Pixis @HackAndDo

Active Directory curious ♥ hackndo.com France Joined July 2014

Tweets

3K
Followers

8K
Following

392
Likes

3K

Pixis @HackAndDo

2 weeks ago

A detailed description of the R&D process with its ups and downs, a great deep dive into Windows internals to try to remotely enable the Web Client service. Great work 👏

SpecterOps @SpecterOps

2 weeks ago

A detailed description of the R&D process with its ups and downs, a great deep dive into Windows internals to try to remotely enable the Web Client service. Great work 👏

0 59 173 19K 75

0 2 19 2K 7

Hosts running the WebClient service are prime targets for NTLM relay attacks, and it may be possible to start the service remotely as a low-privileged user. @0xthirteen breaks down the service startup mechanics, plus the protocols and technologies. ghst.ly/41QT7GW

0 59 173 19K 75

mpgn @mpgn_x64

3 weeks ago

If you want to quickly check whether the guest account is enabled, you can now do it with NetExec. This is not enabled by default you need to set the custom flag check_guest_account in your nxc.conf file. Maybe one day it will be set to true by default 🪂

4 30 170 12K 75

Download Image

Wil @wil_fri3d

3 weeks ago

gpoParser, which I presented at #leHACK2025 and #DEFCON, is available here: github.com/synacktiv/gpoP… It is a specialized utility designed to enumerate Group Policy Objects (GPOs) and identify potential security misconfigurations.

4 169 492 28K 391

Ruben Labs @RubenLabs

3 weeks ago

You didn’t click, but your password challenge is leaked. I’m excited to share my latest research: CVE-2025-50154, a high severity NTLM hash disclosure vulnerability in the explorer.exe process, exploitable without any user interaction. cymulate.com/blog/zero-clic…

0 35 81 10K 62

Alex Neff @al3x_n3ff

4 weeks ago

Session enumeration is only possible with admin privileges? That is a problem of the past thanks to the new --reg-sessions core functionality of NetExec, made by @toffyrak🔥

7 96 426 36K 219

Download Image

Tomer Nahum @TomerNahum1

a month ago

Today, together with Jonathan Elkabas, we're releasing EntraGoat - A Deliberately Vulnerable Entra ID Environment. Your own hands-on Entra lab for identity attack simulation. Built for red teams, blue teams and identity nerds. Check it out here👉github.com/semperis/entra…

9 232 695 40K 532

Download Image

Alex Neff @al3x_n3ff

a month ago

Added a small Quality of Life improvement to NetExec: When the target allows null authentication the host banner automatically displays this info now🚀

10 36 229 17K 33

Download Image

Andy Robbins @_wald0

a month ago

In this blog post I explain the fundamental building blocks, vocabulary, and principles of attack graph design for BloodHound: specterops.io/blog/2025/08/0…

1 42 97 9K 34

hashcat @hashcat

a month ago

hashcat v7.0.0 released! After nearly 3 years of development and over 900,000 lines of code changed, this is easily the largest release we have ever had. Detailed writeup is available here: hashcat.net/forum/thread-1…

22 379 1K 74K 270

Download Image

Dirk-jan @_dirkjan

a month ago

It's been almost a year since my last blog... So, here is a new one: Extending AD CS attack surface to the cloud with Intune certificates. Also includes ESC1 over Intune (in some cases). dirkjanm.io/extending-ad-c… Oh, and a new tool for SCEP: github.com/dirkjanm/scepr…

9 195 526 29K 255

S3cur3Th1sSh1t @ShitSecure

2 months ago

To trigger local SYSTEM authentication for relaying to ADCS or LDAP for LPE you would usually need the printer service or EFS service to be enabled (printerbug/petitpotam). Here is an alternative without this requirement 🤠 github.com/rtecCyberSec/R…

3 108 327 33K 202

Download Image

OtterHacker @OtterHacker

3 months ago

Okta chained with Azure with auto MFA subscription for Okta and frame-buster bypass to perform Bitb ! Evilginx is really nice to setup custom phishing campaign whatever the environment is... Phishlet available here : github.com/OtterHacker/Ok…

4 54 211 39K 145

Download Video

SpecterOps @SpecterOps

2 months ago

SCCM’s Management Points can leak more than you’d expect. @unsigned_sh0rt shows how Network Access Accounts, Task Sequences, and Collection Settings can be stolen by relaying a remote Management Point to the site database. Check it out ⬇️ ghst.ly/4eNLaHU

1 80 167 13K 89

Aurélien Chalot @Defte_

2 months ago

Netexec users and Windows lovers here is a small tip I learned experimenting with @scam_work about windows loggedon-users and scheduled task impersonation

2 43 167 24K 123

Melvin langvik @Flangvik

2 months ago

New video out 😊 showing how you can take control of port 445 and perform those magical relay attacks toward AD CS when working from a C2 agent. Way easier than before thanks to some great research by @zyn3rgy youtube.com/watch?v=e4f3h5…

0 82 238 25K 158

Franso @Fransosiche

2 months ago

🧐Le 11 juin dernier, deux chercheurs de @Synacktiv ont publié un billet de blog révélant CVE-2025-33073, une faille critique qui est pourtant passée (presque) sous le radar. 🤓On passe en revue la vuln' aujourd'hui ! youtu.be/sXdca8lfG14

0 7 19 2K 7

Download Image

Pixis @HackAndDo

3 months ago

Je serai à #LeHack vendredi 27 et samedi 28 juin, et si tu n'as pas encore ta place, tente ta chance pour venir gratuitement, en résolvant ce petit challenge made by @LoginSecurite 💪 linkedin.com/posts/login-s-…

1 4 9 5K 2

SpecterOps @SpecterOps

3 months ago

Introducing the BloodHound Query Library! 📚 @martinsohndk & @joeydreijer explore the new collection of Cypher queries designed to help BloodHound users to unlock the full potential of the BloodHound platform by creating an open query ecosystem. ghst.ly/4jTgRQQ

3 112 282 21K 152

Synacktiv @Synacktiv

3 months ago

While performing penetration tests on SAP Financial Consolidation, our ninjas @l4x4 and @alexisdanizan discovered an authentication bypass for local accounts including the built-in ADMIN account, leading to the underlying system compromise: synacktiv.com/en/advisories/…