Red Team and Offensive R&D at @CrowdStrike | Powered by ☕🍻🍩
Joined October 2016
- Tweets3.4K
- Following403
- Followers5K
- Likes5.7K
Pinned Tweet
To wrap up 2022, I'm releasing the final part of my 3-part browser exploitation series on Chrome!
In this post, we demonstrate the practical use of the concepts we've learned throughout the series by analyzing and exploiting CVE-2018-17463.
Enjoy!
jhalon.github.io/chrome-brow…
Jack Halon retweeted
... get it while its hot... 😈
> CVE-2026-109618 / CVE-2026-109619 (pre-patch PHP 8.x)
> session.upload_progress UAF
> jackalsyn.com/posts/php-up-2…
> Courtesy of Me, @acd421 & @Archknight23
#CyberSecurity #infosec #php2shell #php
Jack Halon retweeted
The details of the long awaited KVM Escape are published. PwnEscape leads to VM escapes across multiple hypervisors due to a super cool Linux networking bug.
CVE-2026-99999 is a 9.3 CVSS critical rated KVM escape ⛓️
pwn.ai/blog/pwnescape
Jack Halon retweeted
F5, BIG-IP, a 20-year-old primitive, a security appliance, an "authentication" mechanism - and a CISA promise ring.
Yes, it's CVE-2026-94127.
Give us strength. Speak soon xo
labs.watchtowr.com/is-this-a…
Jack Halon retweeted
Seems that wp2shell PoCs are now floating around the internet, so we've published our blog post including our research methodology for finding the bug as well as a deep dive into the chain itself - slcyber.io/research-center/e…
Jack Halon retweeted
We think of WASM as a mechanism to run compiled code in your browser, but what if we shimmed in all the host APIs necessary to run full implants with ALL logic entirely in the WASM VM? This post walks through what that looks like.
praetorian.com/blog/wasmforg…
#wasm #malware #sliver
Jack Halon retweeted
I'm tired of my tools getting sig'd so I built a pipeline to keep our tools alive for longer and bring some classics back.
Post 1 of 3 is live now. The final post will drop our Go/C# -> WASM toolchain. It builds #Sliver, #Chisel, and some of #GhostPack.
praetorian.com/blog/llm-edr-…
Jack Halon retweeted
🫡 We’re back.
Today, we’re publishing vulnerabilities we discovered, disclosed, and chained to achieve pre-auth RCE against Progress ShareFile.
Enjoy the journey with us, while you sob into your hands 🫠
labs.watchtowr.com/youre-not…
Jack Halon retweeted
while we’re eating our best writing crayons and using finger paint to finish our latest research, we’ve decided to take this opportunity to share research from the archives with new followers 🙂
happy Friday… for now 🥹
labs.watchtowr.com/we-spent-…
(Yes this is not new don’t @ us)
Jack Halon retweeted
What's new is old, and what's old is new - as is relentlessly proven.
Join us in our analysis of CVE-2026-32746, the recent pre-auth RCE in inteutils' Telnetd
Speak soon.
labs.watchtowr.com/a-32-year…
Jack Halon retweeted
In 2025, we achieved pre-auth RCE against another solution in a ransomware gang favourite category. Today, we finally click publish.
Join us as we walk through a chain of vulnerabilities we identified in BMC’s FootPrints ITSM solution.
Enjoy!
labs.watchtowr.com/thanks-it…
Jack Halon retweeted
We promised we'd be back!
Join us on our journey, from repro'ing N-days to stumbling into 0-days in SolarWinds Web Help Desk, eventually achieving pre-auth RCE.
This research fuels the watchTowr Platform, our Preemptive Exposure Management technology.
labs.watchtowr.com/buy-a-hel…
Jack Halon retweeted
We just published our @rapid7 analysis of CVE-2026-1731, a critical command injection affecting BeyondTrust Privileged Remote Access (PRA) & Remote Support (RS). Unauthenticated RCE, with a root cause due to Bash arithmetic evaluation. Analysis/PoC here: attackerkb.com/topics/jNMBcc…
Jack Halon retweeted
We’re releasing our analysis of ring-1.io, a major game cheat targeted by multiple studios in recent legal actions. We partially deobfuscated several Themida-protected components and document how it hijacks Hyper-V to inject and manipulate game code.
back.engineering/blog/04/02/…
github.com/backengineering/r…
Jack Halon retweeted
I wrote a post on creating "scalable research tooling for agent systems" and I'm also releasing the companion MCP server which lets you do autonomous Frida instrumentation on Android. Details in thread 👇📲🪝
Jack Halon retweeted
A small rant:
The State of Art in Red Team is whatever you want to believe
x-c3ll.github.io/posts/Rant-…
Jack Halon retweeted
Someone knows Bash disgustingly well, and we love it.
Here's our analysis of the Ivanti EPMM Pre-Auth RCE vulnerabilities - CVE-2026-1281 & CVE-2026-1340.
This research fuels our technology, enabling our clients to accurately determine their exposure.
labs.watchtowr.com/someone-k…
Jack Halon retweeted
Early last year @rad9800 shared an idea he'd discussed with @jonasLyk about how to stealthily write to the registry without using the traditional registry APIs EDR watches. The time has come to open source the tool. Hope this helps someone hit their goal!
praetorian.com/blog/corrupti…
Jack Halon retweeted
Earlier this month, we reported a zero-day auth. bypass in the SmarterTools SmarterMail email solution.
Someone has reversed the patch (released on 15th Jan) and begun exploiting it in the wild.
Read our analysis and please, ASSUME BREACH + PATCH NOW.
labs.watchtowr.com/attackers…
Jack Halon retweeted
Blog post: On the Coming Industrialisation of Exploit Generation with LLMs sean.heelan.io/2026/01/18/on…
TL;DR: I ran an experiment with GPT-5.2 and Opus 4.5 based agents to generate exploits for a zeroday QuickJS bug. They're pretty good at it.
Code: github.com/SeanHeelan/anamne…
Jack Halon retweeted
Today, Project Zero released a 0-click exploit chain for the Pixel 9. While it targets the Pixel, the 0-click bug and exploit techniques we used apply to most other Android devices.
projectzero.google/2026/01/p…
