invisiblebyte @invisiblebyte

FalconFlank : Crowdstrike Falcon 0day LPE is now public github.com/MSNightmare/Fa…

EvilFontTool - hides machine-readable text inside a document that displays completely different text to a human reader. github.com/DoctorEww/Evil…

Three zero-days in Windows 11 and Microsoft Entra ID. Over 20 novel attack techniques against passkeys. Toolkit open sourced. Microsoft declined to fix one of them. Passkeys were supposed to be unphishable. @MGrafnetter from @SpecterOps just presented Pass-the-Passkey at Black Hat. Global Admin impersonation from a standard user account. No user interaction. Bypasses phishing-resistant MFA Conditional Access policies. Zero alerts from Defender for Identity or Entra Identity Protection on M365 E5. Windows Hello passkeys are still vulnerable after the patches because they always send signature counter 0. Microsoft scored it 6.5 Medium and paid $1,000. The researcher scored it 8.6 High. Their advisory described it as 'could potentially read small portions of heap memory.' This is the same team behind BloodHound, Certified Pre-Owned (AD CS), Rubeus, Certify, Seatbelt, SharpDPAPI, SharpUp, Ghostwriter, Nemesis, SharpSCCM, and CuddlePhish. They consistently ship research that changes how the industry thinks about Active Directory and identity security. If you do red teaming, pentesting, identity security, Entra ID, FIDO2, WebAuthn, Windows Hello, phishing-resistant MFA, or detection engineering, this is the most important identity research to drop this year. Pass-the-Hash for the passwordless era. i.blackhat.com/BH-USA-26/Pres… #Infosec #RedTeam #DetectionEngineering

keyboard_arrow_left Previous keyboard_arrow_right Next

Happy to share a technical analysis by @h0j3n on our recent CVE-2026-54121 a.k.a Certighost. glhf🔥 Technical analysis: gist.github.com/H0j3n/a5ef2609… POC: github.com/aniqfakhrul/CV…

This Hacker Made $40,000 Using Claude Code youtu.be/pRPT_yrgRL0

Hacking into modems: 30+ vulnerabilities in devices used in homes, ATMs, buses, and critical infrastructure. ☎️🌐👨🏻‍💻💡🍟 More details on: LinkedIn: linkedin.com/posts/dlaskov_… Substack: it4sec.substack.com/p/hacking-into…

Every Entra ID assessment ends here: “How do I get a token without triggering Conditional Access controls?” 🤔 @rbnroot built CAPSlock, an offline ROADrecon-based Conditional Access engine that simulates sign-ins & flags gaps without touching the tenant. ghst.ly/4aKIk64

NTLM relays failing because of EPA? 😒 @zyn3rgy & @Tw1sm break down how to enumerate EPA settings across more protocols + drop new tooling (RelayInformer) to make relays predictable. Check out their blog for more: ghst.ly/4rqwpRs

Credential Guard was supposed to end credential dumping. It didn't. @bytewreck just dropped a new blog post detailing techniques for extracting credentials on fully patched Windows 11 & Server 2025 with modern protections enabled. Read for more ⤵️ ghst.ly/4qtl2rm

We are looking for a junior security researcher 🤠 No university degree or previous work experience required, but MUST be able to demonstrate interest in the field and some basic skills by either: 1. Have published blog post detailing 0-day vulnerability (found by yourself) or n-day (analysing someone else's vuln in detail), preferably with exploit code published for the vuln detailed in the blog post. 2. We can also accept private write-ups for vulns you have found / exploited but never published (even if they are already fixed). 3. OR if you don't have any of the above, but have a way to prove your skill, hit me up and we'll talk! We're also accepting mid-level security researchers with a few years experience! What we offer: - Fully remote working environment with regular company meet-ups. - Great salaries and bonuses! - Flexibility to work on different CUTTING EDGE projects (mostly related to mobile). - Mentoring and training by some of the world's top security researchers

How the NSA (Equation Group) allegedly hacked into China's Polytechnical University 👀 I analysed intelligence reports from Chinese cyber firms (360, Pangu, CVERC) to aggregate TTPs attributed to Equation Group. 🔗inversecos.com/2025/02/an-ins…

Transform your smartphone into a portable hacking lab Lear how to set up Kali Linux #PiTail and control it with just your smartphone. Plus, get some of my tips on troubleshooting common issues along the way Read more: mobile-hacker.com/2024/10/04/por…

Articles worth reading discovered last week: 🗞 lyra.horse/blog/2024/09/u… 🗞 blog.includesecurity.com/2024/09/vulner… 🗞 shielder.com/blog/2024/09/a… 🗞 blog.quarkslab.com/exploiting-cha… 🗞 kibty.town/blog/arc/ 🗞 xintra.org/blog/tokens-in… 🗞 pathonproject.com/zb/?02fdf36133… #PentesterLabWeekly

new blogpost time!! this one's a fun writeup on a vulnerability chain i found across multiple google services that earned me a $4133.70 bounty lots of fun css as usual! i had to recreate a bunch of drive/docs/gmail/youtube UIs c: have fun! lyra.horse/blog/2024/09/u…

The time has come, and with it your reading material for the week. Phrack #71 is officially released ONLINE! Let us know what you think! phrack.org/issues/71/1.ht…

#FakePotato (CVE-2024-38100) post is out! Check out the short write-up on this unexpected vulnerability 😅 decoder.cloud/2024/08/02/the…

Boom! Windows Hello fingerprint authentication bypassed on top three devices: - Dell Inspiron - Lenovo ThinkPad - Microsoft Surface Pro Still waiting for recordings from our BlueHat talk to drop, but here's our writeup: blackwinghq.com/blog/posts/a-t… #infosec #security #vulnresearch @blackwinghq

BUSY WEEK! Articles worth reading discovered last week: 🗞 tiraniddo.dev/2024/06/workin… 🗞 samcurry.net/hacking-millio… 🗞 pqshield.com/pqshield-plugs… 🗞 androidoffsec.withgoogle.com/posts/attackin… 🗞 github.com/php/php-src/co… 🗞 slava-moskvin.medium.com/extracting-fir… 🗞 ambionics.io/blog/scalpel 🗞 matteomalvica.com/blog/2024/06/0… 🗞 aeth.cc/public/Article… 🗞 labs.watchtowr.com/no-way-php-str… #PentesterLabWeekly

Just published a short blog post on abusing the SeRelabelPrivilege ;) decoder.cloud/2024/05/30/abu…

Just released the write-up for CVE-2024-4367, a bug I found recently in PDF.js (and hence in Firefox), resulting in arbitrary JavaScript execution when opening a malicious PDF. codeanlabs.com/blog/research/…