redNULL @0xrednull

Red. Hacking the planet. My other computer is your domain controller. 0x00.red Joined November 2018

Tweets

1K
Followers

45
Following

224
Likes

123

Jonathan Bar Or (JBO) 🇮🇱🇺🇸🇺🇦🎗️ @yo_yo_yo_jbo

3 weeks ago

New blogpost, this time about different ways to dump lsass. While not novel, I explain all techniques and uploaded a full implementation of different ways of dumping lsass: github.com/yo-yo-yo-jbo/d… As a reminder, all my content is available at jonathanbaror.com

2 108 434 26K 318

Download Image

Stephan Berger @malmoeb

2 months ago

During a recent incident response case, we observed the following file access: \\localhost\C$\@ GMT-2025.06.21-10.53.43\Windows\NTDS\ntds.dit This is a clever method of accessing a Volume Shadow Copy (VSS) snapshot. Many EDR and detection systems typically monitor for commands…

23 245 1K 73K 766

Download Image

LuemmelSec @theluemmel

2 months ago

github.com/LuemmelSec/P4w… P4wnP1 on the Zero 2 W? Sure why not Detailed documentation? Sure why not New images and instructions to do your own? Sure why not New attacks per default? Sure why not. Was down in the rabbit hole for days ... Enjoy. Thx @mame82 and @RoganDawes

0 10 42 3K 16

Download Image

Dor @Dor00tkit

2 months ago

Most EDR and AV products rely on nt!PsSetCreateProcessNotifyRoutineEx2 to monitor process creation and termination. But what happens if an attacker clears the nt!PspCreateProcessNotifyRoutine array? [1/3]

3 45 267 26K 185

Daniel @0x64616e

2 months ago

Onboard yourself - PaloAlto Global Protect edition: 1. Become local admin 2. Export device cert from original workstation 3. Import cert in your VM 4. Login with user creds 5. Enjoy EDR-free testing :)

12 104 745 59K 622

Download Image

S3cur3Th1sSh1t @ShitSecure

2 months ago

After today’s talk at #TROOPERS25 I’m releasing BitlockMove, a PoC to execute code on remote systems in the context of a loggedon user session 🔥 github.com/rtecCyberSec/B… No need to steal credentials, no impersonation, no injection needed 👌

8 174 446 43K 260

SEKTOR7 Institute @SEKTOR7net

2 months ago

Modern lateral movement techniques detection (mainly DCOM/DCE/RPC/RDP) with examples. Some assumptions worth mentioning: visibility into source IP/port/hostname, logon activity, remote process metadata. A blog post by @HuntressLabs team. Awesome read, guys!…

1 62 249 10K 123

Download Image

Tom Dörr @tom_doerr

2 months ago

github.com/m1k1o/neko

0 11 104 8K 129

Mohit Mishra @chessMan786

3 months ago

Mastering All Design Patterns In C We’ll get into the assembly-level implications of these patterns, offering a holistic view from high-level design to low-level execution.

8 110 1K 48K 1K

Download Image

mr.d0x @mrd0x

3 months ago

FileFix - A ClickFix Alternative mrd0x.com/filefix-clickf…

20 191 747 171K 453

Download Image

VIEH Group @viehgroup

3 months ago

an XSS payload, Cuneiform-alphabet based 𒀀='',𒉺=!𒀀+𒀀,𒀃=!𒉺+𒀀,𒇺=𒀀+{},𒌐=𒉺[𒀀++], 𒀟=𒉺[𒈫=𒀀],𒀆=++𒈫+𒀀,𒁹=𒇺[𒈫+𒀆],𒉺[𒁹+=𒇺[𒀀] +(𒉺.𒀃+𒇺)[𒀀]+𒀃[𒀆]+𒌐+𒀟+𒉺[𒈫]+𒁹+𒌐+𒇺[𒀀] +𒀟][𒁹](𒀃[𒀀]+𒀃[𒈫]+𒉺[𒀆]+𒀟+𒌐+"(𒀀)")() #bugbounty #bugbountytips #cybersecurity

32 298 2K 111K 1K

Download Image

I am Jakoby @I_Am_Jakoby

3 months ago

Well it appears APTs are learning from me in real time. This looks familiar doesn't it? thehackernews.com/2025/06/new-ma… Using cloudflare tunnels and malicious LNK files lol Right after I demo'd exactly that with my 3 parts series I did as a collaboration with Nahamsec ha You can…

12 61 353 22K 224

Download Image

R.B.C. @G3tSyst3m

3 months ago

I'm starting another series - Buffer Overflows in the Modern Era. I'll go over the basics of using a debugger all the way to successfully achieving a buffer overflow exploit on Windows 11 24H2, using ROP gadgets and bypassing ASLR, etc. Here's part 1! g3tsyst3m.github.io/binary%20explo…

4 124 504 31K 454

SEKTOR7 Institute @SEKTOR7net

3 months ago

Excellent post by Johnathan Johnson (@JonnyJohnson_) on leveraging PLA (Performance Logs and Alerts) DCOM library to get to ETW telemetry remotely. We touched the same topic in our RTO: Evasion course, when TraceDataProvider interface was used to locate a "hidden" SysMon…

1 41 118 8K 64

Download Image

breakgimme @adamos9898

3 months ago

iOS in QEMU is a thing now - and it's open source (by ChefKissInc)

42 374 4K 272K 2K

Download Image

RedTeam Pentesting @RedTeamPT

3 months ago

🚨 Our new blog post about Windows CVE-2025-33073 which we discovered is live: 🪞 The Reflective Kerberos Relay Attack - Remote privilege escalation from low-priv user to SYSTEM with RCE by applying a long forgotten NTLM relay technique to Kerberos: blog.redteam-pentesting.de/2025/reflectiv…

8 176 423 38K 251

SEKTOR7 Institute @SEKTOR7net

3 months ago

Crystal Palace - a dedicated linker to generate position-independent DLL loaders, by Raphael Mudge (original creator of Cobalt Strike). CP takes any DLL and reshuffles it into a PIC blob, ready to be run in-memory only. #redteam #maldev tradecraftgarden.org/docs.html

1 56 205 15K 152

Download Image

Aditya Telange @adityatelange

3 months ago

evil-winrm-py v1 released🌟 github.com/adityatelange/… #infosec #windows

2 22 78 4K 24

Download Image

Brut 🇮🇳 @wtf_brut

3 months ago

⚠️wpprobe - WPProbe is a fast and efficient WordPress plugin scanner that leverages REST API enumeration (?rest_route) to detect installed plugins without brute-force. 🖥github.com/Chocapikk/wppr… ✅Join Telegram For More Content: t.me/brutsecurity…

2 133 546 22K 462

Download Image

0b1d1 @_0b1d1

3 months ago

🛡️ cf-hero – Technical Overview cf-hero is an open-source CLI tool that reveals the real IP addresses of websites hidden behind Cloudflare’s reverse proxy protection. GITHUB Link 🔗 ⤵️⤵️