How a Default Password Let Me Log Into Almost Anyone’s Account
A story about how one shared default password, combined with a simple user-enumeration flaw, turned into a critical account takeover…Continue reading on Medium »
Read more...
A story about how one shared default password, combined with a simple user-enumeration flaw, turned into a critical account takeover…Continue reading on Medium »
Read more...
Medium
How a Default Password Let Me Log Into Almost Anyone’s Account
A story about how one shared default password, combined with a simple user-enumeration flaw, turned into a critical account takeover…
Video tutorial: How to run Password Spraying attacks directly from Sliver C2 framework?
https://www.reddit.com/r/redteamsec/comments/1w8qsx9/video_tutorial_how_to_run_password_spraying/
submitted by /u/lsecqt (https://www.reddit.com/user/lsecqt)
[link] (https://youtu.be/MgotYfujDio) [comments] (https://www.reddit.com/r/redteamsec/comments/1w8qsx9/video_tutorial_how_to_run_password_spraying/)
https://www.reddit.com/r/redteamsec/comments/1w8qsx9/video_tutorial_how_to_run_password_spraying/
submitted by /u/lsecqt (https://www.reddit.com/user/lsecqt)
[link] (https://youtu.be/MgotYfujDio) [comments] (https://www.reddit.com/r/redteamsec/comments/1w8qsx9/video_tutorial_how_to_run_password_spraying/)
CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT
https://www.reddit.com/r/redteamsec/comments/1wal658/cve202525249_exploitation_delivers_pivotc2_a/
submitted by /u/socradario (https://www.reddit.com/user/socradario)
[link] (https://socradar.io/blog/cve-2025-25249-pivotc2-fortigate-rat/) [comments] (https://www.reddit.com/r/redteamsec/comments/1wal658/cve202525249_exploitation_delivers_pivotc2_a/)
https://www.reddit.com/r/redteamsec/comments/1wal658/cve202525249_exploitation_delivers_pivotc2_a/
submitted by /u/socradario (https://www.reddit.com/user/socradario)
[link] (https://socradar.io/blog/cve-2025-25249-pivotc2-fortigate-rat/) [comments] (https://www.reddit.com/r/redteamsec/comments/1wal658/cve202525249_exploitation_delivers_pivotc2_a/)
🔴 Breakdown of a real Redis rogue-replication cryptomining toolkit recovered from an open directory
https://www.reddit.com/r/redteamsec/comments/1wavxeq/breakdown_of_a_real_redis_roguereplication/
<!-- SC_OFF -->Recovered an operator's full working toolkit from an open directory, so this is real tradecraft rather than a PoC. The R&D trail is the interesting part, you can see what they tried and dropped. Core primitive is rogue replication: CONFIG SET dir/dbfilename, SLAVEOF to a rogue master, crafted RDB served on +FULLRESYNC with an embedded newline that lands a cron entry, then SLAVEOF NO ONE and restore config to stay quiet. Not novel, but clean, and it works from Redis 2.8.17 to 7.2.0 because it abuses replication, not a bug. Four production fallback write paths, plus a separate deploy_all.py that hits cron.d, an APT hook (/etc/apt/apt.conf.d/), and profile.d in one pass for redundancy against cleanup. Pull cron and the other two respawn on the next apt update or login shell. Abandoned R&D still in the folder: a BGSAVE-based first draft (noisier, dropped for replication), a webshell-via-Redis probe against web roots (never weaponized), and path recon into /etc/init.d, the full rc0-rc6 SysV set, and /etc/modprobe.d. None of those shipped. modprobe.d is the one they tested but held back, writable modprobe config runs commands on module load, stealthier than cron. Two verify payload bugs they hit and documented in comments: a test cron written to a dotfile that run-parts silently skips, and a /dev/tcp callback that dies under dash. Both burned real campaign runs before they fixed them. Opsec choices worth noting: XMRig pulled from the official GitHub release (blends into github.com egress, no attacker-hosted binary), renamed to /tmp/.xmrig, --tls on 443 to look like HTTPS, and the newest variant pins the pool cert with --tls-fingerprint so it fails closed against inspection. Two techniques that went nowhere: SSH-via-AOF (0 of 2,342, every host bounced at CONFIG SET with AUTH_REQUIRED) and a Lua EVAL sandbox probe. Fresh no-auth targets are the constraint, a run against a pre-qualified list hit 72.6% vs 22 to 26% full-fleet. Full write-up with IOCs and code: https://hunt.io/blog/redis-cryptomining-botnet-3562-servers <!-- SC_ON --> submitted by /u/Straight-Practice-99 (https://www.reddit.com/user/Straight-Practice-99)
[link] (https://hunt.io/blog/redis-cryptomining-botnet-3562-servers) [comments] (https://www.reddit.com/r/redteamsec/comments/1wavxeq/breakdown_of_a_real_redis_roguereplication/)
https://www.reddit.com/r/redteamsec/comments/1wavxeq/breakdown_of_a_real_redis_roguereplication/
<!-- SC_OFF -->Recovered an operator's full working toolkit from an open directory, so this is real tradecraft rather than a PoC. The R&D trail is the interesting part, you can see what they tried and dropped. Core primitive is rogue replication: CONFIG SET dir/dbfilename, SLAVEOF to a rogue master, crafted RDB served on +FULLRESYNC with an embedded newline that lands a cron entry, then SLAVEOF NO ONE and restore config to stay quiet. Not novel, but clean, and it works from Redis 2.8.17 to 7.2.0 because it abuses replication, not a bug. Four production fallback write paths, plus a separate deploy_all.py that hits cron.d, an APT hook (/etc/apt/apt.conf.d/), and profile.d in one pass for redundancy against cleanup. Pull cron and the other two respawn on the next apt update or login shell. Abandoned R&D still in the folder: a BGSAVE-based first draft (noisier, dropped for replication), a webshell-via-Redis probe against web roots (never weaponized), and path recon into /etc/init.d, the full rc0-rc6 SysV set, and /etc/modprobe.d. None of those shipped. modprobe.d is the one they tested but held back, writable modprobe config runs commands on module load, stealthier than cron. Two verify payload bugs they hit and documented in comments: a test cron written to a dotfile that run-parts silently skips, and a /dev/tcp callback that dies under dash. Both burned real campaign runs before they fixed them. Opsec choices worth noting: XMRig pulled from the official GitHub release (blends into github.com egress, no attacker-hosted binary), renamed to /tmp/.xmrig, --tls on 443 to look like HTTPS, and the newest variant pins the pool cert with --tls-fingerprint so it fails closed against inspection. Two techniques that went nowhere: SSH-via-AOF (0 of 2,342, every host bounced at CONFIG SET with AUTH_REQUIRED) and a Lua EVAL sandbox probe. Fresh no-auth targets are the constraint, a run against a pre-qualified list hit 72.6% vs 22 to 26% full-fleet. Full write-up with IOCs and code: https://hunt.io/blog/redis-cryptomining-botnet-3562-servers <!-- SC_ON --> submitted by /u/Straight-Practice-99 (https://www.reddit.com/user/Straight-Practice-99)
[link] (https://hunt.io/blog/redis-cryptomining-botnet-3562-servers) [comments] (https://www.reddit.com/r/redteamsec/comments/1wavxeq/breakdown_of_a_real_redis_roguereplication/)
firmware-reverse-engineering
https://kitploit.com/en/tools/github/orbitcurve/firmware-reverse-engineering
A full claude and codex skillsets for firmware reverse engineering.
https://kitploit.com/en/tools/github/orbitcurve/firmware-reverse-engineering
A full claude and codex skillsets for firmware reverse engineering.
sshelf
https://kitploit.com/en/tools/github/max-rh/sshelf
Fast terminal UI for your SSH hosts: fuzzy-search and connect in two keystrokes, dual-pane SFTP file transfer, and background port forwarding. Keeps its own host database and generates the ssh command — never edits ~/.ssh/config.
https://kitploit.com/en/tools/github/max-rh/sshelf
Fast terminal UI for your SSH hosts: fuzzy-search and connect in two keystrokes, dual-pane SFTP file transfer, and background port forwarding. Keeps its own host database and generates the ssh command — never edits ~/.ssh/config.
skulto
https://kitploit.com/en/tools/github/asteroid-belt/skulto
Offline and security-first tool for syncing and managing agent skills
https://kitploit.com/en/tools/github/asteroid-belt/skulto
Offline and security-first tool for syncing and managing agent skills
strongswan v6.1.0
Open-source IPsec-based VPN solution with IKEv2 support, certificate-based authentication, and flexible site-to-site, host-to-host, and roadwarrior configurations.
Read more...
Open-source IPsec-based VPN solution with IKEv2 support, certificate-based authentication, and flexible site-to-site, host-to-host, and roadwarrior configurations.
Read more...
Aegis aegis-v0.14.1-alpha
OS-level monitor for AI agents: observes processes, file access, and network activity on the local machine and attributes each event to an agent instance.
Read more...
OS-level monitor for AI agents: observes processes, file access, and network activity on the local machine and attributes each event to an agent instance.
Read more...
Ethical Hacker: Hire The Best Certified Ethical Hackers > Smatchoicehackers.com
https://medium.com/@paulweller_3232/ethical-hacker-hire-the-best-certified-ethical-hackers-smatchoicehackers-com-b6c0e135b0b7?source=rss------bug_bounty-5
https://medium.com/@paulweller_3232/ethical-hacker-hire-the-best-certified-ethical-hackers-smatchoicehackers-com-b6c0e135b0b7?source=rss------bug_bounty-5
Certificate Ethical HackerContinue reading on Medium » (https://medium.com/@paulweller_3232/ethical-hacker-hire-the-best-certified-ethical-hackers-smatchoicehackers-com-b6c0e135b0b7?source=rss------bug_bounty-5)
How a Default Password Let Me Log Into Almost Anyone’s Account
https://medium.com/@udaydixit987/how-a-default-password-let-me-log-into-almost-anyones-account-75d3a60dbc5b?source=rss------bug_bounty-5
https://medium.com/@udaydixit987/how-a-default-password-let-me-log-into-almost-anyones-account-75d3a60dbc5b?source=rss------bug_bounty-5
A story about how one shared default password, combined with a simple user-enumeration flaw, turned into a critical account takeover…Continue reading on Medium » (https://medium.com/@udaydixit987/how-a-default-password-let-me-log-into-almost-anyones-account-75d3a60dbc5b?source=rss------bug_bounty-5)
Deep-Live-Cam v2.7.5-Ultimate
real time face swap and one-click video deepfake with only a single image
Read more...
real time face swap and one-click video deepfake with only a single image
Read more...
preflight v0.22.0
Go-based CLI tool that scans codebases for launch readiness, detecting missing configuration, security hygiene issues, secret leaks, and integration gaps before production deployment.
Read more...
Go-based CLI tool that scans codebases for launch readiness, detecting missing configuration, security hygiene issues, secret leaks, and integration gaps before production deployment.
Read more...
Stop Guessing and Start Grepping: The Hacker’s Masterclass in Regex
Let’s get straight to it. Most bug bounty hunters are terrified of Regular Expressions (Regex). They look at a string of characters like…Continue reading on Medium »
Read more...
Let’s get straight to it. Most bug bounty hunters are terrified of Regular Expressions (Regex). They look at a string of characters like…Continue reading on Medium »
Read more...
Medium
Stop Guessing and Start Grepping: The Hacker’s Masterclass in Regex
Let’s get straight to it. Most bug bounty hunters are terrified of Regular Expressions (Regex). They look at a string of characters like…
security-baseline-ubuntu
https://kitploit.com/en/tools/github/eugexo/security-baseline-ubuntu
Production-grade Security Baseline & Hardening Guide for Ubuntu 24.04/26.04 LTS. Kernel isolation, custom AppArmor/Firejail 0.9.80, Rootless Docker, AIDE integrity checks, Lynis audits, and secure hardware (YubiKey/Ledger). 17 languages.
https://kitploit.com/en/tools/github/eugexo/security-baseline-ubuntu
Production-grade Security Baseline & Hardening Guide for Ubuntu 24.04/26.04 LTS. Kernel isolation, custom AppArmor/Firejail 0.9.80, Rootless Docker, AIDE integrity checks, Lynis audits, and secure hardware (YubiKey/Ledger). 17 languages.
strongswan v6.1.0
https://kitploit.com/en/posts/github-strongswan-strongswan-610
Open-source IPsec-based VPN solution with IKEv2 support, certificate-based authentication, and flexible site-to-site, host-to-host, and roadwarrior configurations.
https://kitploit.com/en/posts/github-strongswan-strongswan-610
Open-source IPsec-based VPN solution with IKEv2 support, certificate-based authentication, and flexible site-to-site, host-to-host, and roadwarrior configurations.
Aegis aegis-v0.14.1-alpha
https://kitploit.com/en/posts/github-antropos17-aegis-aegis-v0141-alpha
OS-level monitor for AI agents: observes processes, file access, and network activity on the local machine and attributes each event to an agent instance.
https://kitploit.com/en/posts/github-antropos17-aegis-aegis-v0141-alpha
OS-level monitor for AI agents: observes processes, file access, and network activity on the local machine and attributes each event to an agent instance.