TechnSecurity @ActorTechn

Active Directory Hardening Series Part 1 Disabling NTLMv1 techcommunity.microsoft.com/blog/coreinfra… Part 2 Removing SMBv1 techcommunity.microsoft.com/blog/coreinfra… Part 3 Enforcing LDAP Signing techcommunity.microsoft.com/blog/coreinfra… Part 4 Enforcing AES for Kerberos techcommunity.microsoft.com/blog/coreinfra…

Found an interesting host it doesn't have an open C2 panel, but there are a lot of different files, whether it's various bruteforce scripts, checkers, exploits, cookies, and much more. You can take a look yourselves it works on different ports: 8080, 7777, 8002 172.86.76[.]127

Free research Fridays? hXXp://139.162.182.252:8080/

🚨 Based on @rapid7 observations of exploitation of PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257), we can also confirm first signs of exploitation around the same time (May 18th on the Defused TF feeds, and a customer hit on May 17th) The exploit payload differs slightly from Rapid 7's POC with the user-agent PAN GlobalProtect/6.0.0 Attacker IP: 104.207.144[.]154 🇺🇸 AS20473 The Constant Company Rapid7 write-up: rapid7.com/blog/post/etr-…

⚠️⚠️ CVE-2026-39352 (CVSS 8.7): Path traversal may allow unauthenticated arbitrary file read on internet-facing Frappe-based ERP surfaces (e.g. ERPNext). 🔗FOFA Link: en.fofa.info/result?qbase64… 🎯115.7K+ Results are found on en.fofa.info in the past year. FOFA Query: app="ERPNext" 🔖Refer: github.com/frappe/frappe/… #OSINT #FOFA #CyberSecurity #Vulnerability

A sophisticated ValleyRAT malware campaign uses fake Microsoft Teams installers and DLL sideloading to evade Windows Defender detection. #ValleyRAT #SilverFoxAPT #MalwareCampaign #Infosec #CyberNews securityonline.info/valleyrat-malw…

Windows DNS Client RCE -- CVE-2026-41096 POC -- qdcount=0, a DNS OPT resource record (type 41), and 0xff bytes via example response -- github.com/satchfunky/CVE…

🌐 Open-Source Web Scanners — Massive Collection of Web Security Testing Tools Includes scanners for: • Web vulnerabilities • APIs • CMS platforms • XSS, SQLi, SSTI, SSRF • Fuzzing & brute forcing • Infrastructure & DAST testing Tools covered: • Nuclei • OWASP ZAP • SQLMap • XSStrike • Dalfox • ffuf • dirsearch • Nikto • Wapiti • Commix • Ghauri • WPScan • feroxbuster • gobuster • And many more Categories: • General-purpose scanners • Infrastructure scanners • API security tools • CMS scanners • Specialized vulnerability scanners • Fuzzers & brute force tools Useful for: • Pentesters • Bug bounty hunters • AppSec engineers • Red teamers 🔗 github.com/psiinon/open-s… #CyberSecurity #AppSec #BugBounty #Pentesting #OWASP #RedTeam #WebSecurity #DAST

Password Reset Poisoning -> Account Takeover POC -> 1. Intercepted password reset request 2. Changed Host header to attacker domain 3. Reset link generated with malicious host 4. Victim clicked poisoned reset URL Learning -> - Never trust Host headers - Use fixed domains for reset links #BugBounty #CyberSecurity #BugBountytips

keyboard_arrow_left Previous keyboard_arrow_right Next

''GitHub - nikaiw/VMkatz: Extract Windows credentials directly from VM memory snapshots and virtual disks'' #infosec #pentest #redteam #blueteam github.com/nikaiw/VMkatz

@obscaries what Altarnative chrom

Active Directory Reconnaissance with Sliver C2 Learn how cyberwarriors enumerate Active Directory environments using tools like PowerView, SharpView, and native Windows utilities to better understand domain structures, trust relationships, and security weaknesses. hackers-arise.com/building-comma… @three_cube @co11ateral

⚠️403 bypass tools for bug bounty hunters: bypass-403 → github.com/iamj0ker/bypas… nomore403 → github.com/devploit/nomor… 4-ZERO-3 → github.com/Dheerajmadhuka… byp4xx → github.com/lobuhi/byp4xx dontgo403 → github.com/mbrg/dontgo403

We just received a bounty reward from UniFi for reporting a vulnerability affecting UniFi OS devices. As part of the Hakai Labs (@HakaiOffsec) research team at @quimerax_intel, we independently identified a Path Traversal vulnerability (CVE-2026-34911) that allowed an attacker with network access to access internal routes on the underlying system without a valid token, exposing a sensitive information. Our research was conducted independently, but the vulnerability we reported could be chained with other vulnerabilities disclosed during the same period, including Improper Access Control and Command Injection flaws reported by other researchers. When combined, these issues lead to a pre-auth RCE affecting multiple UniFi OS products. Affected products include UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, Express 7, UNVR, UNVR-Pro, UNVR-Instant, ENVR, UCG-Ultra, UCG-Max, UCG-Fiber, and several other UniFi OS devices. We strongly recommend updating affected systems to the latest available version. Technical details remain under coordinated disclosure, and the only public information currently available is UniFi’s Security Advisory Bulletin. community.ui.com/releases/Secur…

goLoL - a Windows host scanner that finds LOLBAS binaries present on the current machine and lists techniques you can run at your current privilege level with MITRE ATT&CK mappings and example commands github.com/aaron-kidwell/…

Threat Intelligence Analysis: PhantomKiller (BYOVD) PhantomKiller is a new EDR/AV evasion proof-of-concept that weaponizes a legitimate, fully signed Lenovo kernel driver (BootRepair.sys). It employs a classic Bring Your Own Vulnerable Driver (BYOVD) technique with an exceptionally simple and reliable implementation: it enables any low-privileged user (or after driver loading) to terminate any process on the system, including Protected Process Light (PPL) processes protected by modern EDRs. Technical Details of the Driver & Vulnerability •Driver: BootRepair.sys (part of Lenovo PC Manager) •SHA256: 5ab36c116767eaae53a466fbc2dae7cfd608ed77721f65e83312037fbd57c946 •Signature: Valid Lenovo signature (trusted by Windows; currently 0 detections on VirusTotal) •Build date: ~2018 (legacy driver still not broadly blocked) Reverse Engineering Highlights (IDA Pro): •Creates device object \\Device\\::BootRepair without a secure DACL. •Exposes symbolic link \\DosDevices\\BootRepair — any user-mode process can open it via CreateFileW("\\\\.\\BootRepair"). •Only one IOCTL is exposed: 0x222014. •The handler simply validates a 4-byte buffer (DWORD PID) and calls ZwTerminateProcess directly in kernel context with zero checks on caller, PID, or protections. Result: Ring-0 termination bypasses all EDR objection handling, PPL, minifilter callbacks, and process protections. Simple PoC HANDLE h = CreateFileW(L"\\\\.\\BootRepair", GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL); DeviceIoControl(h, 0x222014, &pid, sizeof(pid), NULL, 0, &ret, NULL); •If the driver is already loaded → direct low-priv exploitation. •Otherwise → classic BYOVD load via sc.exe. Successfully tested against CrowdStrike Falcon and claimed to work universally due to the kernel-trusted nature of the driver. Cross-Checked Intelligence •Disclosed May 19-21, 2026 by Jehad Abu Dagga (@jehadbudagga). •Official repo: github.com/redteamfortres… •Rapidly added to LOLDrivers by the community. •Part of the ongoing 2026 wave of BYOVD EDR killers (ESET tracked 54+ tools abusing 35 vulnerable drivers this year). Key IOCs: •File: BootRepair.sys (SHA256 above) •Device: \\.\BootRepair / \\Device\\::BootRepair •IOCTL: 0x222014 •Service name: PhantomKiller (or attacker-chosen) References:
• Full technical write-up: medium.com/@jehadbudagga/…
• PoC Repository: github.com/redteamfortres… . #CyberSecurity #ThreatIntelligence #EDR #BYOVD #RedTeaming #InfoSec #WindowsSecurity #Vulnerability #CyberThreats #MalwareAnalysis

macOS malware cluster using heredoc to embed base64+gzip payload directly inside the script, executes in memory. One variant uses operator-tasked AppleScript via C2 instead of hardcoded instructions. Shared API keys suggest common builder. IOCs + writeup: github.com/motuariki/IOCs…

Este video contiene las principales metodologías que utilizan los atacantes para hackear sitios web de WordPress.

@xabdul بالتوفيق انت مبدع

🚨Alert🚨 CVE-2026-42945: A Critical Heap Buffer Overflow in NGINX. 🧐Credit by depthfirst:depthfirst.com/research/nginx… 📊 868M+ Services are found on the hunter.how yearly. 🔗Hunter Link:hunter.how/list?searchVal… 👇Query HUNTER : product.name="Nginx" 📰Refer:github.com/DepthFirstDisc… thehackernews.com/2026/05/18-yea… #hunterhow #infosec #infosecurity #OSINT #Vulnerability