r1cksec
@r1cksec.bsky.social
Data breach revealed, Malware lurks, silent, stealthy - OSINT tracks the thread. URLs I post may contain malware – be careful and check yourself before running anything. https://github.com/r1cksec infosec.exchange/@r1cksec
New cheatsheets pushed github.com/r1cksec/chea... #infosec #cybersecurity #redteam #pentest #threatintel #malware #dfir #bugbounty #opensource
GitHub - r1cksec/cheatsheets: Collection of knowledge about information security
Collection of knowledge about information security - r1cksec/cheatsheets
github.com
Windows Provisioning Package (.ppkg) generator. Payload runs as SYSTEM on apply. github.com/init1Securit... #infosec #cybersecurity #redteam #pentest
GitHub - init1Security/PPKGPacker: Python scripts that helps in the development of PPKG binaries
Python scripts that helps in the development of PPKG binaries - init1Security/PPKGPacker
github.com
A litterbox integration for the Mythic Command and Control Server github.com/Whispergate/... #infosec #cybersecurity #redteam #pentest
GitHub - Whispergate/Sphinx: A litterbox integration for the Mythic Command and Control Server
A litterbox integration for the Mythic Command and Control Server - Whispergate/Sphinx
github.com
Notes on Windows Component Object Model (COM hijacking, elevation of privilege, DCOM lateral movement, and persistence). Notes were generated by Kimi K3 Swarm may contain inaccuracies. github.com/An0nUD4Y/Off... #infosec #cybersecurity #redteam #pentest #windows
GitHub - An0nUD4Y/Offensive-COM: Research notes on Windows Component Object Model (COM) attack surface for offensive security and vulnerability research. Covers COM hijacking, elevation of privilege, ...
Research notes on Windows Component Object Model (COM) attack surface for offensive security and vulnerability research. Covers COM hijacking, elevation of privilege, DCOM lateral movement, and per...
github.com
An open-source, self-hosted security research platform that turns focused AI analysis into de-duplicated, ranked findings with configurable validation and enrichment. github.com/Kritt-ai/ope... #infosec #cybersecurity #redteam #pentest #ai
GitHub - Kritt-ai/open-kritt: Orchestrate AI agents to find real vulnerabilities in code.
Orchestrate AI agents to find real vulnerabilities in code. - Kritt-ai/open-kritt
github.com
Nuclei-like credential surface scanner with BloodHound support. Audits local hosts for exposed secrets, cloud tokens, DevOps, and AI keys. github.com/haxxm0nkey/c... #infosec #cybersecurity #redteam #pentest #opensource
GitHub - haxxm0nkey/credshound: Nuclei-like credential surface scanner with BloodHound support. Audits local hosts for exposed secrets, cloud tokens, DevOps, and AI keys.
Nuclei-like credential surface scanner with BloodHound support. Audits local hosts for exposed secrets, cloud tokens, DevOps, and AI keys. - haxxm0nkey/credshound
github.com
Extract Windows credentials directly from VM memory snapshots and virtual disks github.com/nikaiw/VMkatz #infosec #cybersecurity #redteam #pentest #opensource
GitHub - nikaiw/VMkatz: Extract Windows credentials directly from VM memory snapshots and virtual disks
Extract Windows credentials directly from VM memory snapshots and virtual disks - nikaiw/VMkatz
github.com
There is a documented enforcement gap in Conditional Access policies that apply to "all resources" but have an exclusion for at least one resource. dirkjanm.io/bypassing-co... #infosec #cybersecurity #redteam #pentest #cloud
dirkjanm.io
This is a proof-of-concept tool to demonstrate CVE-2026-54121 a.k.a Certighost. github.com/aniqfakhrul/... #infosec #cybersecurity #redteam #pentest
GitHub - aniqfakhrul/CVE-2026-54121: Certighost POC
Certighost POC. Contribute to aniqfakhrul/CVE-2026-54121 development by creating an account on GitHub.
github.com
Nuclei-like credential surface scanner with BloodHound support. Audits local hosts for exposed secrets, cloud tokens, DevOps, and AI keys. github.com/haxxm0nkey/c... #infosec #cybersecurity #redteam #pentest #opensource
GitHub - haxxm0nkey/credshound: Nuclei-like credential surface scanner with BloodHound support. Audits local hosts for exposed secrets, cloud tokens, DevOps, and AI keys.
Nuclei-like credential surface scanner with BloodHound support. Audits local hosts for exposed secrets, cloud tokens, DevOps, and AI keys. - haxxm0nkey/credshound
github.com
ProxyWatch is a real-time process and network behavior monitor for detecting proxy activity, tunnels, C2 sessions, beacons, and lateral movement. github.com/In3x0rabl3/P... #infosec #cybersecurity #redteam #pentest #dfir
GitHub - In3x0rabl3/Proxywatch: ProxyWatch
ProxyWatch. Contribute to In3x0rabl3/Proxywatch development by creating an account on GitHub.
github.com
A post about Git integrations that can be used to exploit insecure implementations. nopnop.pro/2026/06/17/e... #infosec #cybersecurity #redteam #pentest
The gift that keeps giving: Exploiting Git Integrations in Cloud Services
1. Introduction
nopnop.pro
This blogpost explains how GPOs work and how filters can be applied in order to restrict their impact. www.intrinsec.com/hide-the-thr... #infosec #cybersecurity #redteam #pentest
Hide the threat - GPO lateral movement
Learn how to perform and understand lateral mouvement though GPO mechanism during pentest and red team assessments.
intrinsec.com
Living Off the Land Credentials. Public credential defaults, locations, and exposure patterns for real products, SaaS/cloud services, appliances, and deployment packages. github.com/haxxm0nkey/l... #infosec #cybersecurity #redteam #pentest #password
GitHub - haxxm0nkey/lolcreds-data: Living Off the Land Credentials. Public credential defaults, locations, and exposure patterns for real products, SaaS/cloud services, appliances, and deployment pack...
Living Off the Land Credentials. Public credential defaults, locations, and exposure patterns for real products, SaaS/cloud services, appliances, and deployment packages. - haxxm0nkey/lolcreds-data
github.com
Dump TGTs remotely and convert Windows' klist binary output to ccache. github.com/jakeotte/kli... #infosec #cybersecurity #redteam #pentest #opensource
GitHub - jakeotte/klist2ccache: Dump TGTs remotely and convert Windows' klist binary output to ccache.
Dump TGTs remotely and convert Windows' klist binary output to ccache. - jakeotte/klist2ccache
github.com
Entra ID user enumeration and auth method discovery via the public GetCredentialType API github.com/RedByte1337/... #infosec #cybersecurity #redteam #pentest #opensource #cloud
GitHub - RedByte1337/CredSpy: Entra ID user enumeration and auth method discovery via the public GetCredentialType API
Entra ID user enumeration and auth method discovery via the public GetCredentialType API - RedByte1337/CredSpy
github.com
Noma Labs discovered a prompt injection vulnerability within GitHubs new Agentic Workflows, allowing an unauthenticated attacker to silently pull data from private repositories by posting a crafted GitHub Issue noma.security/blog/gitlost... #infosec #cybersecurity #redteam #pentest
GitLost: How We Tricked GitHub’s AI Agent into Leaking Private Repos - Noma Security
TL;DR: Noma Labs discovered a critical prompt injection vulnerability within GitHub’s new Agentic Workflows, allowing an unauthenticated attacker to silently pull data from private repositories by pos...
noma.security
A public reference of protocol-level and implementation-level indicators of compromise(IoCs) for detecting Impacket-driven activity. github.com/ThatTotallyR... #infosec #cybersecurity #redteam #pentest
GitHub - ThatTotallyRealMyth/Impacket-IoCs: This repo contains the results of an internal re-write of impacket I undertook at my current company. It contains some of the IoCs found within the library
This repo contains the results of an internal re-write of impacket I undertook at my current company. It contains some of the IoCs found within the library - ThatTotallyRealMyth/Impacket-IoCs
github.com
A post about the security implications of new features in SQL Server 2025 specterops.io/blog/2026/06... #infosec #cybersecurity #redteam #pentest
Oops, I Weaponized the Database: Abusing AI Features in SQL Server 2025
SQL Server 2025 AI features can be abused for data exfiltration, NTLM coercion, and C2 traffic. See how attackers exploit them and how defenders can respond.
specterops.io
Ghost-Sender is a misconfiguration enabling the delivery of arbitrary phishing emails against a large number of Exchange Online tenants. labs.infoguard.ch/posts/ghost-... #infosec #cybersecurity #redteam #phishing
Ghost-Sender - Universal Email Spoofing against Exchange Online - InfoGuard Labs
An analysis of a widely available Exchange Online misconfiguration allowing attackers to spoof internal and external senders.
labs.infoguard.ch
A post that uses the Windows source code to illustrate several examples of how attackers can customize their indicators of compromise. www.abdulmhsblog.com/posts/useing... #infosec #cybersecurity #redteam #pentest
The Gold Mine Red Teamers Never Touch
The Problem If you are like me, you have found yourself digging through Microsoft specifications and RFC documentation trying to wrangle with a new exploit or tooling to get DA faster than your peers....
abdulmhsblog.com
A sleepmask based on Ekko that preserves unwind data at sleep time. github.com/kapla0011/In... #infosec #cybersecurity #redteam #pentest
GitHub - kapla0011/InsomniacUnwinding: A sleepmask based on Ekko that preserves unwind data at sleep time.
A sleepmask based on Ekko that preserves unwind data at sleep time. - kapla0011/InsomniacUnwinding
github.com
A curated directory of 127 SaaS platforms with free tiers, documenting abuse surface, OPSEC profiles, detection logics, C2 framework mappings, and operational limits for security research. github.com/lolfsaas/lol... #infosec #cybersecurity #redteam #pentest
GitHub - lolfsaas/lolfsaas.github.io: Living of the Land of Free SaaS
Living of the Land of Free SaaS. Contribute to lolfsaas/lolfsaas.github.io development by creating an account on GitHub.
github.com
A post that explains different concepts behind advanced EDR evasion. lorenzomeacci.com/bypassing-ed... #infosec #cybersecurity #redteam #pentest
Bypassing EDR in a Crystal Clear Way | Lorenzo Meacci
Most operators spend days engineering the perfect shellcode loader and ship the payload naked. This blog takes you from how C2 payloads actually work under the hood all the way to building a fully eva...
lorenzomeacci.com
IP rotation through Azure Functions. Like proxychains, but through the cloud. github.com/ar0x4/azproxy #infosec #cybersecurity #redteam #pentest #cloud #opensource
GitHub - ar0x4/azproxy
Contribute to ar0x4/azproxy development by creating an account on GitHub.
github.com
A Beacon Object File (BOF) in-line LSASS credential extraction from C2 using the KslD.sys BYOVD technique. github.com/PrincipleChe... #infosec #cybersecurity #redteam #pentest
GitHub - PrincipleCheck/KslKatzBof
Contribute to PrincipleCheck/KslKatzBof development by creating an account on GitHub.
github.com
A Cobalt Strike Beacon Object File (BOF) that enables execution of commands within WSL distributions directly from a Beacon session, without spawning wsl.exe. github.com/MayerDaniel/... #infosec #cybersecurity #redteam #pentest
GitHub - MayerDaniel/the-one-wsl-bof: One WSL BOF to rule them all
One WSL BOF to rule them all. Contribute to MayerDaniel/the-one-wsl-bof development by creating an account on GitHub.
github.com
Azure RedOps is a offensive security toolkit for assessing the security posture of Microsoft Entra ID github.com/Mr-Un1k0d3r/... #infosec #cybersecurity #redteam #pentest #cloud
GitHub - Mr-Un1k0d3r/AzureRedOps: Azure RedOps is a offensive security toolkit for assessing the security posture of Microsoft Entra ID
Azure RedOps is a offensive security toolkit for assessing the security posture of Microsoft Entra ID - Mr-Un1k0d3r/AzureRedOps
github.com
RelayKing is a comprehensive relay detection and enumeration tool designed to identify relay attack opportunities in Active Directory environments. github.com/depthsecurit... #infosec #cybersecurity #redteam #pentest #opensource
GitHub - depthsecurity/RelayKing-Depth: Dominate the domain. Relay to royalty.
Dominate the domain. Relay to royalty. Contribute to depthsecurity/RelayKing-Depth development by creating an account on GitHub.
github.com
An article about how an AI agent was tested using various phishing simulations www.varonis.com/blog/opencla... #infosec #cybersecurity #redteam #phishing #ai
Phishing for Lobsters: How We Tricked OpenClaw into Spilling Secrets
We built an AI agent and put it through four phishing simulations to reveal critical security gaps and offer solutions to protect your organization's data.
varonis.com