Roberto Soares

🔥 Old Tactics, New Weapons: Abusing Modern Software Stacks for Reliable Shell Access – @espreto teaches how to craft reverse & bind shells with modern runtimes like Clojure, Bun & Crystal when classic tools fail. Hands-on at @redteamvillage_ during @defcon 33! 🚀

@RedTeamVillage_ @NahamSec @0dayCTF @InsiderPhD @santosomar @hAPI_hacker @MeganSquire0 @GrahamHelton3 @defcon The @RedTeamVillage_ at #DEFCON33 also featured @cwolff411, @NopResearcher, @lazzslayer, @FilipiPires, @crd0x49, @Alevsk, @mosesrenegade, @GuhnooPlusLinux, @rxerium, @MikeHacksThings, @espreto, and @Camelotinv. Explore all @DEFCON villages! ➡️ infosecmap.com/event/def-con-… #InfoSec

Welcome @espreto , Co-founder @thalliuminfosec ! ▪ 15+ yrs in offensive security ▪ Apple vuln research ▪ Red team tools ▪ Ex-EY/Nubank | Conf speaker | OSMR holder c0c0n.org #c0c0n #VulnerabilityResearch #CyberSecurity #InfoSec #ThalliumSec

💡Linkook: An OSINT Tool for Uncovering Linked Social Accounts and Emails from a Single Username github.com/JackJuly/linko…

Your laptop was stolen. It’s running Windows 11, fully up-to-date, device encryption (BitLocker) and Secure Boot enabled. Your data is safe, right? Think again! This software-only attack grabs your encryption key : #teaser" target="_blank" rel="nofollow noopener">neodyme.io/en/blog/bitloc… credits @Neodyme

Collection of write-ups, blog posts and papers related to cybersecurity, reverse engineering and exploitation github.com/0xor0ne/awesom… #infosec #cybersecurity

2001: The documentary film "The Secret History of Hacking" had its TV premiere. Covering computer hacking, phreaking, and social engineering, the film featured Steve Wozniak, Captain Crunch, and Kevin Mitnick. Watch the 50 minute film: archive.org/details/The_Se…

🍲🔍 Get ready for a treat! Join us in RTV for @espreto’s talk, "Mac-n-Cheese: How to Cook Up Delicious Electron Techniques for Red Teamers” during @defcon 32. 🍴💻 Dive into the secrets of exploiting Electron apps and more! 📅 9Aug 2024, 4:00 PM 📍 Haven (Track 1)

Do you know the biggest hacker conference in the world? @defcon . I was pleased to have my talk accepted at @RedTeamVillage_ . Let’s cook something delicious there. 🤤 Thanks for the opportunity. #redteam #defcon32

Stoked to announce "Objective by the Sea" v7.0: objectivebythesea.org/v7/index.html #OBTS v7: 📍 Maui, Hawai'i 🗓️ Dec. 2nd - 6th '24 ...hope to see you all there! 🌞🌴

🆕🍎My new blogpost @KandjiMDM about how Apple attempts to mitigate some installer script vulnerabilities using "Install Script Actions" and "Install Script Mutations" in the PackageKit framework. blog.kandji.io/apple-mitigate…

Ahead of our workshop and first day of @Steel_Con, the first tool to be released is SlinkyCat, @myexploit2600 and I will be demoing it in our talk and workshop labs.lares.com/introducing-sl… check it out on @Lares_ Labs #purpleteam #redteam #pentest

3, 2, 1 CrackMapExec 6.0.0 is now public ! 🎉 So much new features and fix that I've made a blogpost for it ▶️ wiki.porchetta.industries/news/a-new-home Special thanks to @_zblurx @MJHallenbeck & @al3x_n3ff for their indefectible support & contributions ! 🍻

Now there's (a more detailed) blog post on this all! Just posted: "Ironing out (the macOS details) of a Smooth Operator" objective-see.org/blog/blog_0x73…

@intigriti “site” can also be used for subdomains, like: site:*.*.google.com #my2cents

That's all for this thread! 🧵 How do you use Google dorks while hunting for bugs? Let us know in the comments! 🔥 And if you want more of these threads, be sure to leave a like 💜

9 Google Dorks you NEED to know about! 🧵 Google knows everything about your target. Google Dorking is using the search engine to find juicy stuff! Here are some quick examples to show you the POWER of dorks 👇

Gregor Samsa: Exploiting Java's XML Signature Verification googleprojectzero.blogspot.com/2022/11/gregor…

We worked together with @_zblurx to pull this new feature on CME ! CrackMapExec can now authenticate using kerberos with login/pass/nthash/aeskey without the need of a KRB5CCNAME ticket env 🚀 But wait there is more! by adding this feature we can now mimic kerbrute features 🔥🫡

Token Access Manipulation, by @RET2_pwn Part (1) xret2pwn.github.io/Access-Token-P… Part (2) xret2pwn.github.io/Building-Token…

Finally got around to writing a blog about the Kerberos RC4-MD4 downgrade attack, how it works, and how you can exploit it. googleprojectzero.blogspot.com/2022/10/rc4-is…

LIVE: Apple Security Research, our new blog and website at security.apple.com! We launch with an update on Apple Security Bounty (security.apple.com/blog/apple-sec…), and a deep dive into some fundamental XNU memory safety improvements with kalloc_type (security.apple.com/blog/towards-t…). Enjoy!