Powerpointken (@powerpointken) 's Twitter Profile
Powerpointken

@powerpointken

ID: 1481519720503431172

linkhttps://powerseb.github.io calendar_today13-01-2022 06:53:50

219 Tweet

103 Followers

380 Following

Kuba Gretzky (@mrgretzky) 's Twitter Profile Photo

Not sure how I missed this! Luke Kavanagh (Luke Kavanagh) has exhausted the topic on all the mitigations you can implement to protect your users from reverse proxy phishing 🔥🎣 Recommended reading not only if you are on the defense. bleekseeks.com/blog/how-to-pr…

Dirk-jan (@_dirkjan) 's Twitter Profile Photo

It's been quiet for a while around bloodhound Python, however I'm happy to share that I am now maintaining the project at my personal GitHub. The latest version fixes many bugs/issues, also thanks to the many PRs that were submitted (thanks all!). github.com/dirkjanm/blood…

pfiatde (@pfiatde) 's Twitter Profile Photo

If you ever asked yourself how complex it is to setup an O365 phishing infrastructure, the answer might be a little bit disturbing "not much". It's done in under 10 mins and free O.o Here is a walkthrough:

pfiatde (@pfiatde) 's Twitter Profile Photo

Yes, this is not new, this is also simple and stupid. But is it stupid if its working? More Details: badoption.eu/blog/2023/12/0…

pfiatde (@pfiatde) 's Twitter Profile Photo

Did you know, that you can use search-ms to bind a WebDAV drive and filter there? This offers some possibilities for attack chains, e.g. with Java, Python, Ruby or Visual Studio. Here is a PoC for Visual Studio: More 🧵👇 #initialAccess

pfiatde (@pfiatde) 's Twitter Profile Photo

As nowadays an EDR is on almost PC, it might be time to move on to the next part in assesments. Smartphones maybe? You can send a QR Code as Unicode, to ensure you land on a mobile device, bypass image privacy and and go for device code phishing to get a full Azure / M365 PRT!

As nowadays an EDR is on almost PC, it might be time to move on to the next part in assesments.
Smartphones maybe?
You can send a QR Code as Unicode, to ensure you land on a mobile device, bypass image privacy  and  and go for device code phishing to get a full Azure / M365 PRT!
pfiatde (@pfiatde) 's Twitter Profile Photo

More details are here, as usual: badoption.eu/blog/2024/01/0… If you have some remarks, feel free to discuss here or send me a DM.

pfiatde (@pfiatde) 's Twitter Profile Photo

Microsoft patched the MS Teams external collaboration Splashscreen bypass via meetings, after 4 months. So, here is a new one via group chats 🫣🫣🫣

pfiatde (@pfiatde) 's Twitter Profile Photo

Steps: - Create a group chat - Invite the external “victim” - Write your message - Splash screen will be shown to the user - Remove the user from participants - Splash screen will also be removed Some details here: badoption.eu/blog/2024/01/1…

SkelSec (@skelsec) 's Twitter Profile Photo

Psst! Hey you! yeah I see you struggling with exfiltrating vhdx files you found on that public SMB share over a HTTP tunnel. What if I told you there is a better way? You can browse remote disk images with this project and only download what u need! github.com/skelsec/adiskr…

pfiatde (@pfiatde) 's Twitter Profile Photo

Leaking sensitive data via public accessable cloud storage is still a thing... I collected some samples of what can be found. Crazy stuff... badoption.eu/blog/2024/02/2…

Chetan Nayak (Brute Ratel C4 Author) (@ninjaparanoid) 's Twitter Profile Photo

Watching people tweet they bypassed a certain EDR is just cringe at this point. When you ask them what did they bypass, they dont know what. So let me take you back to school... Executing OpenSource tool is not a bypass. An EDR employs several mechanisms for detection. Getting a

pfiatde (@pfiatde) 's Twitter Profile Photo

As ntlm leaking is still a thing, made a showcase for elevating via ldap relaying with some little tricks. Relaying is done with a Win Client without admin privs and an active Windows firewall (default config), by using HTTP.SYS and SSH. Details here: badoption.eu/blog/2024/04/2…

Nathan McNulty (@nathanmcnulty) 's Twitter Profile Photo

Have you blocked Device Code flow by default yet? If not, this very slow Graph PowerShell Beta command will tell you who is using them Get-MgBetaAuditLogSignIn -Filter "AuthenticationProtocol eq 'deviceCode'" Microsoft calls this a best practice, so go create the CA policy ;)

Have you blocked Device Code flow by default yet?

If not, this very slow Graph PowerShell Beta command will tell you who is using them

Get-MgBetaAuditLogSignIn -Filter "AuthenticationProtocol eq 'deviceCode'"

Microsoft calls this a best practice, so go create the CA policy ;)