NetExec module for automated Kerberos TGT extraction
https://www.reddit.com/r/redteamsec/comments/1usj50l/netexec_module_for_automated_kerberos_tgt/
<!-- SC_OFF -->Hey everyone, I recently put together a NetExec module called stealTGT to simplify grabbing Kerberos TGTs from logged-on users after you already have local admin on a Windows machine. The original idea was pretty simple: I wanted to avoid dropping a plain Rubeus binary on disk every time I needed a ticket, so I automated the whole process into a single NetExec module. Here's what it does: Takes a local copy of Rubeus, converts it to position-independent shellcode with Donut, and obfuscates it with Myph (AES + API hashing). The execution arguments are generated only for the user you want to target. Uploads the randomized loader to a temporary share and executes it as NT AUTHORITY\SYSTEM through mmcexec. Captures the output, extracts the Base64-encoded ticket, and converts the resulting .kirbi into a .ccache file ready to use from Linux. Removes the temporary files and cleans up the generated artifacts once everything is finished. I've attached a screenshot of it running against a fully patched Windows host with Microsoft Defender real-time protection enabled. The project is available here: https://github.com/JssNGC/harpyTools If anyone wants to try it in their lab, I'd love to hear any feedback or suggestions. Bug reports and PRs are always welcome. <!-- SC_ON --> submitted by /u/KeyDay4761 (https://www.reddit.com/user/KeyDay4761)
[link] (https://github.com/JssNGC/harpyTools) [comments] (https://www.reddit.com/r/redteamsec/comments/1usj50l/netexec_module_for_automated_kerberos_tgt/)
https://www.reddit.com/r/redteamsec/comments/1usj50l/netexec_module_for_automated_kerberos_tgt/
<!-- SC_OFF -->Hey everyone, I recently put together a NetExec module called stealTGT to simplify grabbing Kerberos TGTs from logged-on users after you already have local admin on a Windows machine. The original idea was pretty simple: I wanted to avoid dropping a plain Rubeus binary on disk every time I needed a ticket, so I automated the whole process into a single NetExec module. Here's what it does: Takes a local copy of Rubeus, converts it to position-independent shellcode with Donut, and obfuscates it with Myph (AES + API hashing). The execution arguments are generated only for the user you want to target. Uploads the randomized loader to a temporary share and executes it as NT AUTHORITY\SYSTEM through mmcexec. Captures the output, extracts the Base64-encoded ticket, and converts the resulting .kirbi into a .ccache file ready to use from Linux. Removes the temporary files and cleans up the generated artifacts once everything is finished. I've attached a screenshot of it running against a fully patched Windows host with Microsoft Defender real-time protection enabled. The project is available here: https://github.com/JssNGC/harpyTools If anyone wants to try it in their lab, I'd love to hear any feedback or suggestions. Bug reports and PRs are always welcome. <!-- SC_ON --> submitted by /u/KeyDay4761 (https://www.reddit.com/user/KeyDay4761)
[link] (https://github.com/JssNGC/harpyTools) [comments] (https://www.reddit.com/r/redteamsec/comments/1usj50l/netexec_module_for_automated_kerberos_tgt/)
Why is Pseudoconsole so rarely used in reverse shells?
https://www.reddit.com/r/redteamsec/comments/1usofiu/why_is_pseudoconsole_so_rarely_used_in_reverse/
<!-- SC_OFF -->Most reverse shells I have seen are directly sending the piped stdout and stdin of a started process.
Using a pseudoconsole has many benefits i think that are worth the extra implementation effort. Like working tab completion and no suspicious attributes like "-WindowStyle Hidden"
I experimented with it a bit and had some success in creating a payload which avoids usual behavior based detection. <!-- SC_ON --> submitted by /u/Difficult-Advice3002 (https://www.reddit.com/user/Difficult-Advice3002)
[link] (https://github.com/Schich/Lucky-Arc) [comments] (https://www.reddit.com/r/redteamsec/comments/1usofiu/why_is_pseudoconsole_so_rarely_used_in_reverse/)
https://www.reddit.com/r/redteamsec/comments/1usofiu/why_is_pseudoconsole_so_rarely_used_in_reverse/
<!-- SC_OFF -->Most reverse shells I have seen are directly sending the piped stdout and stdin of a started process.
Using a pseudoconsole has many benefits i think that are worth the extra implementation effort. Like working tab completion and no suspicious attributes like "-WindowStyle Hidden"
I experimented with it a bit and had some success in creating a payload which avoids usual behavior based detection. <!-- SC_ON --> submitted by /u/Difficult-Advice3002 (https://www.reddit.com/user/Difficult-Advice3002)
[link] (https://github.com/Schich/Lucky-Arc) [comments] (https://www.reddit.com/r/redteamsec/comments/1usofiu/why_is_pseudoconsole_so_rarely_used_in_reverse/)
OpenClaw: Three patched high-severity vulnerabilities affecting AI agent execution workflows
https://www.reddit.com/r/redteamsec/comments/1ustl4c/openclaw_three_patched_highseverity/
<!-- SC_OFF -->I recently disclosed three high-severity vulnerabilities in OpenClaw, all of which have now been patched in version 2026.6.6. The findings affect different parts of the execution pipeline: Environment variable sanitizer bypass enabling interpreter startup variable abuse. Git ext:: transport command execution through developer workflows. Docker bind-mount validation weakness allowing access to restricted host paths. One of the demonstrations starts from a WhatsApp message and reaches host-side code execution under the documented deployment configuration. The Hacker News covered the coordinated disclosure: https://thehackernews.com/2026/07/researcher-details-whatsapp-to-host.html Technical write-up: https://medium.com/@chinmohannayak/i-sent-a-whatsapp-message-to-an-ai-agent-it-ran-my-code-on-the-host-adbbcbb0e0ad GitHub Security Advisories: https://github.com/openclaw/openclaw/security/advisories/GHSA-hjr6-g723-hmfm https://github.com/openclaw/openclaw/security/advisories/GHSA-9969-8g9h-rxwm https://github.com/openclaw/openclaw/security/advisories/GHSA-575v-8hfq-m3mc <!-- SC_ON --> submitted by /u/Lazy_Curve3899 (https://www.reddit.com/user/Lazy_Curve3899)
[link] (https://thehackernews.com/2026/07/researcher-details-whatsapp-to-host.html) [comments] (https://www.reddit.com/r/redteamsec/comments/1ustl4c/openclaw_three_patched_highseverity/)
https://www.reddit.com/r/redteamsec/comments/1ustl4c/openclaw_three_patched_highseverity/
<!-- SC_OFF -->I recently disclosed three high-severity vulnerabilities in OpenClaw, all of which have now been patched in version 2026.6.6. The findings affect different parts of the execution pipeline: Environment variable sanitizer bypass enabling interpreter startup variable abuse. Git ext:: transport command execution through developer workflows. Docker bind-mount validation weakness allowing access to restricted host paths. One of the demonstrations starts from a WhatsApp message and reaches host-side code execution under the documented deployment configuration. The Hacker News covered the coordinated disclosure: https://thehackernews.com/2026/07/researcher-details-whatsapp-to-host.html Technical write-up: https://medium.com/@chinmohannayak/i-sent-a-whatsapp-message-to-an-ai-agent-it-ran-my-code-on-the-host-adbbcbb0e0ad GitHub Security Advisories: https://github.com/openclaw/openclaw/security/advisories/GHSA-hjr6-g723-hmfm https://github.com/openclaw/openclaw/security/advisories/GHSA-9969-8g9h-rxwm https://github.com/openclaw/openclaw/security/advisories/GHSA-575v-8hfq-m3mc <!-- SC_ON --> submitted by /u/Lazy_Curve3899 (https://www.reddit.com/user/Lazy_Curve3899)
[link] (https://thehackernews.com/2026/07/researcher-details-whatsapp-to-host.html) [comments] (https://www.reddit.com/r/redteamsec/comments/1ustl4c/openclaw_three_patched_highseverity/)
screenscrub: Find credentials in screenshots, save them to your secret manager, and irreversibly redact them from the image
https://www.reddit.com/r/redteamsec/comments/1usv6ff/screenscrub_find_credentials_in_screenshots_save/
submitted by /u/ok_bye_now_ (https://www.reddit.com/user/ok_bye_now_)
[link] (https://github.com/Adversis/screenscrub) [comments] (https://www.reddit.com/r/redteamsec/comments/1usv6ff/screenscrub_find_credentials_in_screenshots_save/)
https://www.reddit.com/r/redteamsec/comments/1usv6ff/screenscrub_find_credentials_in_screenshots_save/
submitted by /u/ok_bye_now_ (https://www.reddit.com/user/ok_bye_now_)
[link] (https://github.com/Adversis/screenscrub) [comments] (https://www.reddit.com/r/redteamsec/comments/1usv6ff/screenscrub_find_credentials_in_screenshots_save/)
GitHub - IceCubeSandwich/CaddySmith: Generate Caddy redirector configs from Cobalt Strike or Sliver C2 profiles.
https://www.reddit.com/r/redteamsec/comments/1uttc87/github_icecubesandwichcaddysmith_generate_caddy/
<!-- SC_OFF -->Saw a tool like this for Apache a while back but I prefer Caddy, so I built CaddySmith (name pending kinda). Why Caddy? Single binary, automatic Let's Encrypt, cleaner config. Point it at a profile and it generates a Caddyfile that proxies beacon traffic to your teamserver and everything else arrives at a decoy. Strict mode enforces UA and all client headers from the profile. Sliver support is there too since the format is just JSON. --smoke generates a few curl commands to validate the redirector post-deploy. Test it out and tell me what you think. <!-- SC_ON --> submitted by /u/Kind_Giraffe_3279 (https://www.reddit.com/user/Kind_Giraffe_3279)
[link] (https://github.com/IceCubeSandwich/CaddySmith) [comments] (https://www.reddit.com/r/redteamsec/comments/1uttc87/github_icecubesandwichcaddysmith_generate_caddy/)
https://www.reddit.com/r/redteamsec/comments/1uttc87/github_icecubesandwichcaddysmith_generate_caddy/
<!-- SC_OFF -->Saw a tool like this for Apache a while back but I prefer Caddy, so I built CaddySmith (name pending kinda). Why Caddy? Single binary, automatic Let's Encrypt, cleaner config. Point it at a profile and it generates a Caddyfile that proxies beacon traffic to your teamserver and everything else arrives at a decoy. Strict mode enforces UA and all client headers from the profile. Sliver support is there too since the format is just JSON. --smoke generates a few curl commands to validate the redirector post-deploy. Test it out and tell me what you think. <!-- SC_ON --> submitted by /u/Kind_Giraffe_3279 (https://www.reddit.com/user/Kind_Giraffe_3279)
[link] (https://github.com/IceCubeSandwich/CaddySmith) [comments] (https://www.reddit.com/r/redteamsec/comments/1uttc87/github_icecubesandwichcaddysmith_generate_caddy/)
AntiVE-BehaviorWatch ( AI model Inside a EXE )
https://www.reddit.com/r/redteamsec/comments/1uug7hr/antivebehaviorwatch_ai_model_inside_a_exe/
submitted by /u/ObligationLucky842 (https://www.reddit.com/user/ObligationLucky842)
[link] (https://github.com/NirvanaOn/AntiVE-BehaviorWatch) [comments] (https://www.reddit.com/r/redteamsec/comments/1uug7hr/antivebehaviorwatch_ai_model_inside_a_exe/)
https://www.reddit.com/r/redteamsec/comments/1uug7hr/antivebehaviorwatch_ai_model_inside_a_exe/
submitted by /u/ObligationLucky842 (https://www.reddit.com/user/ObligationLucky842)
[link] (https://github.com/NirvanaOn/AntiVE-BehaviorWatch) [comments] (https://www.reddit.com/r/redteamsec/comments/1uug7hr/antivebehaviorwatch_ai_model_inside_a_exe/)
Persistence via Fake AMSI Provider | Playbook & Detection Strategies
https://www.reddit.com/r/redteamsec/comments/1uv51jv/persistence_via_fake_amsi_provider_playbook/
submitted by /u/netbiosX (https://www.reddit.com/user/netbiosX)
[link] (https://ipurple.team/2026/07/13/amsi-provider/) [comments] (https://www.reddit.com/r/redteamsec/comments/1uv51jv/persistence_via_fake_amsi_provider_playbook/)
https://www.reddit.com/r/redteamsec/comments/1uv51jv/persistence_via_fake_amsi_provider_playbook/
submitted by /u/netbiosX (https://www.reddit.com/user/netbiosX)
[link] (https://ipurple.team/2026/07/13/amsi-provider/) [comments] (https://www.reddit.com/r/redteamsec/comments/1uv51jv/persistence_via_fake_amsi_provider_playbook/)
What separates a real red-team lab from a tool-running lab?
https://www.reddit.com/r/redteamsec/comments/1uva5qt/what_separates_a_real_redteam_lab_from_a/
<!-- SC_OFF -->Running tools is easy. Building an operation that survives detection is the real skill. A realistic red-team lab should include: Infrastructure and C2 setup OPSEC and payload delivery Credential access and privilege escalation Lateral movement and persistence Detection-aware execution Reporting and remediation context What is the most important element that most red-team labs still miss? Redfox Blog:
https://www.redfoxsec.com/blog/adversary-simulation-vs-penetration-testing-which-does-your-business-need <!-- SC_ON --> submitted by /u/redfoxsecurity (https://www.reddit.com/user/redfoxsecurity)
[link] (https://www.redfoxsec.com/blog/adversary-simulation-vs-penetration-testing-which-does-your-business-need) [comments] (https://www.reddit.com/r/redteamsec/comments/1uva5qt/what_separates_a_real_redteam_lab_from_a/)
https://www.reddit.com/r/redteamsec/comments/1uva5qt/what_separates_a_real_redteam_lab_from_a/
<!-- SC_OFF -->Running tools is easy. Building an operation that survives detection is the real skill. A realistic red-team lab should include: Infrastructure and C2 setup OPSEC and payload delivery Credential access and privilege escalation Lateral movement and persistence Detection-aware execution Reporting and remediation context What is the most important element that most red-team labs still miss? Redfox Blog:
https://www.redfoxsec.com/blog/adversary-simulation-vs-penetration-testing-which-does-your-business-need <!-- SC_ON --> submitted by /u/redfoxsecurity (https://www.reddit.com/user/redfoxsecurity)
[link] (https://www.redfoxsec.com/blog/adversary-simulation-vs-penetration-testing-which-does-your-business-need) [comments] (https://www.reddit.com/r/redteamsec/comments/1uva5qt/what_separates_a_real_redteam_lab_from_a/)
Python Web Penetration Testing
https://python.plainenglish.io/python-web-penetration-testing-c0d127b69c2f?source=rss------bug_bounty-5
https://python.plainenglish.io/python-web-penetration-testing-c0d127b69c2f?source=rss------bug_bounty-5
Day 2: The Heart of HTTP — Interacting with Web Applications Like a ProContinue reading on Python in Plain English » (https://python.plainenglish.io/python-web-penetration-testing-c0d127b69c2f?source=rss------bug_bounty-5)
UMANG App Vulnerability: Why Responsible Disclosure Matters More Than Headlines
https://medium.com/@radhavidhale4/umang-app-vulnerability-why-responsible-disclosure-matters-more-than-headlines-51a87c4fa4f7?source=rss------bug_bounty-5
n recent days, reports have emerged regarding a security vulnerability in the UMANG (Unified Mobile Application for New-age Governance)…Continue reading on Medium » (https://medium.com/@radhavidhale4/umang-app-vulnerability-why-responsible-disclosure-matters-more-than-headlines-51a87c4fa4f7?source=rss------bug_bounty-5)
https://medium.com/@radhavidhale4/umang-app-vulnerability-why-responsible-disclosure-matters-more-than-headlines-51a87c4fa4f7?source=rss------bug_bounty-5
n recent days, reports have emerged regarding a security vulnerability in the UMANG (Unified Mobile Application for New-age Governance)…Continue reading on Medium » (https://medium.com/@radhavidhale4/umang-app-vulnerability-why-responsible-disclosure-matters-more-than-headlines-51a87c4fa4f7?source=rss------bug_bounty-5)
How Automatic Link Generation in Transactional Emails Can Introduce Security Risks
https://medium.com/@GERRR4Y/how-automatic-link-generation-in-transactional-emails-can-introduce-security-risks-d83f6b7d54aa?source=rss------bug_bounty-5
https://medium.com/@GERRR4Y/how-automatic-link-generation-in-transactional-emails-can-introduce-security-risks-d83f6b7d54aa?source=rss------bug_bounty-5
بسم الله والصلاة والسلام على رسول الله الحمد لله الذي علم بالقلم علم الإنسان ما لم يعلم والصلاة والسلام على خير معلم الناس الخير محمدContinue reading on Medium » (https://medium.com/@GERRR4Y/how-automatic-link-generation-in-transactional-emails-can-introduce-security-risks-d83f6b7d54aa?source=rss------bug_bounty-5)
I Just Wanted a Cold Coffee. Instead I Found a Master Key to a Vending Machine Empire.
https://medium.com/@gokul965/i-just-wanted-a-cold-coffee-instead-i-found-a-master-key-to-a-vending-machine-empire-fc4bad7bc1db?source=rss------bug_bounty-5
https://medium.com/@gokul965/i-just-wanted-a-cold-coffee-instead-i-found-a-master-key-to-a-vending-machine-empire-fc4bad7bc1db?source=rss------bug_bounty-5
A cautionary tale about snacks, curiosity, and why you should never F12 near a vending machine.Continue reading on Medium » (https://medium.com/@gokul965/i-just-wanted-a-cold-coffee-instead-i-found-a-master-key-to-a-vending-machine-empire-fc4bad7bc1db?source=rss------bug_bounty-5)
The Endpoint Everyone Ignored Just Took Down a Server
A $1,024 bug hidden inside the most ignored endpoint on the platform — and the mistake every developer makes without knowing it.Continue reading on Medium »
Read more...
A $1,024 bug hidden inside the most ignored endpoint on the platform — and the mistake every developer makes without knowing it.Continue reading on Medium »
Read more...
Medium
The Endpoint Everyone Ignored Just Took Down a Server
A $1,024 bug hidden inside the most ignored endpoint on the platform — and the mistake every developer makes without knowing it.
The Endpoint Everyone Ignored Just Took Down a Server
https://medium.com/@Aacle/the-endpoint-everyone-ignored-just-took-down-a-server-c32d51cf886e?source=rss------bug_bounty-5
https://medium.com/@Aacle/the-endpoint-everyone-ignored-just-took-down-a-server-c32d51cf886e?source=rss------bug_bounty-5