v1n @0xv1nx0

detection engineer 🦝 v1n.sh Joined March 2023

Tweets

130
Followers

367
Following

134
Likes

85

v1n @0xv1nx0

2 weeks ago

The year is almost 2026. We're still letting users double click JavaScript files in enterprise environments. 2027 is the year, I feel it. I definitely won't copy paste this post a year from now, no way.

0 0 1 41 0

Download Gif

Chetan Nayak (Brute Ratel C4 Author) @NinjaParanoid

2 weeks ago

I know a lot of people will hate me for saying this but it has to be said. I get a lot of DMs saying RT is getting harder everyday, traditional loaders dont work anymore, opensource tools tend to crash or get detected instantly. But wasnt that the whole point of Red team? Thats…

23 55 375 32K 81

Rasta Mouse @_RastaMouse

a month ago

Hard to tell because I was pretty dumb to begin with.

Girl loves coding 👩‍💻 @girllovescoding

a month ago

Hard to tell because I was pretty dumb to begin with.

70 2 93 9K 6

4 1 37 4K 0

v1n @0xv1nx0

a month ago

recent events make you wonder. at this point are you safer just not having an enterprise firewall vs using one?🤔 ha ha jk, this is satire... unless?

1 0 1 95 0

Rasta Mouse @_RastaMouse

4 months ago

I'm particularly proud to bring PPP pricing into cybersecurity.

Zero-Point Security @_ZeroPointSec

4 months ago

I'm particularly proud to bring PPP pricing into cybersecurity.

12 71 320 41K 75

19 20 256 19K 21

v1n @0xv1nx0

5 months ago

"Pet Friendly" apartment starter kit: - 400 dollar non-refundable pet fee - 250 dollar pet deposit - 50 dollar a month pet rent - 2 Pet limit, and can't have <arbitrary breed list> - no dog park - no walkable areas

2 0 1 158 0

v1n @0xv1nx0

6 months ago

Anyone got that giant iceberg of alternatives to whoami? I'd like to submit this one for Mac - system_profiler SPSoftwareDataType | grep "User Name" | awk -F': ' '{print $2}'

0 0 1 89 0

v1n @0xv1nx0

7 months ago

Lua Lua Lua

1 0 1 178 0

v1n @0xv1nx0

7 months ago

I don't have a C2 tier list, but this one would be in my S-tier: github.com/0x-Apollyon/Ma…

0 0 2 122 0

Fred HK @fr3dhk

8 months ago

Indtroducing: What is this stealer? A new repository that allows for you to identify Stealer malware by the system information text file format commonly included in stealer malware exfiltration. We encourage everyone to check it out and contribute! github.com/MalBeacon/what…

7 140 460 36K 288

v1n @0xv1nx0

a year ago

My first "net new" LOLbin contribution for MacOS! github.com/infosecB/LOOBi…

0 3 7 741 3

v1n @0xv1nx0

a year ago

Wrote a blog on my experience replicating the LOLBin qwinsta using undocumented APIs, really an expansion of work done years ago by @harmj0y but using WinStation instead of Terminal Services. 0xv1n.github.io/posts/sessione…

1 47 154 9K 63

v1n @0xv1nx0

a year ago

Why run "hostname" on macOS when you can just run "nvram -xp | xmllint --xpath "string(//key[.='fmm-computer-name']/following-sibling::data[1])" - | base64 --decode | tr -d ' '"

1 1 5 852 1

bakki @avx128

a year ago

POC for the silly shenanigans i talk about in my last blogpost can be found here github.com/xrombar/flower now working on a version that doesn't rely on NtContinue, as I now have an "agnostic" IOC for such chains; on top of implementing different ways to "flow" :)

bakki @avx128

a year ago

19 72 161 53K 91

0 12 36 5K 8

v1n @0xv1nx0

2 years ago

Not sure if it's new or interesting but when Discord launches, it tries to execute `C:\Program Files\NVIDIA Corporation\\NVSMI\nvidia-smi.exe`. Would be a shame to hijack that non-existent bin if user's have Discord set to launch on Windows startup.