DEF CON Las Vegas Food Map
In Vegas for hacker summer camp and trying to get food without breaking the bank? I vibed a simple map site: defconfood.badsectorlabs.com
Come see Ludus at the embedded Systems Village - hack an IP camera, see the new UI, and get a sticker!
07.08.2025 20:50 β π 3 π 1 π¬ 0 π 0
Last Week in Security (LWiS) - 2025-07-21
PIC agents (@_RastaMouse), ToolShell, Async BOFs (@Cneelis), SCCM MP relays (@unsigned_sh0rt), RAITrigger (@ShitSecure), and more!
PIC agents (@_RastaMouse), ToolShell, Async BOFs (@Cneelis), SCCM MP relays (@unsigned_sh0rt), RAITrigger (@ShitSecure), and more!
blog.badsectorlabs.com/last-week-in...
22.07.2025 21:38 β π 2 π 1 π¬ 0 π 0
Last Week in Security (LWiS) - 2025-07-14
LudusHound (@bagelByt3s), SpeechRuntimeMove (@ShitSecure), Havoc Pro (@C5pider), FortiWeb RCE (@SinSinology), SailPoint IQService RCE (@NetSPI), Altiris RCE (@lefterispan), WAF bypass (@nyxgeek ), and...
LudusHound (@bagelByt3s), SpeechRuntimeMove (@ShitSecure), Havoc Pro (@C5pider), FortiWeb RCE (@SinSinology), SailPoint IQService RCE (@NetSPI), Altiris RCE (@lefterispan), WAF bypass (@nyxgeek), and more!
blog.badsectorlabs.com/last-week-in...
15.07.2025 14:38 β π 3 π 0 π¬ 0 π 0
LudusHound: Raising BloodHound Attack Paths to Life - SpecterOps
LudusHound is a tool for red and blue teams that transforms BloodHound data into a fully functional, Active Directory replica environment via the Ludus framework for controlled testing.
Ludushound shows the power of community driven innovation in cybersecurity. @bagelByt3s created an awesome tool to convert bloodhound data into a working lab in ποΈ Ludus. Replicate complex live environments with automation - and get back to the fun stuff!
specterops.io/blog/2025/07...
14.07.2025 19:12 β π 3 π 1 π¬ 0 π 0
Ludus
The easiest way to deploy testing infrastructure
Lots of good write ups (like Citrix Bleed 2) but my favorite was seeing how ποΈ Ludus.cloud helped Cameron Stish of Guidepoint Security find "LoopyTicket" (CVE-2025-33073).
blog.badsectorlabs.com/last-week-in...
08.07.2025 13:40 β π 3 π 0 π¬ 0 π 0
@raphaelmudge.bsky.social summed up why we built and released Ludus open source: "Develop technologies that give individual operators and researchers LEVERAGE acting on hypothesis and make it fast to try things, adapt, and modify."
When spinning up ADCS or SCCM is 3 commands, it gives you leverage.
09.06.2025 17:07 β π 1 π 0 π¬ 0 π 0
Want to learn pivoting this weekend? The ποΈLudus community created a Pivot Lab with 11 different pivoting tools! Check it out: docs.ludus.cloud/docs/environ...
06.06.2025 20:32 β π 4 π 2 π¬ 0 π 0
Last Week in Security (LWiS) - 2025-06-02
Stealth syscalls (@darkrelaylabs), VM introspection (@memn0ps), Marebackup LPE (@itm4n), Azure Arc C2 (@ZephrFish), Obfusk8 (@x86byte), and more!
Stealth syscalls (@darkrelaylabs), VM introspection (@memn0ps), Marebackup LPE (@itm4n.bsky.social), Azure Arc C2 (@zephrfish.yxz.red), Obfusk8 (@x86byte), and more!
blog.badsectorlabs.com/last-week-in...
02.06.2025 22:23 β π 2 π 0 π¬ 1 π 0
MATCH (c1:Computer)-[:MemberOf*1..]->(g:Group) WHERE g.objectsid ENDS WITH '-516' WITH COLLECT(c1[.]name) AS dcs MATCH (c2:Computer) WHERE c2.enabled = true AND (c2.operatingsystem contains '2025') AND (c2[.]name IN dcs) RETURN c2[.]name
If this query hits, you're DA: www.akamai.com/blog/securit...
21.05.2025 18:13 β π 4 π 2 π¬ 0 π 0
Cobalt Strike for free!? Adaptix C2 (@hacker_ralf) is the best open source C2 I've used since Havoc (@C5pider). Adaptix has SOCKS5, remote and local port forwards, and BOF support! Now it's easy to install the server and client, especially on ποΈLudus with our new role:
github.com/badsectorlab...
15.05.2025 21:26 β π 6 π 1 π¬ 0 π 0
The Ludus range config can get complex - lots of features == lots of options, but VSCode (and Cursor/Windsurf) can help if you add:
# yaml-language-server: $schema=https://docs.ludus.cloud/schemas/range-config.json
to the top of a yaml, the editor will highlight and explain errors! π€―
08.05.2025 17:39 β π 0 π 0 π¬ 0 π 0
Last Week in Security (LWiS) - 2025-05-05
ProxyBlobing (@_atsika), SonicWall n-days (@SinSinology), Drag and Pwnd (@d4d89704243), Loki C2 2.0 (@0xBoku), GraphSpy 1.5.0 (@RedByte1337), and more!
ProxyBlobing (@_atsika), SonicWall n-days (@SinSinology), Drag and Pwnd (@d4d89704243), Loki C2 2.0 (@0xBoku), GraphSpy 1.5.0 (@RedByte1337), and more!
blog.badsectorlabs.com/last-week-in...
06.05.2025 20:01 β π 2 π 0 π¬ 0 π 0
Got my hands on an unreleased Google DeepMind AI workstation! π§ π»
jk, but the new ποΈLudus π«ποΈAnti-Sandbox update allows for full customization of machine values. Make your machines look like whatever you (or your APTs) expect. docs.ludus.cloud/docs/enterpr...
02.05.2025 22:01 β π 0 π 0 π¬ 0 π 0
2οΈβ£ While honing offensive techniques in the lab, plan to transition from the pay-to-play #PEN200 network to a self-hosted cyber range. Explore options to reduce upfront costs, streamline deployment w/ Ludus, & integrate SIEM solutions to enhance your learning experience.
π§΅: 3/4
25.03.2025 17:05 β π 0 π 1 π¬ 1 π 0
Fileless lateral movement with trapped COM objects | IBM
New research from IBM X-Force Red has led to the development of a proof-of-concept fileless lateral movement technique by abusing trapped Component Object Model (COM) objects. Get the details.
[Blog] This ended up being a great applied research project with my co-worker Dylan Tran on weaponizing a technique for fileless DCOM lateral movement based on the original work of James Forshaw. Defensive recommendations provided.
- Blog: ibm.com/think/news/f...
- PoC: github.com/xforcered/Fo...
25.03.2025 21:21 β π 16 π 11 π¬ 0 π 1
ludus 1.9.2 Β· Bad Sector Labs / Ludus Β· GitLab
Changelog All notable changes to this project will be documented in this file. [1.9.2]...
π’ ποΈ Ludus 1.9.2 is now available! New features include:
β
Install Linux packages easily from range config
β
Control Wireguard subnet traffic with custom network rules
β
Fixed domain joining for non-English Windows and more!
Full changelog: gitlab.com/badsectorlab...
22.03.2025 15:24 β π 3 π 1 π¬ 0 π 0
Last Week in Security (LWiS) - 2025-03-17
Evilginx Pro (@mrgretzky), Pre-auth RCE in a CMS (@chudyPB), GOAD ADCS (@M4yFly), YouTube email disclosure (@brutecat), SAML parser bug (@ulldma.bsky.social/@ulldma@infosec.exchange), and more!
Evilginx Pro (@mrgretzky.breakdev.org ), Pre-auth RCE in a CMS (@chudypb.bsky.social), GOAD ADCS, YouTube email disclosure (@brutecat.com), SAML parser bug (ulldma.bsky.social), and more!
blog.badsectorlabs.com/last-week-in...
18.03.2025 00:05 β π 6 π 2 π¬ 0 π 1
πΈ Snapshots | Ludus
Ludus provides snapshot functionality for VMs in your range. Snapshots allow you to save the state of a VM at a point in time and revert back to it later.
Excited to announce ποΈLudus 1.9.0 now with arbitrary snapshot support! See the docs: docs.ludus.cloud/docs/snapshots
We've added documentation for deploy tags as well.
1.9.0 also includes:
- Disable Windows Defender via GPO
- Better VM validation
- Chrome/Edge FRE disabled
- Much more!
14.03.2025 15:50 β π 4 π 0 π¬ 0 π 0
Evilginx Pro is finally here!
After over two years of development, Evilginx Pro reverse proxy phishing framework for red teams is finally live!
π¨ Evilginx Pro is finally here! π¨π£π
This is it! After over two years of development, countless delays, and hundreds of manual company verifications, Evilginx Pro is finally live!
Thank you all for your invaluable support π
breakdev.org/evilginx-pro...
12.03.2025 15:29 β π 11 π 6 π¬ 0 π 0
AdSim Consultant @ SpecterOps π»
Corgi dad πΆ
Cat servant π±
Tattoo collector πΌοΈ
Runner ππ»
Pentest & Windows security research
Associate Consultant @SpecterOps
Ethical Hacker
Active Directory | Web Apps | Social Engineering | Physical Security
Riding around in the breeze. Security Thinker. Hacker. USAF Veteran. https://aff-wg.org
Offensive security
https://www.solomonsklash.io
Manager, Research @ SpecterOps
https://github.com/JonasBK/JonasBK/blob/main/README.md
Hacker, runner, general nerd
Self-Claimed Security βResearcherβ | Ex-MSFT | Former Microsoft MVP | Interested in Security, Debugging, and Troubleshooting.
Creators of BloodHound | Experts in Adversary Tradecraft | Leaders in Identity Attack Path Management
Adversary Services @xforce
https://h4wkst3r.github.io
[ 'cto @sensepost.com', '@orangecyberdef', 'caffeine fueled', '(β―Β°β‘Β°)β―οΈ΅ β»ββ»', 'security guy', 'metalhead', 'i saw your password', 'KOOBo+KXleKAv+KXlSnjgaM=' ]
Head of Red team @ IBM X-Force. Black Hat Review Board. Founder and co-organizer of Offensive AI Con. Co-Founder of RemoteThreat. inveni et usurpa
breaker and builder. arsenal supporter. marathoner. adv sim @xforce.bsky.social.
Security Researcher @neodyme.io | CTF, Fuzzing, Embedded Security
Offensive Security Dev, Red Teamer, overall swell guy
Cybersecurity & Threat Intelligence. Knowledge is power, France is bacon π₯
