Dwayne Cyr

@HackingDave @nyxgeek It was probably one of the scariest talks of the week honestly. Especially if you consider the shocking amount of access a guest account gets...

I'm not sure many folks recognize or know the impact @nyxgeek talk at #DEFCON has. The ability unauthenticated to really map some critical data about the organization as well as company relationships and more. Insane that this isn't getting remediated and on the tenant to fix.

Daily reminder that cell data providers prioritize traffic to speedtest[.]net and there's absolutely nothing stopping you from registering a VPS you own to the pool of speedtest servers and also running a VPN on it, allowing you to bypass throttling and often have 0GB plan usage.

🚨 Active Directory admins, read this post and check in PowerShell with: Get-ADObject -Filter "msDS-supportedEncryptionTypes -bor 0x7 -and -not msDS-supportedEncryptionTypes -bor 0x18"

Protip: If you're not already blocking .one files at your perimeter/email gateway...it's time.

30 cybersecurity search engines for researchers: 1. Dehashed—View leaked credentials. 2. SecurityTrails—Extensive DNS data. 3. DorkSearch—Really fast Google dorking. 4. ExploitDB—Archive of various exploits. 5. ZoomEye—Gather information about targets.

Step 1: open a binary in IDA and press F5 Step 2: paste the decompiled code into OpenAI's chatbot Someone's job just got way easier.

Anyone with an Internet connection can get into cybersecurity with nothing but a laptop: @cybraryIT is free. @rootme_org is free. @LetsDefendIO is free. @hackthebox_eu is free. @tryhackme is free. @OverTheWireCTF is free. The resources are already out there.

DreamBooth is becoming popular for creating custom Stable Diffusion models using your images. Here is a beginner friendly thread on how it works: 🧵

*New live hack demo video* CNN’s @donie asked me to hack him again at @defcon — hacked him last time thru service provider call center attacks, but this time I intruded using the easiest method: reused passwords found in data breaches. Here’s the breakdown.

CA Optics - Azure AD Conditional Access Gap Analyzer - out for testing! Having gotten some excellent feedback and ironed some kinks out (and discovered some new ones) I decided it’s time to extend testing from silent release to public release. #ca-optics---azure-ad-conditional-access-gap-analyzer" target="_blank" rel="nofollow noopener">github.com/jsa2/caOptics#…

cyber security isn't important... and that's OK. This isn't a bleak rant... more a sharing of something I've known for a while... and am now accepting. If you want your assumptions of cyber security challenged, please read on! 🧵 1

Threat Actors Leveraging Microsoft Applications To Deliver Cobalt-Strike Beacons. I shared the #YARA Rule to hunt this malware. cc: @malwrhunterteam @vxunderground @pr0xylife @James_inthe_box @JAMESWT_MHT @1ZRR4H @DebugPrivilege @nas_bench @Max_Mal_ github.com/AhmetPayasliog…

"Running a successful open source project is just Good Will Hunting in reverse, where you start out as a respected genius and end up being a janitor who gets into fights." Quote attributed to @cra, and I don't think I've ever seen anything more true posted.

HijackLibs : an open-source, community-driven project tracking DLL Hijacking opportunities in Windows : hijacklibs.net credits @Wietze

Introducing STrace & PDBReSym! An MIT licensed reimplantation of dtrace and rust symbolicating tool. Allows system call hooks in a patchguard compatible way. See my DEFCON talk recording for more details, or the /blog folder for now until that's public! github.com/mandiant/STrace

Thanks to everyone who came out to our demo of SharpSCCM at DEFCON! We had an absolute blast answering your questions and meeting everyone. As promised, the slides are now available on the SharpSCCM GitHub! @subat0mik github.com/Mayyhem/SharpS…

@NicoleBeckwith Delegate clearly and trust your people. Focus on only the most important things. Say no to everything else.

For my manager types out there, what do you find most effective at keeping track of all the balls in the air?

Transfer your PC clipboard to a nearby mobile device: xclip -o -s c | qrencode -o - | feh --force-aliasing -ZF -

@HackerGautam I’ll take a formerly private wordlist.

Dropping all the private wordlists, exclusive templates and exploits in next few hours. Comment if you need it 👇

I’m deleting @Spotify. You should too. Vaccine disinformation is not cool. #DeleteSpotify #Spotifydeleted