Sean Hopkins @_seahop

Red teamer, terrible coder. Black Badge Defcon30. Joined August 2021

Tweets

635
Followers

189
Following

220
Likes

1K

SpecterOps @SpecterOps

3 weeks ago

Why should Microsoft's Nested App Authentication (NAA) should be on your security team's radar? @Icemoonhsv breaks down NAA and shows how attackers can pivot between Azure resources using brokered authentication. ghst.ly/45h2Zw3

0 21 63 16K 36

Rad @rad9800

4 weeks ago

EDR vendors secure their sales pipelines but neglect monitoring GitHub for exposed installer tokens -leaving customers vulnerable to abuse and over-licensing. Adversaries likely exploit these tokens to build sandboxes for payload testing. Here are search patterns to help…

6 51 313 28K 260

Download Image

Panos Gkatziroulis 🦄 @netbiosX

4 weeks ago

Beyond Beacon: Writing BOF and a Native Rust COFF Loader malware-decoded.com/rust-bof-coff-… #redteam

0 6 19 2K 10

_leon_jacobs(💥) @leonjza

6 years ago

I was today years old when I learnt that you can run ELF using ld-linux. Useful when the executable bit is not set (and you can't change it).

11 249 710 0 94

Download Image

Print3M @Print3M_

4 weeks ago

Solid overview of OPSEC considerations when operating with Sliver C2 by @zimnyaatishina 💪 #redteam #c2 #malware #opsec tishina.in/opsec/sliver-o…

2 33 141 7K 128

SpecterOps @SpecterOps

4 weeks ago

Lance Cain & Daniel Mayer shared examples of Jamf exploitation techniques available to threat actors in their #BHUSA briefing today, which included the introduction of two new tools: JamfHound & Eve.

2 12 41 4K 10

Download Image

Clandestine @akaclandestine

a month ago

GitHub - 0pepsi/Linux-persistence: A no-reboot, in-memory Linux persistence PoC leveraging namespace joining, user-namespace elevation, and self‑deletion. github.com/0pepsi/Linux-p…

0 77 363 24K 285

Stefan Esser @i0n1c

a month ago

There is a party at #GLx and you have been invited. Brand new training course giving you a deep dive into #SPTM, #TXM, #SK and #Exclaves antid0te.sg/blog/25-12-15-…

0 8 27 9K 17

hashcat @hashcat

a month ago

hashcat v7.0.0 released! After nearly 3 years of development and over 900,000 lines of code changed, this is easily the largest release we have ever had. Detailed writeup is available here: hashcat.net/forum/thread-1…

22 379 1K 74K 270

Download Image

Panos Gkatziroulis 🦄 @netbiosX

a month ago

The RPC-function RAiForceElevationPromptForCOM from the appinfo.dll library allows SYSTEM coercion. This only works on domain joined systems. This function can be called from any low privileged user to trigger SYSTEM authentication to an arbitrary location github.com/rtecCyberSec/R…

0 27 104 5K 71

S3cur3Th1sSh1t @ShitSecure

2 months ago

This is so much! 🔥🔥😎 Found two new Potato triggers just today. Not only Potato but can also be used for LPE as remote auth is done which could be relayed to LDAP without Signing enabled. Or relayed to ADCS for a certificate. github.com/warpnet/MS-RPC…

5 181 584 25K 302

James 🏴󠁧󠁢󠁷󠁬󠁳󠁿 @two06

2 months ago

Tool release form my @Steel_Con talk. Nothing ground breaking but free tools are free tools github.com/two06/LinkedIn…

5 43 223 15K 174

vx-underground @vxunderground

2 months ago

Dear Red Team nerds, If you're curious what a successful and serious malware campaign looks like (if you want to make a more serious Red Team engagement) I HIGHLY suggest reading the write up on the new malware campaign called TransferLoader zscaler.com/blogs/security…

16 289 1K 74K 1K

Panos Gkatziroulis 🦄 @netbiosX

2 months ago

DreamWalkers: Reflective shellcode loader with advanced call stack spoofing and .NET support github.com/maxDcb/DreamWa…

1 32 108 6K 67

0xor0ne @0xor0ne

3 months ago

Leveraging program entry points for process injection in Windows bohops.com/2023/06/09/no-… Credits @bohops #infosec #Windows

2 39 239 14K 111

Download Image

0xor0ne @0xor0ne

3 months ago

Windows kernel exploitation for beginners Part 1: mdanilor.github.io/posts/hevd-0/ Part 2: mdanilor.github.io/posts/hevd-1/ Part 3: mdanilor.github.io/posts/hevd-2/ Part 4: mdanilor.github.io/posts/hevd-3/ Part 5: mdanilor.github.io/posts/hevd-4/ #windows #infosec

2 230 1K 42K 1K

Download Image

TKYN @TKYNSEC

3 months ago

Windows 11 24H2 broke a popular malware evasion technique! The Lloyd Labs self-deletion method now fails because of NTFS changes, so I spent time with kernel debugging to figure out why and how to fix it. Full technical breakdown: tkyn.dev/2025-6-8-The-N…

7 106 334 35K 220

Roy Carrilho @RuiCarrilho5

3 months ago

Here's Building a Virtual Machine in C! Cobb Coding is an amazing channel, and this is a great playlist. You can learn a lot on how a computer works by building a VM, and Cobb explains it just fine! Enjoy!

7 103 957 33K 842

Download Image

Roy Carrilho @RuiCarrilho5

4 months ago

Found an amazing guide that shows you how to code a TCP/IP stack from scratch! This is written in C, and goes over every nook and cranny of networks! You can learn a lot of both C and networks just by following this, enjoy!

14 223 2K 157K 3K

Download Image

Social Engineering Community @sec_defcon

5 months ago

🚨Calling all volunteers! SE Community runs on the heart and hustle of our amazing volunteers. 💛 Apply to be a part of the team! 📆Submissions close: June 1, 2025 📬Acceptances sent: June 16, 2025 Learn more: se.community/call-for-volun…