Breaking stuff and writing about it
Joined April 2021
- Tweets 97
- Following 284
- Followers 295
- Likes 1,057
6 Photos and videos
Jan 26
For the last few weeks I’ve been trying to build a usable AI Vishing model as cheaply as possible, hopefully my post may help others who are considering doing something similar!
http418infosec.com/developin…
3
6
894
22 Jun 2025
Some thoughts on how to test against Scattered Spider TTPs and a quick summary on the current available TI. http418infosec.com/simulatin…
3
6
616
HTTP418 retweeted
11 Apr 2024
I wrote a script to identify every TAKEOVER and ELEVATE attack in Misconfiguration Manager that can be run with Read-only Analyst privileges or higher in SCCM. Please share with your IT admins, defenders, clients, assessors, and friends in infosec!
posts.specterops.io/rooting-…
1
135
340
40,177
HTTP418 retweeted
Today the Cyber Safety Review Board released its independent review of the Summer 2023 Microsoft Exchange Online intrusion laying out what led to the intrusion & what industry & gov't can do to ensure an intrusion at this magnitude does not happen again. go.dhs.gov/JRT
6
117
249
148,386
HTTP418 retweeted
13 Mar 2024
Amazon is the new source for OST 🔥🔥
20
81
619
80,571
6 Dec 2023
The GoPhish API can be used for some fun and games, my latest post shows how single use phishing links can be made using GoPhish AWS SES! http418infosec.com/one-time-…
1
2
178
MachineAccountQuota = 0, preventing you from grabbing NAA creds remotely?
DPAPI to the rescue!
Ported over NAA Extraction via DPAPI to sccmhunter.
h/t: @agsolino & @clavoillotte for SystemDPAPI.py
5
79
309
67,426
14 Nov 2023
Confused on the basics of C ? Hopefully this little post will help out with some of the confusion! http418infosec.com/deez-word…
1
185
29 Aug 2023
I have just written a post (http418infosec.com/offensive…) summarising the various published SCCM attacks, from PXE enumeration through to Site Takeovers 1/2
2
36
88
7,511
29 Aug 2023
These attacks are from tooling and guides shared by @_Mayyhem, @garrfoster, @_xpn_, @Raiona_ZA and @DiLomSec1. @vendetce's talk at BHIS is a fantastic intro to the area if you have a spare hour, and was a huge help to me! 2/2
2
3
13
2,224
HTTP418 retweeted
22 Aug 2023
We would like to express our condolences to Blue Teamers.
Microsoft has announced Microsoft Excel will now support Python.
More information: techcommunity.microsoft.com/…
68
656
2,338
262,143
Didn't have time to talk about the newly released TLDs last week, but here we go.
File Archiver In The Browser: Emulating file archive software in the browser with a .zip domain for phishing
mrd0x.com/file-archiver-in-t…
11
136
365
99,004
19 May 2023
I've just published a post on how Cypher language can be used to assess & audit an AD environment with some of its more complex features (1/2) http418infosec.com/2023/05/1…
1
19
56
4,819
19 May 2023
Additionally, I have done another post on the basics of BloodHound for those who are new to the tool! (2/2) http418infosec.com/2023/05/1…
2
7
367
5 May 2023
Another amazing article by @KimZetter, grab a cup of tea and make time to read this!
2 May 2023
Two years ago the SolarWinds hack made history as the boldest, most sophisticated supply chain hack ever pulled off. I dug into the detailed story about the ingenious way the hackers pulled it off - and then got caught - in this tale for WIRED magazine wired.com/story/the-untold-s…
1
145
8 Mar 2023
Seeing as #redteamtips have been all the rage recently, I thought I would put my own #whiteteamtips out there. My latest post is on how to make good timelines for red team testing, (hopefully) leading to less painful debriefs! http418infosec.com/diagrams-…
1
136
12 Feb 2023
Great day at @BSidesCymru yesterday, thanks to all of the organisers and volunteers! Great talks from @teamcymru_S2 @matdotsh and @_EthicalChaos_ in particular 🏴
4
213
24 Jan 2023
KeePass is back in the news with CVE-2023-24055, very timely as I have a post on the trigger system & some other attacks against KeePass! http418infosec.com/attacking…
2
2
263
23 Jan 2023
Great write up on Invoke-ShareFinder from @iiamaleks!
23 Jan 2023
ShareFinder: How Threat Actors Discover File Shares
Detection Opportunities:
➡️ Network
➡️ PowerShell Logs
➡️ LDAP Logs
➡️ Object Access Logs
thedfirreport.com/2023/01/23…
101
11 Jan 2023
I have recently been using Shodan quite a lot and have found some more tips and tricks in Shodan to hunt down the weird and wonderful assets for a target.
http418infosec.com/shodan-20…
1
1
108