dru1d @_dru1d

Husband. Hacker. Adversary Simulation team lead. OSCP. blog.dru1d.ninja 127.0.0.1 Joined September 2009

Tweets

2K
Followers

934
Following

2K
Likes

15K

Trail of Bits @trailofbits

a day ago

@signalapp @1Password @SlackHQ @googlechrome The attack: override JavaScript builtins in v8_context_snapshot.bin. When apps use these builtins during normal operation, malicious code executes. Code integrity checks miss this, since snapshots are not considered executable. blog.trailofbits.com/2025/09/03/sub…

1 14 142 12K 18

S3cur3Th1sSh1t @ShitSecure

2 days ago

Best Citrix Breakout ever. You can only download .ica files that provide access to certain local applications but breakout out of these applications is not possible? Just modify the .ica file before starting it and remove The InitialProgram= value -> Full Citrix Session! 🤓

11 81 372 30K 210

Download Image

Andrew Oliveau @AndrewOliveau

a week ago

Excited to be presenting "Keep COM and Hijack On: Redefining Windows Session Hijacking" at Black Hat Arsenal Europe this December. Looking forward to connecting with many of you there! 🤟 blackhat.com/eu-25/arsenal/…

1 14 57 6K 12

Download Gif

Octoberfest7 @Octoberfest73

a week ago

Fixed the issue in Koppeling, was missing a single line of code to fix up the RVA of the Name field within the IMAGE_EXPORT_DIRECTORY struct github.com/monoxgas/Koppe…

Octoberfest7 @Octoberfest73

2 weeks ago

Fixed the issue in Koppeling, was missing a single line of code to fix up the RVA of the Name field within the IMAGE_EXPORT_DIRECTORY struct github.com/monoxgas/Koppe…

0 1 12 6K 1

1 4 33 4K 11

Vector 35 @vector35

2 weeks ago

WARP speed ahead! Want to learn more about the future of function matching in Binary Ninja (and hopefully your other favorite tools too!)? Mason talks about that and more in our latest blog post: binary.ninja/2025/08/22/war…

1 5 29 2K 9

Dirk-jan @_dirkjan

2 weeks ago

@NathanMcNulty Intune be like

2 7 36 4K 2

Download Image

Logan Goins @_logangoins

2 weeks ago

I Just documented a cool way to authenticate proxied tooling to LDAP in an AD environment using C2 payload auth context, without stealing any tickets or hashes! Keep tooling execution off-host and away from EDR on your Red Team assessments! specterops.io/blog/2025/08/2…

4 117 398 30K 218

Garrett @unsigned_sh0rt

2 weeks ago

I automated the POC for stealing policies from MP relays from this blog into a modified version of mssqlclient specterops.io/blog/2025/07/1… would work too with any other piv account to the DB github.com/garrettfoster1… (no PR because impacket doesnt merge, sorry)

4 42 115 8K 45

Kyle Avery @kyleavery_

3 weeks ago

if you want to train a model yourself with GRPO: 1. find a verifiable task: jasonwei.net/blog/asymmetry… 2. add a new reward function to open-r1: github.com/huggingface/op…

Kyle Avery @kyleavery_

3 weeks ago

if you want to train a model yourself with GRPO: 1. find a verifiable task: jasonwei.net/blog/asymmetry… 2. add a new reward function to open-r1: github.com/huggingface/op…

0 5 14 9K 9

4 13 54 8K 30

dru1d @_dru1d

3 weeks ago

He’s not on X anymore, but Mike (GitHub: alfarom256) has a new post on how he developed his own tooling to abuse JDWP. malicious.dev/posts/jdwp/

0 4 11 991 4

Phrack Zine @phrack

3 weeks ago

At long last - Phrack 72 has been released online for your reading pleasure! Check it out: phrack.org

7 328 741 110K 242

Download Image

𓃹 @SPLATTERBRAIN01

3 weeks ago

Everywhere I look Factor_ meals sit outside homes baking in the sun

14 7 355 11K 7

dru1d @_dru1d

3 weeks ago

I had a blast learning and working through some cool bug classes! It turns out the FAFO method can be useful for learning new things. 😂

chompie @chompie1337

3 weeks ago

I had a blast learning and working through some cool bug classes! It turns out the FAFO method can be useful for learning new things. 😂

8 10 49 26K 3

0 2 10 5K 0

Low Level @LowLevelTweets

3 weeks ago

i love how software was trending towards being more secure. more sanitizers shipping with clang. more software being written with memory safety in mind. then: vibe coding enters the arena

123 291 6K 223K 362

SpecterOps @SpecterOps

3 weeks ago

PDQ SmartDeploy versions prior to 3.0.2046 used static, hardcoded encryption keys for cred storage. Low-privileged users could potentially access admin creds from registry or deployment files. @unsigned_sh0rt unpacks his testing in his latest blog post. ghst.ly/4mjyuvw

2 52 127 15K 51

Rad @rad9800

4 weeks ago

EDR vendors secure their sales pipelines but neglect monitoring GitHub for exposed installer tokens -leaving customers vulnerable to abuse and over-licensing. Adversaries likely exploit these tokens to build sandboxes for payload testing. Here are search patterns to help…

6 51 313 28K 260

Download Image

Garrett @unsigned_sh0rt

4 weeks ago

WSFC misconfigurations can turn your domain into one big fustercluck. I'm sharing fustercluck today as part of my #BHUSA presentation. The README summarizes the issues and a detailed blog is coming soon. github.com/garrettfoster1…

4 51 115 9K 45

Garrett @unsigned_sh0rt

4 weeks ago

My presentation starts in 20 minutes! Oceanside C level 2. Hope to see you there! #BHUSA

0 2 17 606 0

Download Image

Garrett @unsigned_sh0rt

a month ago

I pushed updates to SCCMHunter as part of my Arsenal demo at #BHUSA today! New features include a relay module for TAKEOVER-5 and a community contribution to coerce client push from a *nix host for ELEVATE-2. github.com/garrettfoster1….

1 48 134 7K 27

SpecterOps @SpecterOps

a month ago

👋 Say hello to Nemesis 2.0, a streamlined, Docker Compose-based platform that is laser-focused on file triage. After introducing v1 two years ago, the team has reworked the platform to better serve what people need from it. Read more from @harmj0y. ⤵️ ghst.ly/4mxQzFU