14 Photos and videos
Snowscan retweeted
Apr 2
Relayed NTLM creds are powerful, if you can use them.
@senderend shows why browsers fail through ntlmrelayx SOCKS and introduces ghostsurf to make NTLM-authenticated web apps accessible.
Read more ⤵️ ghst.ly/4tnJOtx
2
91
276
17,896
Snowscan retweeted
14 Apr 2025
My new blog for Check Point Research - check it out! 💙 // #ProcessInjection : #WaitingThreadHijacking
14 Apr 2025
Thread Execution Hijacking is one of the well-known methods that can be used to run implanted code.
In this blog we introduce a new injection method, that is based on this classic technique, but much stealthier - Waiting Thread Hijacking.
Read More : research.checkpoint.com/2025…
18
135
478
92,223
#pypykatz new version 0.6.11 is out on github and pip.
Big thanks to all awesome contributors!!
Besides the fixes, the two important things in this version:
- Kerberos aes keys extraction is now supported
- !!!!Windows 24H2 support is here!!!!!
github.com/skelsec/pypykatz/…
5
52
141
14,583
Introducing PowerHuntShares 2.0 Release!
NetSPI VP of Research @_nullbind introduces new insights, charts, graphs, & LLM capabilities that can be used to map the relationships & risks being exposed through the network shares: ow.ly/6Rjo50U7tNr
3
35
107
15,850
Snowscan retweeted
28 Mar 2024
CcmPwn is equipped with various modules. The “exec” module runs an AppDomainManager Injection payload for every logged-in user. The “coerce” module coerces SMB/HTTP authentications, which can then be used for password cracking or relay attacks. 👇
github.com/mandiant/CcmPwn
18
67
4,727
Snowscan retweeted
16 Mar 2024
Found a flaw in NetBSD's utmp_update allowing injection of ASCII escape sequences into utmpx logs, leading to unexpected terminal emulator behavior and utmpx database integrity concerns.
ftp.netbsd.org/pub/NetBSD/se… #NetBSD #Security
1
14
20
6,604
Snowscan retweeted
1 Mar 2024
Struggeling to get those precious certificates with #certipy and AD CS instances that do not support web enrollment and do not expose CertSvc via RPC? @qtc_de has you covered and added functionality to use DCOM instead of good old RPC #redteaming github.com/ly4k/Certipy/pull…
3
70
150
13,588
It's been quiet for a while around bloodhound Python, however I'm happy to share that I am now maintaining the project at my personal GitHub. The latest version fixes many bugs/issues, also thanks to the many PRs that were submitted (thanks all!). github.com/dirkjanm/bloodhou…
11
196
624
60,821
Snowscan retweeted
21 Oct 2023
Do you want to start the RemoteRegistry service without Admin privileges?
Just write into the "winreg" named pipe 👇
24
304
1,083
259,395
Thanks to the generous folks @bcsecurity @hackthebox_eu @SANSOffensive @sektor7net and @nostarch for sponsoring prizes at the DEF CON Red Team Village CTF!
1
9
2,423
You can use the Windows Search Protocol to coerce authentication from hosts running the Windows Search Service (Win10/11 only by default) as a regular domain user. Haven't been able to do WebDAV with it though so usefulness is limited. PoC: github.com/slemire/WSPCoerce
5
97
284
30,898
Snowscan retweeted
19 Jul 2023
🔥 Excited to share my latest @Mandiant Red Team blog on "Escalating Privileges via Third-Party Windows Installers"
mandiant.com/resources/blog/…
Learn how attackers exploit this privilege escalation vector and ways to defend against it. Includes BOF release and a couple CVEs!
7
146
347
35,804
Snowscan retweeted
5 Jun 2023
Outlook for Windows can be tricked into displaying a fake domain, but open another one. Add a <base> tag with a fake domain left-to-right mark (U 200E)
Links in <a> tags will show the fake domain, but open the real domain.
No need to buy .zip! :) Convincing #phishing #redteam
13
229
803
117,213
Snowscan retweeted
25 May 2023
Been playing with the .zip TLD for phishing, apparently Outlook on Windows doesn't let you click links containing credentials, mitigating the "attack". haven't seen anyone talk about this, weirdly. after looking into this a bit, I found a way to bypass this behaviour!
1
8
17
3,004
Snowscan retweeted
3 May 2023
Introducing ETWHash!
ETWHash is a new method and tool by @lefterispan for consuming SMB events from Event Tracing for Windows (ETW) and extracting NetNTLMv2 hashes for cracking offline.
labs.nettitude.com/blog/etwh…
170
324
47,512
More quality video content by @xct_de. Those labs are really great.
25 Apr 2023
I'm starting a new video series on pentesting the new lab (Wutai). In the first one, we'll start from the perspective of an unauthenticated, external attacker and will mainly focus on enumeration and getting initial access.
youtu.be/QpQ66IaR06U
3
1,496