intervals get ciphertext, not plaintext. - VAD operation

evasionkernel
Read entry
TrustedSec2026-09-10

So… You Found AWS Access Keys (Part 1)

The AWS access keys are in hand... now what? In Part 1 of this blog series, we break down AWS credential types, where to find them, and how to validate and use them during a security engagement.

cloud
Read entry
RedTeamSec2026-09-09

TornadoRevC2: A Post-Ex Framework I Built for Red Team Ops — 49 Plugins, Minimal Artifacts

Hey r/redteamsec community, I've been developing TornadoRevC2 for a while now. It started as a simple reverse-shell session handler—just TCP/TLS listeners with switch and kill. Over time, I kept extending it based on real operational needs, and it's evolved into a fully modular post-exploitation framework with 49 built-in plugins. Why It's Different Session handler, not beacon-based C2. It gives you reliable interactive PTY/TTY shells and executes post-ex capabilities on-demand—no heavy agent infrastructure. Minimal artifact footprint: All enumeration plugins use native OS commands already on the target (netsh, ss, iptables, PowerShell cmdlets, and etc. ). No binaries, scripts, or temp files dropped for reconnaissance. The only deliberate artifacts: Some plugins put binary artifacts or changes a system setting in target Shell history is the only unavoidable footprint (can be cleared with historydel plugin, or manually). Network traffic artifact: Plain TCP exposes reverse-shell traffic in cleartext, potentially allowing commands and their output to be captured by network logging or inspection. TLS encrypts the session traffic, reducing the amount of sensitive session content exposed

evasionc2opsec
Read entry
RedTeamSec2026-09-09

voidsec-proxy — open-source opsec toolkit (Python)

18 modules: proxy rotation, port scanner, DNS, passwords, hash cracking, recon, web fingerprinting, encryption, steganography, reverse shells, forensics, anonymization. Zero deps. submitted by /u/FirefighterNext360 [link] [comments]

opsec
Read entry
RedTeamSec2026-09-08

🔴 Breakdown of a real Redis rogue-replication cryptomining toolkit recovered from an open directory

Recovered an operator's full working toolkit from an open directory, so this is real tradecraft rather than a PoC. The R&D trail is the interesting part, you can see what they tried and dropped. Core primitive is rogue replication: CONFIG SET dir/dbfilename, SLAVEOF to a rogue master, crafted RDB served on +FULLRESYNC with an embedded newline that lands a cron entry, then SLAVEOF NO ONE and restore config to stay quiet. Not novel, but clean, and it works from Redis 2.8.17 to 7.2.0 because it abuses replication, not a bug. Four production fallback write paths, plus a separate deploy_all.py that hits cron.d, an APT hook (/etc/apt/apt.conf.d/), and profile.d in one pass for redundancy against cleanup. Pull cron and the other two respawn on the next apt update or login shell. Abandoned R&D still in the folder: a BGSAVE-based first draft (noisier, dropped for replication), a webshell-via-Redis probe against web roots (never weaponized), and path recon into /etc/init.d, the full rc0-rc6 SysV set, and /etc/modprobe.d. None of those shipped. modprobe.d is the one they tested but held back, writable modprobe config runs commands on module load, stealthier than cron. Two verify payload bugs

evasionopsec
Read entry
RedTeamSec2026-09-05

How to spend $1K in training

My company has allocated $1K this year for training. I’m doing a lot more with genai and have assessed several internal genai apps. I asked Claude and it suggested either the CAISP course or a course from RedFoxSec. Anyone take these or have other suggestions? It has to be online as we have no travel budget and needs to be spent by EOY. submitted by /u/Character_Pie_5368 [link] [comments]

evasion
Read entry
RedTeamSec2026-09-05

Zairo : Catching what security diff scanners miss.

Diff security scanners miss the effects of the changes, Zairo finds those effects and looks for vulnerabilities. Zairo scans what has changed in your code with context, makes a subgraph for you to look at and finds vulnerabilities using LLMs of your choice. submitted by /u/iamavu [link] [comments]

evasioncloud
Read entry
RedTeamSec2026-09-05

Evilginx

May I ask how we can by pass challenges.cloudflare.com I try every thing . removing estereggs , using proxies, rebuild the phishlets again and again and again but i didn’t find a way submitted by /u/2-Pac- [link] [comments]

Read entry
RedTeamSec2026-09-04

I spent a year figuring out how to stop an LLM-powered security tool from confidently reporting things that aren't true

I've spent the last year building a tool that tests web applications and uses a language model to decide what to try next. The biggest problem wasn't that it missed vulnerabilities. It was that it could be very confidently wrong. It would see a login page after a request and call it a successful authentication bypass. It would treat a 200 status code as proof without checking what the response actually contained. Sometimes it would end up writing things like "this is exploitable" into a report when the evidence didn't actually support that conclusion. That became a much bigger problem than getting the model to find more things, so I ended up spending a lot of time building safeguards around it. I wrote up what went wrong, what actually fixed it, and included a small offline demo that anyone can run without an API key or network access. It includes: A "failure museum" with real false positives the tool produced, why they looked convincing at first, and the rule I added to catch each one. The actual code I use to stop weak evidence from becoming strong claims. For example, severity can be automatically lowered, but it can't be raised unless the captured evidence directly supports it.

evasion
Read entry
RedTeamSec2026-09-03

SecFlow: AI orchestration framework with swappable models, GLUTTON MCP, and per-target vulnerability playbooks

We published research on a Chinese-speaking operator's orchestration framework that's worth a look from the offensive tooling side. The setup is basically an AI-driven pentest pipeline with model swapping, layered egress, and MCP-integrated post-exploitation. SecFlow is the orchestration layer. It launched either Claude ACP or Qwen Code, injected the model name and API route, applied tool permissions (bypassPermissions, approval-mode=yolo), and routed traffic through private endpoints on niestools.com. Five model profiles were recovered, including a DeepSeek-compatible endpoint served through an Anthropic-format relay. The "External Pentest Skill" acted as the master workflow. SKILL .md moved each target through initialization, recon, exploitation, post-exploitation, and reporting. Recon established tech stack, auth boundaries, response baselines, and ranked attack paths. Each candidate got routed to a vulnerability-specific playbook: file upload, command execution, template injection, SQLi, Java deserialization, SSRF, IDOR, auth bypass, known product vulns, supply chain, WAF bypass, source audit, and advanced web attacks. GLUTTON integration is notable. It was exposed to AI agents

evasion
Read entry
TrustedSec2026-09-03

LLMHaxor Update

Most LLM testing tools require setup, paid access, or internet; LLMHaxor requires none of that. In this blog, we walk through the latest update, including a new WebSocket adapter for modern streaming LLM applications.

Read entry
RedTeamSec2026-09-03

logSpecter – Schema-aware secret scanner for cloud logs (Regex + Shannon Entropy + JSON Path trackin

Hey everyone, I built logSpecter, an open-source secret scanner designed specifically for structured cloud logs. What My Project Does logSpecter scans large cloud log files (AWS CloudTrail, GCP Audit Logs, JSON dumps) to detect leaked API keys, tokens, and credentials. JSON Path Tracking: Parses nested JSON and pinpoints the exact key path (e.g., requestParameters.headers.Authorization) where the leak happened. Entropy + Regex: Combines regex detection with Shannon entropy analysis to eliminate false positives from random hashes or UUIDs. Low-RAM Streaming: Processes multi-GB log archives using streaming without exhausting system memory. CI/CD Integration: Supports pre-commit hooks, baselines, and exports to SARIF, JSON, CSV, or formatted tables. Target Audience Built for DevSecOps engineers, Cloud Security analysts, and developers who need to audit cloud log dumps or prevent secret leaks in log pipelines. It is ready for production CLI use and CI automation. Comparison vs. TruffleHog / Gitleaks: Standard scanners target git commit history and source code. When run on raw JSON logs, they output useless line numbers and flood you with hash false positives. logSpecter understands log

cloud
Read entry
TrustedSec2026-09-01

waf-fu, or Some Log Replay Nonsense

AWS WAF logs are keeping receipts, including your session tokens. In this blog, we walk through the risk of default WAF logging configurations and the tool built to pull, analyze, and replay what gets left behind.

cloud
Read entry
RedTeamSec2026-08-31

Building a Custom SMB1 Authentication Server from Scratch

For the past 8 months, in my spare time, I’ve been working on a personal project with the goal of studying the old SMB1 down to its lowest levels. During this time, I’ve dissected the protocol using Wireshark, waded through Microsoft’s documentation (help!), and reverse-engineered the authentication phase. I also used AI as a tool for debugging and to help wrap my head around some of the more complex mechanisms, though the overall structure, architecture, and code were entirely designed and written by me. So, I decided to build a lightweight server designed to 'trick' SMB clients into authenticating against it (similar to what the famous tool Responder does). I chose to hand-craft virtually the entire SMB1 stack, or at least enough of it to capture hashes. To achieve this, I wrote all the necessary network parsers from scratch: SMB1, ASN.1, SPNEGO, and NTLM, followed by the server itself. It was both challenging and incredibly rewarding to dive so deep into a protocol famous for its complexity. I learned a huge amount along the way. In the end, I think it turned out to be a cool little project, so I decided to share it. It’s certainly not meant to replace well-established tools, bu

ad
Read entry
RedTeamSec2026-08-31

I built a tool to check which outbound ports your network actually lets through

I do a fair bit of security work and kept hitting the same problem. I needed to know which ports a restrictive network will actually let out. Scanning from the inside isn't enough, because a firewall or intermediary device can happily report a port as open when nothing is really getting through. So I put together Port Leak Checker: https://portleak.link/ It's a passive listener running on a public server. It captures inbound TCP and UDP packets on every port and logs them in a live web interface. You point a device at it and scan or send some traffic, and anything that actually reaches the server shows up with the source IP, protocol, port and timestamp. If a packet lands there, you know that port genuinely made it out of your network. The server never replies to anything, so your scanner will show the ports as filtered or closed. The log is the thing to trust, not the scan output. You can filter by your source IP, group the results by port so a scan doesn't flood the view, and export to CSV or XLSX. There's also a /scans page with some ready to run PowerShell and bash scripts for the Nmap top 130 ports. submitted by /u/Xtrato [link] [comments]

Read entry
MDSec2026-08-28

When it Snows it Pours – Anatomy of a ServiceNow Red Team

Introduction What if I told you six thousand of your employees were two steps removed from gaining full control over your IT infrastructure. If we told you this was related... The post When it Snows it Pours – Anatomy of a ServiceNow Red Team appeared first on MDSec.

Read entry