Constantin @HackmichNet

Windows security novice ... Always try to learn something new ... Happy hacking hackmich.net Joined June 2011

Tweets

4K
Followers

464
Following

2K
Likes

716

Swissky @pentest_swissky

3 days ago

Oops, I Weaponized the Database: Abusing AI Features in SQL Server 2025 - Justin Kalnasy - @SpecterOps specterops.io/blog/2026/06/1…

1 15 51 4K 30

View Details

SEKTOR7 Institute @SEKTOR7net

4 days ago

Undocumented IMsiServer COM interface for DCOM upload & execution. A post by Eliran Nissan. Source: deepinstinct.com/blog/forget-ps… #redteam #blueteam

0 13 48 2K 43

View Details

Super cool research from my colleague Shai Laron on new attack paths to Active Directory that can lead to full domain takeover 😜 . It was presented at Black Hat and he will be speaking again at DEF CON this weekend. Don't miss this 💪 : semperis.com/blog/identity-…

0 77 216 10K 126

View Details

cr3ghost @cr3ghost

5 days ago

A security researcher (Dirk-jan) just dropped a new technique for abusing Windows Hello for Business keys from a compromised user session. No admin rights. No PIN. No biometrics. Full persistence into Entra ID cloud from a user-level implant. KQL detection query included. dirkjanm.io/borrowing-wind… If you do anything with Active Directory, Entra ID, identity security, red teaming, or detection engineering and you're not reading his blog, you're behind. This is the researcher who found CVE-2025-55241, Global Admin in every Entra ID tenant in the world. No logs. No Conditional Access. Microsoft fixed it in 3 days. Creator of ROADtools, ROADrecon, roadtx, krbrelayx, mitm6, and ntlmrelayx contributions. His blog covers: PRT theft and phishing, Conditional Access bypass via resource exclusions, Temporary Access Pass lateral movement, Azure AD Connect credential dumping, Cloud Kerberos Trust abuse from Azure AD to on-prem, AD CS attack surface extended to Intune, SID filtering bypass across forest trusts (CVE-2020-0665), safer Zerologon exploitation, unconstrained Kerberos delegation abuse, ACL privilege escalation, and B2B trust hopping. Every post comes with tools, detection queries, and full attack chains. Bookmark the entire blog. dirkjanm.io Author: @_dirkjan #Infosec #RedTeam #DetectionEngineering

5 148 693 46K 643

View Details

Swissky @pentest_swissky

a week ago

SMBLoot has been updated with: - OPSEC mode: directory trees are cached when opened, preventing new requests when revisiting them; for example, when navigating back to a parent directory. - Sensitive file highlighting: files such as .kdbx, .vhd, .ova, and .bash_history are now easier to spot. - Kerberos authentication support, thanks to a merged PR. - File modification timestamps in the browsing view. Feel free to suggest more features🥰

Swissky @pentest_swissky

2 weeks ago

SMB browsing without the endless use share, cd, and get file commands 😃 SMBLoot lets you navigate with your keyboard, preview files, filter directory listings, and recursively download entire directory trees from a TUI. github.com/swisskyrepo/SM…

0 44 185 16K 142

0 20 105 9K 66

View Details

bohops @bohops

6 days ago

I recently updated "The Ultimate WDAC Bypass List" to include TextTransform.exe as well as a few undocumented placeholder entries (despite my personal feelings of seeing some good rainy day bypasses disclosed in an unexpected, lazy fashion). More updates coming soon... github.com/bohops/Ultimat…

1 62 192 9K 138

View Details

SpecterOps @SpecterOps

7 days ago

ConfigManBearPig 2.0 is out, a full Python rewrite built on OpenHound. Faster, runs on Linux, SOCKS proxy support, better BloodHound pathfinding for SCCM attacks. ➡️ ghst.ly/3RGyETm Catch @_Mayyhem demo-ing it live at #BHUSA Arsenal TOMORROW, Tue 8/4, 5:15pm, Station 6.

0 45 119 13K 65

View Details

Jonny Johnson @JonnyJohnson_

7 days ago

Whether we want to admit it or not - the more we connect to our agents, the larger we are making the attack surface. In my @btphantomlabs blog below, I go over how easy it is to impersonate a user (with stolen credentials) through OpenAIs "Apps" (remote MCP servers): beyondtrust.com/blog/entry/cod…

3 5 25 4K 9

View Details

SEKTOR7 Institute @SEKTOR7net

a week ago

Extracting and analyzing Windows service configurations and ACLs. A tool by Panagiotis Chartas (@t3l3machus) Source: github.com/t3l3machus/ACE… #redteam #blueteam

0 16 93 4K 51

View Details

S3cur3Th1sSh1t @ShitSecure

a week ago

For anyone who was wondering "how to" regarding to my last two Posts - here is a small writeup and Proof of Concept 🫡🔥

MSec Operations @MSecOps

a week ago

New Blogpost regarding to "Backdooring Open-Weight Models" just published by @ShitSecure: msecops.de/blog/posts/bac…

0 16 54 9K 39

2 17 59 7K 39

View Details

Florian Hansemann @CyberWarship

a week ago

''Large Workflows with Local LLMs'' #infosec #pentest #redteam #blueteam trustedsec.com/blog/large-wor…

0 14 52 4K 36

View Details

DbgMan ^_^ @0XDbgMan

a week ago

New blog Spent way too much time reverse engineering CrowdStrike Falcon. Somewhere along the way, I found a bug. It's low and not practically exploitable... but a bug is a bug :) Publishing soon 0xdbgman.github.io/posts/inside-t…

15 120 476 36K 325

View Details

moton @moton

2 weeks ago

CVE-2026-50502: PoC Exploit Public for Event Log RCE - securityonline.info/cve-2026-50502…

1 40 169 14K 87

View Details

Het Mehta @hetmehtaa

2 weeks ago

Bug Bounty using Claude and Burp Suite yeswehack.com/learn-bug-boun…

1 42 286 13K 280

View Details

Quentin Texier 🦀 @g0h4n_0

2 weeks ago

An Active Directory security-assessment toolkit in Rust (Scan,Enum,Attack)! 🔥 Amazing work by icedracon! github.com/icedracon/adha…

1 10 47 4K 36

View Details

Karl @kfosaaen

2 weeks ago

Our Troopers 26 talk "Modern Adventures in Azure Privilege Escalation" is now online. Thomas and I have an associated blog and resources in the works, so there will be more from us soon. Thanks again to @WEareTROOPERS. This was a fantastic experience! youtube.com/watch?v=GaOi82…

1 11 25 2K 12

View Details

SpecterOps @SpecterOps

2 weeks ago

AI agents are becoming a new layer of enterprise identity. They can access data & execute workflows, thus they also create new attack paths. @elad_shamir explores how BloodHound Enterprise extends Attack Path Management to Microsoft Entra Agent ID. ghst.ly/4xbGsM9

1 11 32 2K 13

View Details

S3cur3Th1sSh1t @ShitSecure

2 weeks ago

I successfully trained a small LLM to always include backdoor code into any answer. All code generated will execute attacker defined commands. And that was 5-10 minutes of work for a PoC wtf? 🫣

3 10 58 10K 21

View Details

Dave Kennedy @HackingDave

a week ago

If you aren't using herdr for your agents, you are missing out big time. Absolutely destroys tmux, and the integrations on your coding agents with worktrees is a huge level up. Check it out here: herdr.dev Also, ensure to check out the quick start, watch the 6 min video. It shows you how to setup the integration workflow, and the skills setup here: youtube.com/watch?v=qnIu-X… 6 minutes, and completely change your coding experience for the better. Guarantee it. Best shell I have ever used.