Red Teamer & Security researcher
Maintainer of #NetExec, #DonPAPI, dploot, certsync, and all the stuff on my github repo
bsky: https://t.co/zISpgvDSWcgithub.com/zblurx Paris, FranceJoined February 2020
Writeup from @mael91620 is now available 🎉
From coerce into SPN less RBDC, gmsa decryption, dpapi, constraint delegation w/t protocol transition to ntds dissection ! 😈
Congrats to the one who solved it
🥇@rayanlecat
🥈@_bluesheet & 🐊
🥉@_sans23
➡️github.com/mael91620/Barb…
Writeup from @mael91620 is now available 🎉
From coerce into SPN less RBDC, gmsa decryption, dpapi, constraint delegation w/t protocol transition to ntds dissection ! 😈
Congrats to the one who solved it
🥇@rayanlecat
🥈@_bluesheet & 🐊
🥉@_sans23
➡️github.com/mael91620/Barb…
gpoParser, which I presented at #leHACK2025 and #DEFCON, is available here: github.com/synacktiv/gpoP…
It is a specialized utility designed to enumerate Group Policy Objects (GPOs) and identify potential security misconfigurations.
Session enumeration is only possible with admin privileges? That is a problem of the past thanks to the new --reg-sessions core functionality of NetExec, made by @toffyrak🔥
Reverse engineering Microsoft’s SQLCMD.exe to implement Channel Binding support for MSSQL into Impacket’s mssqlclient.py. Storytime from Aurelien (@Defte_), including instructions for reproducing the test environment yourself.
(link below)
I'm SO hyped to finally make MSSQLHound public! It's a new BloodHound collector that adds 37 new edges and 7 new nodes for MSSQL attack paths using the new OpenGraph feature for 8.0!. Let me know what you find with it!
- github.com/SpecterOps/MSS…
- specterops.io/blog/2025/07/2…
Golden dMSA: One key to rule them all
Just found a new flaw in Windows Server 2025's dMSAs that lets attackers brute-force ALL managed service account passwords with 1024 attempts. This research builds on the awesome research Golden gMSA (@YuG0rd ).
semperis.com/blog/golden-dm…
This is so much! 🔥🔥😎
Found two new Potato triggers just today. Not only Potato but can also be used for LPE as remote auth is done which could be relayed to LDAP without Signing enabled. Or relayed to ADCS for a certificate.
github.com/warpnet/MS-RPC…
Ludushound shows the power of community driven innovation in cybersecurity. @bagelByt3s created an awesome tool to convert bloodhound data into a working lab in 🏟️ Ludus. Replicate complex live environments with automation - and get back to the fun stuff!
specterops.io/blog/2025/07/1…
Netexec users and Windows lovers here is a small tip I learned experimenting with @scam_work about windows loggedon-users and scheduled task impersonation
Introducing Havoc Professional: A Lethal Presence
We’re excited to share a first look at Havoc Professional, a next-generation, highly modular Command and Control framework, and Kaine-kit our fully Position Independent Code agent engineered for stealth!
infinitycurve.org/blog/introduct…
github.com/LuemmelSec/P4w…
P4wnP1 on the Zero 2 W? Sure why not
Detailed documentation? Sure why not
New images and instructions to do your own? Sure why not
New attacks per default? Sure why not.
Was down in the rabbit hole for days ... Enjoy.
Thx @mame82 and @RoganDawes
How to find the Entra ID sync server - A new NetExec module🔎
Inspired by the great Entra ID talks at #Troopers25, I looked into how to find the Entra ID sync server.
Results: The description of the MSOL account, as well as the ADSyncMSA service account reference this server🚀
Let's crack on 🧨
From a passion project to an essential tool, #NetExec has become a go-to resource for many in the cybersecurity space. Join us as we sit down live on YouTube with @mpgn_x64, the mind behind it all, to talk open source, persistence, and the personal journey of…
Happy to finally share a new blog with @exploitph on our work revisiting the Kerberos Diamond Ticket.
✅ /opsec for a more genuine flow
✅ /ldap to populate the PAC
🆕 Forge a diamond service ticket using an ST
We finally gave it a proper cut 💎
huntress.com/blog/recutting…
0 Followers 64 Following🇫🇷 French
✏️ Aspiring penetration tester (Currently looking for a Penetration Tester position in Toulouse). CTF Player
🎹 Plays piano, drums and composes
2 Followers 100 FollowingProtecting your digital assets from the latest cyber threats. Red Threat Cyber Security offers MSSP, penetration testing, database optimization, SOC & many more
172 Followers 378 FollowingHigh conviction trader turned gambler(lost everything) turned high conviction trader. Never listen to anyone u find on CT, they'll dump on u. Find ur own trades
0 Followers 37 FollowingI'm an 18-year-old developer who's been passionate about creating programs since I was a kid. I use AI a lot to achieve certain goals.
82 Followers 2K FollowingTrust in His plan | God's love makes even the hardest journeys worthwhile | His love is the compass guiding your life's purpose |
2K Followers 92 FollowingA @LexfoSecurite service.
Ambionics is combining the best of human intelligence and technology to continuously assess the security of your applications.
5K Followers 2K FollowingRemote desktop protocol expert, OSS contributor and Microsoft MVP. I love designing products with Rust, C# and PowerShell. Proud to be CTO at Devolutions. 🇨🇦
71K Followers 402 FollowingThe UTMB® invites you to live an adventure by participating to one of the 8 races: UTMB®, CCC®, TDS®, OCC, PTL®, MCC, ETC & YCC !
#HOKAUTMBMontBlanc
2K Followers 8 FollowingAI Malware Art Generation by @Laughing_Mantis. The Machines Make The Art I Just Provide The Malware. May be semiNSFW. All Rights Reserved on Art except for VXU
14K Followers 2K FollowingWomen In Security and Privacy (WISP) — Advancing women and underrepresented communities to lead the future of security & privacy | Nonprofit org open to all
190K Followers 0 FollowingWe make learning web hacking and security easier. Online systems, code review, videos & courses that can be used to understand, test and exploit bugs!
378 Followers 180 FollowingAssistant professor @INSA-Toulouse & LAAS-CNRS / Wireless & embedded security researcher, with a focus on IoT. / developer of WHAD project: https://t.co/eYyB9EMf3u
3K Followers 33 FollowingBallisKit provides tooling and services to professional Pentesters & Red Teams.
We develop MacroPack, ShellcodePack, and DarwinOps.
#redteam #infosec
5K Followers 9 FollowingPaged Out! is a free magazine about programming, hacking, security hacking, retro computers, modern computers, electronics, demoscene, and other amazing topics.
16K Followers 2K FollowingTargeted Ops Red Team @ TrustedSec | Hacking since Renegade BBS backdoors | Prior CrowdStrike/BHIS | In Christ's grip | I speak for myself only | K1HAQ
4K Followers 2K Followingjust a french canadien | ai red team @HiddenLayerSec | CISSP BSCP CRTL CRTO OSCP eWPTX eCPPT | goofing off @ https://t.co/aWC0YYEp9x
10K Followers 1K FollowingPenetration Testing, Purple Team, Red Team & Adversary Emulation, Security Posture Review and Training
Let our Offense, Prepare your Defense.
#weareoffensive