Cookie theft has evolved. 🍪
Over the last year, stealing cookies on Windows devices has changed significantly for Chromium browsers like Chrome and Edge. Andrew Gomez dives into these changes, how threat actors adapt, & new detection opportunities. ghst.ly/45S1ZgW
For anyone who was at DC4420 (@dc4420.bsky.social) on Tuesday, thanks for all the appreciation for my talk. Slides are available here:
github.com/N1ckDunn/SOS...
Microsoft has disabled the ICC Chief prosecutors email account.
But let’s keep all dependencies on US IT alive. What could possibly go wrong?
www.techzine.eu/news/privacy...
All popes must pick a new name upon ascension. So something like Papa John
10/10 no notes, excellent blending in
Hello @miamiuniversity.bsky.social ,
You should probably be aware that someone has compromised your organization and has attempted to notify you.
They wrote to your I.T. department, but it was ignored. You should (probably) fix it.
We've got a 0day exploit.
The 0day impacts an organization which provides managed services for Danone, SeaGate, Unity, Shopify, Paramount Pictures, HubSpot, Amazon, PWC, Yamaha, L'Oreal
The exploit was reported, but the vendor ignored it.
Chat, do we drop a 0day on a Friday?
Is DefCon conf org already making plans for a smaller venue?
A few more stories like this and I recon not a single hacker from outside of the US wants to go to DefCon.
Think NTLM relay is a solved problem? Think again.
Relay attacks are more complicated than many people realize. Check out this deep dive from Elad Shamir on NTLM relay attacks & the new edges we recently added to BloodHound. ghst.ly/4lv3E31
Our red team is growing and we have a rare open position for a Principal RT Operator - if this sounds like you, get in touch 🙏
A diagram describing the negotiate protocol, only saying 'negotiate protocol' twice between client and server
This must be the most informative graphic contained in the Microsoft docs
learn.microsoft.com/en-us/opensp...
Maybe at some sort of red treat ?
Lengthy thread with lots covered, looking back and forward.
Raphael is right on many things, especially for the bad press he got from people just blatantly shouting things without knowing the actual facts and details.
But most important: Rafi, its great to have your voice back in the community!
I’m calling on all InfoSec Rockstars to join us in giving back to the community. Got a killer workshop idea? Reach out to me directly or swing by our website to submit your proposal. Let’s make waves together!
The countdown to BSidesABQ is on.
#SCCM forest discovery accounts can be decrypted—even those for untrusted forests. If the site server is a managed client, all creds can be decrypted via Administration Service API.
Check out our latest blog post from @unsignedsh0rt.bsky.social to learn more. ghst.ly/4buoISp
Recently came across a pretty neat technique to silently load (malicious) VS Code extensions using its bootstrapping and portability features. Thought it was interesting enough to warrant my first blog post in 4 years 🙃
Check it out 👇
casvancooten.com/posts/2025/0...
Electronic infra has gone from open to all to limited under the control of a few companies to under discretion of a few individuals
Virtual fortresses aren’t as invincible as they seem 🏰⚔️.
Read about the latest @outflank.bsky.social research on using Secure Enclaves in Windows for offensive ops — plus fresh insights for red teamers.
Check out Part 1 of our blog series here: www.outflank.nl/blog/2025/02...
SlackPirate sets sail again! 🏴☠️
In his latest blog post, Dan Mayer intros his new PR to SlackPirate that lets you loot Slack again out of the box, a BOF to get you all the data you need to do it, & how to bee the most active slacker in your group chat. 🐝 ghst.ly/4hgwMIt
Part 2 of @hotnops.bsky.social's blog series on Entra Connect attacker tradecraft has dropped! 🙌 Check out this installment to learn more fundamentals of the Entra sync engine & how to interpret the sync rules. ghst.ly/3WqAQO4
If it’s like the one you gave at ams it’ll be mega
Speaking at SO-CON 2025 about SQL Server crypto! Excited for this one… first talk of 2025 🎉
In Part 1 of my Intune Attack Paths series, I discuss the fundamental components and mechanics of Intune that lead to the emergence of attack paths: posts.specterops.io/intune-attac...
Ah nvm worked it out 💪🏽
Achievement unlocked, my first blog with SpecterOps 🤗 This post looks at ADFS OAuth2 support, Device Registration, Enterprise PRT, and a brain dump of things that I didn’t want to leave sat on Notion. buff.ly/4j41VQU
Ah sick! Any hints ? Doing this as a learning exercise in my spare time so the more I work out before the blog the better haha
@xpnsec.com Sorry for the message but I’m trying to write my own objc loader. Got the selector mapping working but soon as my dylib uses extra classes the refs break. Can you share any resources on it ? Tried to add classes in classlist sect as subclasses but nada
Xmas holiday is up now I can finally relax by the fire and stresslax my way through my backlog of things to do so I am neither rested nor productive come Jan 🤗
