Red Team and Offensive R&D at @CrowdStrike | Powered by ☕🍻🍩
Joined October 2016
- Tweets 3,418
- Following 402
- Followers 4,939
- Likes 5,564
71 Photos and videos
Pinned Tweet
29 Dec 2022
To wrap up 2022, I'm releasing the final part of my 3-part browser exploitation series on Chrome!
In this post, we demonstrate the practical use of the concepts we've learned throughout the series by analyzing and exploiting CVE-2018-17463.
Enjoy!
jhalon.github.io/chrome-brow…
8
128
455
55,690
Jack Halon retweeted
Jun 4
We think of WASM as a mechanism to run compiled code in your browser, but what if we shimmed in all the host APIs necessary to run full implants with ALL logic entirely in the WASM VM? This post walks through what that looks like.
praetorian.com/blog/wasmforg…
#wasm #malware #sliver
3
24
72
8,723
Jack Halon retweeted
May 29
I'm tired of my tools getting sig'd so I built a pipeline to keep our tools alive for longer and bring some classics back.
Post 1 of 3 is live now. The final post will drop our Go/C# -> WASM toolchain. It builds #Sliver, #Chisel, and some of #GhostPack.
praetorian.com/blog/llm-edr-…
1
19
67
9,797
Jack Halon retweeted
Apr 2
🫡 We’re back.
Today, we’re publishing vulnerabilities we discovered, disclosed, and chained to achieve pre-auth RCE against Progress ShareFile.
Enjoy the journey with us, while you sob into your hands 🫠
labs.watchtowr.com/youre-not…
3
57
207
38,460
Jack Halon retweeted
Mar 28
while we’re eating our best writing crayons and using finger paint to finish our latest research, we’ve decided to take this opportunity to share research from the archives with new followers 🙂
happy Friday… for now 🥹
labs.watchtowr.com/we-spent-…
(Yes this is not new don’t @ us)
2
7
67
4,589
Jack Halon retweeted
Mar 19
What's new is old, and what's old is new - as is relentlessly proven.
Join us in our analysis of CVE-2026-32746, the recent pre-auth RCE in inteutils' Telnetd
Speak soon.
labs.watchtowr.com/a-32-year…
1
41
120
16,144
Jack Halon retweeted
Mar 18
In 2025, we achieved pre-auth RCE against another solution in a ransomware gang favourite category. Today, we finally click publish.
Join us as we walk through a chain of vulnerabilities we identified in BMC’s FootPrints ITSM solution.
Enjoy!
labs.watchtowr.com/thanks-it…
1
40
109
17,742
Jack Halon retweeted
Feb 25
We promised we'd be back!
Join us on our journey, from repro'ing N-days to stumbling into 0-days in SolarWinds Web Help Desk, eventually achieving pre-auth RCE.
This research fuels the watchTowr Platform, our Preemptive Exposure Management technology.
labs.watchtowr.com/buy-a-hel…
66
206
40,409
Jack Halon retweeted
Feb 10
We just published our @rapid7 analysis of CVE-2026-1731, a critical command injection affecting BeyondTrust Privileged Remote Access (PRA) & Remote Support (RS). Unauthenticated RCE, with a root cause due to Bash arithmetic evaluation. Analysis/PoC here: attackerkb.com/topics/jNMBcc…
3
33
120
26,092
Jack Halon retweeted
We’re releasing our analysis of ring-1.io, a major game cheat targeted by multiple studios in recent legal actions. We partially deobfuscated several Themida-protected components and document how it hijacks Hyper-V to inject and manipulate game code.
back.engineering/blog/04/02/…
github.com/backengineering/r…
15
97
462
115,195
Jack Halon retweeted
Feb 6
I wrote a post on creating "scalable research tooling for agent systems" and I'm also releasing the companion MCP server which lets you do autonomous Frida instrumentation on Android. Details in thread 👇📲🪝
5
15
117
18,514
A small rant:
The State of Art in Red Team is whatever you want to believe
x-c3ll.github.io/posts/Rant-…
17
90
343
50,908
Jack Halon retweeted
Jan 30
Someone knows Bash disgustingly well, and we love it.
Here's our analysis of the Ivanti EPMM Pre-Auth RCE vulnerabilities - CVE-2026-1281 & CVE-2026-1340.
This research fuels our technology, enabling our clients to accurately determine their exposure.
labs.watchtowr.com/someone-k…
8
68
225
32,466
Jack Halon retweeted
Jan 26
Early last year @rad9800 shared an idea he'd discussed with @jonasLyk about how to stealthily write to the registry without using the traditional registry APIs EDR watches. The time has come to open source the tool. Hope this helps someone hit their goal!
praetorian.com/blog/corrupti…
5
29
89
4,221
Jack Halon retweeted
Jan 22
Earlier this month, we reported a zero-day auth. bypass in the SmarterTools SmarterMail email solution.
Someone has reversed the patch (released on 15th Jan) and begun exploiting it in the wild.
Read our analysis and please, ASSUME BREACH PATCH NOW.
labs.watchtowr.com/attackers…
40
93
15,571
Jack Halon retweeted
Jan 18
Blog post: On the Coming Industrialisation of Exploit Generation with LLMs sean.heelan.io/2026/01/18/on…
TL;DR: I ran an experiment with GPT-5.2 and Opus 4.5 based agents to generate exploits for a zeroday QuickJS bug. They're pretty good at it.
Code: github.com/SeanHeelan/anamne…
29
233
1,100
230,004
Jack Halon retweeted
Today, Project Zero released a 0-click exploit chain for the Pixel 9. While it targets the Pixel, the 0-click bug and exploit techniques we used apply to most other Android devices.
projectzero.google/2026/01/p…
7
236
1,021
117,070
Jack Halon retweeted
Jan 8
And, we're back - analyzing CVE-2025-52691, a pre-auth RCE in SmarterTools SmarterMail mail server solution.
Speak soon (:^)) and enjoy..
labs.watchtowr.com/do-smart-…
5
52
188
37,657
20 Dec 2025
A fun little Friday night project porting @AndrewOliveau C# SessionHop code to a BOF. Built off of @tiraniddo session moniker research & @CICADA8Research original IHxHelpPaneServer blog. Enjoy!
github.com/jhalon/cSessionHo…
39
106
7,790
Jack Halon retweeted
10 Dec 2025
Today, we’re releasing watchTowr Labs’ @chudyPB’s BlackHat .NET research, owning Barracuda, Ivanti and more solutions.
Enjoy the read as Piotr explains a new .NET Framework primitive, used to achieve pre- and post-auth RCE on numerous enterprise appliances.
labs.watchtowr.com/soapwn-pw…
3
110
370
87,943
Jack Halon retweeted
26 Nov 2025
krebsonsecurity.com/2025/11/… dear fucking lord. This is absolutely wild
9
63
296
47,120