Tract0r @Tract0r_

Offensive Security Windows Intrernals Active Directory Initial Access Malware Dev Joined April 2012

Tweets

3K
Followers

266
Following

160
Likes

3K

S3cur3Th1sSh1t @ShitSecure

3 days ago

Best Citrix Breakout ever. You can only download .ica files that provide access to certain local applications but breakout out of these applications is not possible? Just modify the .ica file before starting it and remove The InitialProgram= value -> Full Citrix Session! 🤓

11 83 381 31K 215

Download Image

vx-underground @vxunderground

6 days ago

Please look at the vulnerable drivers. Even if you don't plan on reversing them or exploiting them, just behold the beauty of the potential which will not be used by lots of people (myself included, probably) vx-underground.org

3 6 87 12K 25

Lampros @lampnout

6 days ago

Looking at a Roadrecon collection through the lenses of SQLiteBrowser may pay dividends. It allows you to perform custom SQL queries and, overall, search intelligently. For this purpose I'm publishing a list of Roadrecon-compatible SQL queries stmxcsr.com/micro/roadreco…

0 22 47 8K 41

Logan Goins @_logangoins

2 weeks ago

I Just documented a cool way to authenticate proxied tooling to LDAP in an AD environment using C2 payload auth context, without stealing any tickets or hashes! Keep tooling execution off-host and away from EDR on your Red Team assessments! specterops.io/blog/2025/08/2…

4 117 397 30K 218

sn🥶vvcr💥sh @snovvcrash

5 days ago

Oh, that's nice! I've done something similar recently with a vibe coded HTTP proxy server run in context of the target user to access the needed web resource behind domain authentication instead of an LDAP relay 😁

Logan Goins @_logangoins

2 weeks ago

4 117 397 30K 218

1 31 141 10K 56

Download Image

Johann Rehberger @wunderwuzzi23

a week ago

Woohooo! Working on final post for Month of AI Bugs! Can't believe I followed through with this 😀 Hope it serves as useful reference + inspires many to get into AI security testing! We need more people asking tough questions & holding vendors accountable Let's do this! 🚀

8 28 127 9K 53

Download Image

SpecterOps @SpecterOps

a week ago

Cookie theft has evolved. 🍪 Over the last year, stealing cookies on Windows devices has changed significantly for Chromium browsers like Chrome and Edge. Andrew Gomez dives into these changes, how threat actors adapt, & new detection opportunities. ghst.ly/45S1ZgW

3 76 151 12K 84

mpgn @mpgn_x64

a week ago

NTLMv1: NTLMv1 is removed starting in Windows 11, version 24H2 and Windows Server 2025. learn.microsoft.com/en-us/windows/…

6 64 292 24K 74

Dirk-jan @_dirkjan

2 weeks ago

It seems there now is a BOF implementation of ADSyncDecrypt to dump Entra ID connect creds 👀 github.com/Paradoxis/ADSy…

1 84 258 14K 151

LuemmelSec @theluemmel

2 weeks ago

Not again... Citrix, the company that keeps on giving. cyberplace.social/@GossiTheDog/1… If you want to check your systems: github.com/fox-it/citrix-…

1 45 142 16K 81

db @whokilleddb

2 weeks ago

Another hoontr find: tprtdll.dll (like so many others) exposes some Nt/Rtl/Zw functions. It doesn't redirect to ntdll, instead it makes the syscall itself - so you can call something like NtAllocateVirtualMemoryEx without ever touching ntdll! PoC: github.com/whokilleddb/fu…

6 78 333 24K 221

Download Image

LetsDefend @LetsDefendIO

2 weeks ago

Plaintext vs Encoding vs Hashing vs Encryption

8 138 560 29K 418

Download Gif

Garrett @unsigned_sh0rt

2 weeks ago

I automated the POC for stealing policies from MP relays from this blog into a modified version of mssqlclient specterops.io/blog/2025/07/1… would work too with any other piv account to the DB github.com/garrettfoster1… (no PR because impacket doesnt merge, sorry)

4 42 115 8K 45

SpecterOps @SpecterOps

3 weeks ago

Hosts running the WebClient service are prime targets for NTLM relay attacks, and it may be possible to start the service remotely as a low-privileged user. @0xthirteen breaks down the service startup mechanics, plus the protocols and technologies. ghst.ly/41QT7GW

0 59 173 19K 75

RedTeam Pentesting @RedTeamPT

2 weeks ago

@SpecterOps found out that the EFS service (PetitPotam) can simply be activated by asking the endpoint mapper. Great research!🎓 Now our efsr_spray NetExec module is obsolete, but we're on it: This PR activates the service by default with coerce_plus 🚀 github.com/Pennyw0rth/Net…

SpecterOps @SpecterOps

3 weeks ago

0 59 173 19K 75

0 39 139 9K 68

Wil @wil_fri3d

3 weeks ago

gpoParser, which I presented at #leHACK2025 and #DEFCON, is available here: github.com/synacktiv/gpoP… It is a specialized utility designed to enumerate Group Policy Objects (GPOs) and identify potential security misconfigurations.

4 169 492 28K 391

eversinc33 🤍🔪⋆｡˚ ⋆ @eversinc33

3 weeks ago

As a little follow up, I wrote a small blog post/tutorial on how to reverse engineer windows drivers with IDA - this is aimed at people that newer touched drivers before and covers IOCTL codes, IRPs and some IDA shenanigans with unions. eversinc33.com/posts/driver-r… Enjoy :3

4 128 539 33K 439

Download Image

SpecterOps @SpecterOps

4 weeks ago

The AD CS security landscape keeps evolving, and so does our tooling. 🛠️ @bytewreck drops info on Certify 2.0, including a suite of new capabilities and refined usability improvements. ghst.ly/45IrBxI

0 98 235 12K 81

Dirk-jan @_dirkjan

4 weeks ago

Good article from Bleeping Computer about the Exchange hybrid tradecraft I dropped at Black Hat yesterday, with some of my comments on the techniques: bleepingcomputer.com/news/security/…