Jun 11
"#Breaching The #Perimeter: The Forgotten Attack Vector That Always Works" workshop at #x33fcon run by Jiří Vanek and @tatramaco - x33fcon.com/#!/w/JiriVanekCh… - #physical_security, #physical_penetration_test, #covert_methods_of_entry, #physical_breach, #offensive_security
2
6
628
#tools
#Offensive_security
"Hooking Windows Named Pipes", Apr. 2026.
]-> Windows named pipe hooking toolkit github.com/synacktiv/thats_n…
// During security assessments, we often see desktop apps composed of several processes. Some of them run as SYSTEM, and others run in the user session context, meaning they are unprivileged. These processes need to communicate in some way, and often use Windows Named Pipes as IPC mechanisms. Once opened, named pipes are a bidirectional communication channel, just like TCP/Websocket, that may be used by a low privileged process to attack an elevated process
18
92
8,386
#tools
#Offensive_security
1⃣. CrabLoader - Cobalt Strike User-Defined Reflective Loader written in Rust github.com/qmadev/CrabLoader
2⃣. AIMap - security testing platform for AI agent infrastructure github.com/BishopFox/aimap
3⃣. CLR-Stomp - BOF that loads a .NET assembly into a Cobalt Strike beacon github.com/nettitude/CLR-STO…
4⃣. EntraFalcon - tool for assessing the security posture of Microsoft Entra ID github.com/CompassSecurity/E…
5⃣. ghosttype - Local forensic scanner that extracts credentials from AI tool conversation history github.com/xFreed0m/ghosttyp…
2
239
#Offensive_security
Bypassing Windows (11 24H2/Server 2025) authentication reflection mitigations for SYSTEM shells
Part 1 (CVE-2025-33073) synacktiv.com/en/publication…
Part 2 (CVE-2026-26128) synacktiv.com/en/publication…
// Authentication relay (or reflection) attacks will persist as long as integrity mechanisms are not enforced by default on Windows services
11
53
3,617
#Research
#Offensive_security
GPT-5.5 vs Claude Opus 4.7 for Pentesting:
A Practical Workflow-Based Comparison
penligent.ai/hackinglabs/gpt…
// A model that writes convincing exploit code is not automatically useful for pentesting. A model that explains a vulnerability clearly is not automatically able to verify it. A model that scores well on coding or agent benchmarks is not automatically safe to connect to scanners, browsers, shells, credentials, or production-like targets...
3
261
#tools
#Offensive_security
Kerberos with Titanis
trustedsec.com/blog/kerberos…
// Titanis - github.com/trustedsec/Titani… Windows protocol library, including SMB and RPC implementations, among others
7
287
#tools
#AIOps
#MLSecOps
#Offensive_security
Recursive Autonomous Penetration Testing and Observation Robot
github.com/gadievron/raptor
// Autonomous Offensive/Defensive Security Research Framework, based on Claude Code
1
5
203
#tools
#Offensive_security
1⃣. dexfinder - github.com/JuneLeGency/dexfi… Cross-platform APK/DEX method & field reference finder with call chain tracing, ProGuard/R8 deobfuscation, and Android hidden API detection
2⃣. LogonTracer - github.com/JPCERTCC/LogonTra… tool to investigate malicious logon by visualizing and analyzing Windows AD event logs
3⃣. efiguard-detect - github.com/sapdragon/efiguar… tool to detect EfiGuard
4⃣. ReDyne - github.com/speedyfriend433/R… iOS Decompiler/Reverse Engineering Suite
5⃣. Disconnected RSAT - github.com/CCob/DRSAT launcher for running Group Policy Manager, Certificate Authority and Certificate Templates MMC snap-ins from non-domain joined machies
2
18
974
#tools
#exploit
#Offensive_security
1⃣. Fritter - github.com/0xROOTPLS/Fritter tool that generates unique, evasive, position-independent shellcode for in-memory execution, building on Donut's framework with dynamic memory management and randomized components for enhanced stealth
2⃣. KslDump - github.com/andreisss/KslDump exploits a Microsoft-signed Defender driver vulnerability via IOCTL 0x222044, enabling unrestricted kernel and physical memory access, bypassing security protections, through registry manipulation and local privileges
3⃣. RegPwn - github.com/mdsecactivebreach… privilege escalation exploit affecting Windows 10, 11, and Server editions (CVE-2026-24291)
8
29
1,531
#tools
#Offensive_security
#Red_Team_Tactics
1⃣. VMkatz - github.com/nikaiw/VMkatz Extract Windows credentials directly from VM memory snapshots and virtual disks
2⃣. github.com/kapla0011/KaplaSt… KaplaStrike - module overloading, NtContinue entry transfer, call stack spoofing, sleep masking, and static signature removal
3⃣. github.com/Ghaleb0x317374/St… StealthyWMIExec - a stealthier approach to WMI-based command execution using Impacket without touching the disk
4⃣. Kerlab - github.com/airbus-cert/kerla… a Rust implementation of Kerberos for Fun and Detection
5⃣ Ghost in the PPL - core-jmp.org/2026/03/ghost-i… LSASS Memory Dump
14
72
3,792
#hardening
#Offensive_security
Breaking Out of Citrix and other Restricted Desktop Environments
pentestpartners.com/security…
// This article details techniques for escaping restricted environments like Citrix by exploiting misconfigured Windows dialogues, help files, and accessibility features to launch unauthorized shells. The post emphasizes hardening virtualized environments through strict, least-privilege configurations
4
452
#Offensive_security
A Deep Dive into the GetProcessHandleFromHwnd API
projectzero.google/2026/02/g…
// From Windows XP to Windows 11 24H2
See also:
]-> PPLwindow PPL Bypass via GetProcessHandleFromHwnd github.com/R41N3RZUF477/PPLw…
1
16
51
2,678
19
80
3,030
[언론보도] 제주도, 박찬암 화이트 해커 초청해 공직자 대상 사이버 보안 교육 개최
v.daum.net/v/202602201321063…
@hkpco #스틸리언 #STEALIEN #사이버보안 #정보보안 #Offensive_Security #공격자관점 #화이트해커 #박찬암 #제주도 #유퀴즈 #인공지능 #AI #사이버전쟁사례 #보안사고 #사이버보안강연 #정보보호교육
- 27일 복지이음마루에서 진행... 도내 공직자·공공기관 직원 대상
tvN '유퀴즈 온 더 블록' 출연으로 대중에게 친숙한 화이트 해커 박찬암 강사를 초청해 '사이버 전쟁 사례로 알아보는 정보보호'를 주제로 진행된다.
김남진 제주도 혁신산업국장은 "사이버 위협이 일상과 업무에 직접적인 영향을 미치고 있다"며 "이번 교육을 통해 사이버 보안에 대한 경각심을 높이고 안전한 정보환경을 토대로 도민이 안심할 수 있는 행정을 펼치겠다"고 말했다.
1
2
441
#tools
#Offensive_security
#Red_Team_Tactics
1⃣. Automating the Pass-The-Ticket attack
ricardojoserf.github.io/auto…
]-> AutoPtT in C and Python github.com/ricardojoserf/Aut…
2⃣. Linux Shared Library to Shellcode Loader
github.com/sliverarmory/mala…
3⃣. GhostLocker: AppLocker-Based EDR Neutralization
github.com/zero2504/EDR-Ghos…
4⃣. MSSQL Silver Tickets and Token Privileges
vuln.dev/silver-ticket-mssql…
]-> Token handles abuse github.com/blackarrowsec/Han…
5. LOLRMM tools
lolrmm.io
2
5
459
#MalDev
#Malware_analysis
#Offensive_security
MacOS Malware Persistence
Part 1 - LaunchAgents. Simple C example cocomelonc.github.io/macos/2…
]-> Source code in GitHub github.com/cocomelonc/meow/t…
Part 2 - Shell environment hijacking. Simple C example cocomelonc.github.io/macos/2…
]-> Source code in GitHub github.com/cocomelonc/meow/t…
2
7
469
#tools
#Sec_code_review
#Offensive_security
Claude Code in a devcontainer
github.com/trailofbits/claud…
// Sandboxed devcontainer for running Claude Code in bypass mode safely. Built for security audits and untrusted code review
4
325
#Offensive_security
#Red_Team_Tactics
Living off the Process
g3tsyst3m.com/lotp/Living-of…
]-> Full Source Code ready to compile
github.com/g3tsyst3m/Codefro…
14
64
3,552
#tools
#Offensive_security
HuntCyberArk - CyberArk Security Audit Suite
github.com/Logisek/HuntCyber…
// A comprehensive PowerShell-based security assessment tool for Privileged Access Management platforms
See also:
zBang - Risk assessment tool for privileged account threats github.com/cyberark/zBang
Conjur - Secrets management platform github.com/cyberark/conjur
ACLight - Shadow Admin discovery
Ansible Security Automation github.com/cyberark/ACLight Collection - CyberArk Ansible integration github.com/cyberark/ansible-…
1
14
818
#tools
#Kernel_Security
#Offensive_security
AV/EDR Killer: AV/EDR processes termination by exploiting a vulnerable driver (BYOVD)
github.com/xM0kht4r/AV-EDR-K…
// This project demonstartes how a legit, and signed driver can be weponized to gain kernel level access
1
10
464