Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
okla.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
Oklahoma... we're trying ya'll

Administered by:

Server stats:

34
active users

okla.social: AboutStatusProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.6

#offensivesecurity

4 posts4 participants0 posts today
100 Days of Red Team<p>Demonstration of couple of UAC bypass methods using Havoc C2.</p><p><a href="https://100daysofredteam.medium.com/using-havoc-c2-to-bypass-uac-b3a93c33442a" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">100daysofredteam.medium.com/us</span><span class="invisible">ing-havoc-c2-to-bypass-uac-b3a93c33442a</span></a></p><p><a href="https://infosec.exchange/tags/RedTeam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>RedTeam</span></a> <a href="https://infosec.exchange/tags/OffensiveSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>OffensiveSecurity</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a></p>
pentest-tools.com<p>We tested 15 HTML sanitizers and managed to break 3 of them! How We Found XSS in Odoo &amp; Gitea</p><p>Last December two of our security researchers - Alex &amp; Catalin - put 15 HTML sanitizers to the test across Python, Go, JavaScript, and Ruby. The result? Three critical vulnerabilities that impact major platforms used by millions!</p><p>Key findings:<br>✅ Python (lxml.html.clean) – Vulnerability found in Odoo (5M+ users)<br>✅ Go (BlueMonday) – XSS in Gitea (used by Google, MasterCard, OpenStack)</p><p>👉 The research exposed how sanitizers fail to handle edge cases, leading to security risks in chat systems, forums, and self-hosted git platforms.</p><p>🎥 Watch the full keynote for more insights: <a href="https://youtu.be/0M4e347tMds" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">youtu.be/0M4e347tMds</span><span class="invisible"></span></a> </p><p><a href="https://infosec.exchange/tags/pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>pentesting</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/ethicalhacking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ethicalhacking</span></a> <a href="https://infosec.exchange/tags/offensivesecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>offensivesecurity</span></a></p>
0x40k<p>Okay, so AI in Pentesting, huh? 🤖 It's definitely a hot topic! A lot of folks instantly worry about losing their jobs, but let's be real: aren't we pentester basically problem-solvers?</p><p>Thing is, AI *can* actually help us speed up the simpler stuff. Think OSINT, CVE checks, and even report writing – AI could give us a boost there. And that would give us *more* time to focus on the really tricky hacks.</p><p>But hey, a word of caution: AI is just a tool, folks. It's not a magic bullet. Creativity and solid experience *still* matter big time! And let's not forget, security *solely* reliant on AI is just plain wrong. Seriously, certificates or no certificates, a company is NOT secure without good old-fashioned manual pentesting.</p><p>What are your thoughts? 🤔 <a href="https://infosec.exchange/tags/Pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Pentesting</span></a> <a href="https://infosec.exchange/tags/AISecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>AISecurity</span></a> <a href="https://infosec.exchange/tags/OffensiveSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>OffensiveSecurity</span></a></p>
G :donor: :Tick:<p>A very different Monday from my usual, let the learning begin! <a href="https://infosec.exchange/tags/InsomniHack" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>InsomniHack</span></a> <a href="https://infosec.exchange/tags/INS2025" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>INS2025</span></a> <a href="https://infosec.exchange/tags/OffensiveSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>OffensiveSecurity</span></a> <a href="https://infosec.exchange/tags/Entra" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Entra</span></a> <a href="https://infosec.exchange/tags/AD" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>AD</span></a></p>
0x40k<p>AI in security? Yeah, it *can* be helpful, BUT... Automated tools just aren't a substitute for a real-deal penetration tester with brains and experience, ya know? And honestly, blindly relying on AI? Yikes, that's risky! Those things can straight-up hallucinate information sometimes. We're much better off sticking with good ol' brainpower and a solid team, wouldn't you agree? So, what do *you* think are the biggest risks when it comes to AI in the security landscape? Let me know what you think!</p><p><a href="https://infosec.exchange/tags/Pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Pentesting</span></a> <a href="https://infosec.exchange/tags/AISecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>AISecurity</span></a> <a href="https://infosec.exchange/tags/OffensiveSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>OffensiveSecurity</span></a></p>
0x40k<p>Just stumbled across a report about Microsoft taking down some seriously bad actors who were hijacking Azure accounts for AI abuse. LLMjacking – sounds like something straight out of a cyberpunk novel, but it's actually happening! 🤦‍♂️</p><p>Honestly, it reminds me of so many conversations I've had with clients. They're like, "Yeah, we've got a firewall, we're all good." Uh, no? Security's way more than just a product you buy. It's a process that needs to be baked in right from the start of development. And let's be real, automated scans *definitely* don't cut it as a pentest!</p><p>So, what's your take on AI security? Is it just overhyped, or is it a legitimate concern? 🤔 Keen to hear your thoughts!</p><p><a href="https://infosec.exchange/tags/AISecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>AISecurity</span></a> <a href="https://infosec.exchange/tags/Pentest" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Pentest</span></a> <a href="https://infosec.exchange/tags/OffensiveSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>OffensiveSecurity</span></a></p>
0x40k<p>Whoa, malware trends in Q1/25 are getting seriously wild! 🤯 AsyncRAT via TryCloudflare, Lynx Ransomware, Lumma Stealer popping up on GitHub... it's just escalating.</p><p>Here's the deal: tons of companies *think* their security is rock solid, but attackers are constantly leveling up their social engineering game – just look at InvisibleFerret. And then, bam! "Oh no, we've been hacked!" rings alarmingly too often.</p><p>Frankly, we need more pentests and proactive threat hunting. Automated scans? Sure, they're useful, but they're no substitute for experienced pros. What's your take on these new malware campaigns? What actually works for you? 🤔</p><p><a href="https://infosec.exchange/tags/offensiveSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>offensiveSecurity</span></a> <a href="https://infosec.exchange/tags/ThreatHunting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatHunting</span></a> <a href="https://infosec.exchange/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Cybersecurity</span></a></p>
0x40k<p>"Winnti? Ach, das betrifft mich nicht!" – Denkste! 🤨 Die sind wieder da und ihre Supply Chain Attacken? Mega gefährlich! Ja, Japan steht im Fokus, aber die Methoden können *jeden* treffen.</p><p>SQL Injection in ERP-Systemen ist leider immer noch ein Thema und MSP-Kompromittierungen sind der absolute Horror. Und Winnti nutzt das knallhart aus. Stell dir das mal vor: Die Hacker kommen über deinen Dienstleister rein und räumen alles leer! 😱</p><p>Also, was tun? Wir müssen unsere ERP-Systeme absichern, unsere MSPs genau unter die Lupe nehmen, das Netzwerk segmentieren, das Monitoring scharf stellen und Winnti auf dem Schirm behalten. Open Source Tools können uns dabei echt helfen.</p><p>Habt ihr schon mal so eine Situation erlebt? Welche Security-Maßnahmen haben bei euch wirklich was gebracht? Erzählt mal, bin gespannt!</p><p><a href="https://infosec.exchange/tags/offensiveSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>offensiveSecurity</span></a> <a href="https://infosec.exchange/tags/Pentest" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Pentest</span></a> <a href="https://infosec.exchange/tags/SupplyChain" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SupplyChain</span></a></p>
Tedi Heriyanto<p>Build Your Own Offensive Security Lab A Step-by-Step Guide with Ludus: <a href="https://xphantom.nl/posts/Offensive-Security-Lab/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">xphantom.nl/posts/Offensive-Se</span><span class="invisible">curity-Lab/</span></a></p><p><a href="https://infosec.exchange/tags/ludus" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ludus</span></a> <a href="https://infosec.exchange/tags/offensivesecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>offensivesecurity</span></a> <a href="https://infosec.exchange/tags/lab" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>lab</span></a></p>
M<p>Simple Go lang bot maze trap</p><p><a href="https://codeberg.org/matthewjharmon/go-bot-trap.git" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">codeberg.org/matthewjharmon/go</span><span class="invisible">-bot-trap.git</span></a></p><p><a href="https://threat.theater/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosec</span></a> <a href="https://threat.theater/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://threat.theater/tags/offensivesecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>offensivesecurity</span></a></p>
100 Days of Red Team<p><a href="https://infosec.exchange/tags/100DaysOfRedTeam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>100DaysOfRedTeam</span></a><br><a href="https://infosec.exchange/tags/Day" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Day</span></a> 10 - Know the pros and cons of unannounced and announced red team assessments.</p><p><a href="https://100daysofredteam.com/p/unannounced-vs-announced-red-team-assessments" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">100daysofredteam.com/p/unannou</span><span class="invisible">nced-vs-announced-red-team-assessments</span></a></p><p><a href="https://infosec.exchange/tags/RedTeam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>RedTeam</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/OffensiveSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>OffensiveSecurity</span></a></p>
100 Days of Red Team<p><a href="https://infosec.exchange/tags/100DaysOfRedTeam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>100DaysOfRedTeam</span></a><br><a href="https://infosec.exchange/tags/Day" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Day</span></a> 9 -Learn differences between a red team assessment and a penetration test with a simple analogy.</p><p><a href="https://100daysofredteam.com/p/red-teaming-vs-penetration-testing" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">100daysofredteam.com/p/red-tea</span><span class="invisible">ming-vs-penetration-testing</span></a></p><p><a href="https://infosec.exchange/tags/RedTeam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>RedTeam</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/OffensiveSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>OffensiveSecurity</span></a></p>
100 Days of Red Team<p><a href="https://infosec.exchange/tags/100DaysOfRedTeam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>100DaysOfRedTeam</span></a><br><a href="https://infosec.exchange/tags/Day" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Day</span></a> 8 -Learn what is Process Doppelgänging and how to abuse it for red team trade-craft.</p><p><a href="https://100daysofredteam.com/p/what-is-process-doppelganging" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">100daysofredteam.com/p/what-is</span><span class="invisible">-process-doppelganging</span></a></p><p><a href="https://infosec.exchange/tags/RedTeam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>RedTeam</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/OffensiveSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>OffensiveSecurity</span></a></p>
100 Days of Red Team<p><a href="https://infosec.exchange/tags/100DaysOfRedTeam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>100DaysOfRedTeam</span></a><br><a href="https://infosec.exchange/tags/Day7" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Day7</span></a> -Learn what is Process Hollowing and how to abuse it for red team trade-craft.</p><p><a href="https://100daysofredteam.com/p/what-is-process-hollowing" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">100daysofredteam.com/p/what-is</span><span class="invisible">-process-hollowing</span></a></p><p><a href="https://infosec.exchange/tags/RedTeam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>RedTeam</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/OffensiveSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>OffensiveSecurity</span></a></p>
100 Days of Red Team<p><a href="https://infosec.exchange/tags/100DaysOfRedTeam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>100DaysOfRedTeam</span></a> <br>Day6 -Is there a method to the madness of conducting a red team engagement?</p><p><a href="https://100daysofredteam.com/p/what-is-a-red-team-methodology" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">100daysofredteam.com/p/what-is</span><span class="invisible">-a-red-team-methodology</span></a></p><p><a href="https://infosec.exchange/tags/RedTeam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>RedTeam</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/OffensiveSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>OffensiveSecurity</span></a></p>
100 Days of Red Team<p><a href="https://infosec.exchange/tags/100DaysOfRedTeam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>100DaysOfRedTeam</span></a><br><a href="https://infosec.exchange/tags/Day3" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Day3</span></a> - Learn what is COM and how red teams can use it as part of their trade-craft.</p><p><a href="https://www.100daysofredteam.com/p/what-is-com-hijacking" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">100daysofredteam.com/p/what-is</span><span class="invisible">-com-hijacking</span></a></p><p><a href="https://infosec.exchange/tags/redteam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>redteam</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/offensivesecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>offensivesecurity</span></a></p>
100 Days of Red Team<p><a href="https://infosec.exchange/tags/100DaysOfRedTeam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>100DaysOfRedTeam</span></a><br><a href="https://infosec.exchange/tags/Day2" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Day2</span></a> - Learn how session sharing feature became a norm in command and control infrastructure.</p><p><a href="https://www.100daysofredteam.com/p/the-origin-of-session-sharing-in" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">100daysofredteam.com/p/the-ori</span><span class="invisible">gin-of-session-sharing-in</span></a></p><p><a href="https://infosec.exchange/tags/redteam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>redteam</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/offensivesecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>offensivesecurity</span></a></p>
ExploreLive feeds
About