whynotsecurity

Fresh off the #WayWest2022 Toolshed, dropping my new Office365 userenum technique against Federated tenants, check it out below! B: whynotsecurity.com/blog/o365feden… G: github.com/knavesec/o365f…

Time for another tool drop. This one I wrote a couple weeks ago for converting ldapdomaindump data to Bloodhound data. Currently only the bare minimum to get data uploaded into Bloodhound works. B: whynotsecurity.com/blog/ldd2bh/ G: github.com/blurbdust/ldd2…

Awhile back I wrote a tool to look for Windows registry files in a given haystack of data (.tar, .vhd, .vmdk). If impacket is installed, it will automatically secretsdump the found registry files. B: whynotsecurity.com/blog/needle/ G: github.com/blurbdust/need…

XSS to RCE: Covert Target Websites into Payload Landing Pages, good introduction article by @knavesec bit.ly/3DdZaXB

XSS to RCE: Hosting your phishing payload on your client's website, a fun technique for boosting your phishing click rate based off a real attack from a known ransomware threat group Blog: whynotsecurity.com/blog/xss-to-rc…

Cool new way to make eyewitness web enum more opsec friendly, designed to bypass scan prevention techniques. Check it out!

New APIs/syscalls for EDR bypass (@yarden_shafir), UAF browser exploit dev (@33y0re), PowerView replacement [EDD] (@FortyNorthSec), phishing banner defeat (@whynotsecurity), malware packer teardown (@fumik0_), NANDcromancy (@Atredis), and more! blog.badsectorlabs.com/last-week-in-s…

Shoutout to @ldionmarcil for making it public. Phishing “external email” warning bypass POC and writeup #redteam

New blog post going into the details about the potato exploits and SeImpersonatePrivilege. micahvandeusen.com/the-power-of-s…

Introducing Credmaster! Easy & anonymous password spraying suite to beat throttle detections. Based on prior work by @ustayready with just a touch of extra research and features Tool: github.com/knavesec/CredM… Blogpost: whynotsecurity.com/blog/credmaste…

The BloodHound Domain Password Audit Tool, the newest feature of Max. Run cracked password analysis to identify vulnerable groups, privileges and patterns using the power and information of BloodHound. Based off previous work by @OrOneEqualsOne whynotsecurity.com/blog/max3/

Go check this out, new Bloodhound attack primitive plus some updates to a great tool

Back with a new blog post, step up your Bloodhound game with Max! Makes it far easier to extract information and interact with the database whynotsecurity.com/blog/max/

@SwiftOnSecurity Correct, any user is allowed to read the keys.

@whynotsecurity Hello thank you. Can you confirm where the registry keys are and that they do not have limiting ACLs on them?

We are announcing our new blog with a post about Teamviewer and storing user passwords encrypted and not hashed allow for easy plaintext retrieval from the Windows registry. whynotsecurity.com/blog/teamviewe…