Pinned Tweet
If you have ever learned anything from me at all. I challenge you to pay it forward. I didn’t get to where I am by standing on the shoulders of giants, I got here by learning tidbits from hundreds of tweeters, bloggers, podcasters & presenters who chose to share their knowledge.
43
185
1,061
Rob Fuller retweeted
hashcat v8.0.0 released!
The largest update in the history of hashcat, with PCFG attacks, hash recipes that crack hashes without a hash-mode, and bcrypt on FPGA boards.
Release notes: github.com/hashcat/hashca…
Download: hashcat.net/hashcat/
The largest update in the history of hashcat, with PCFG attacks, hash recipes that crack hashes without a hash-mode, and bcrypt on FPGA boards.
Release notes: github.com/hashcat/hashca…
Download: hashcat.net/hashcat/
17
327
1,518
62,490
Rob Fuller retweeted
I wrote up a way to defeat enforced SMB signing for relay.
It abuses a documented SMB re-authentication behavior.
I'm surely missing nuance and prior art. Corrections welcome.
Writeup:
blackfield.ch/blog/defeating…
PoC:
github.com/aas-n/reauthx
It abuses a documented SMB re-authentication behavior.
I'm surely missing nuance and prior art. Corrections welcome.
Writeup:
blackfield.ch/blog/defeating…
PoC:
github.com/aas-n/reauthx
2
64
176
15,101
Rob Fuller retweeted
Its me, I have a working PoC with the infoleaks to bypass ASLR. It took a lot of prompting and re-iterating to find those, tested against PHP 8.5.11 x86_64 with with all defaults and tested over the Internet
Has anyone actually seen a fully working PoC in the wild for the PHP vuln? Finding the UAFs is fast, but you still need things like info leak to get it to exec and I dont see anyone posts that include it, just tons of llms that are just reading proc/other ways to manage layout
8
14
94
11,717
Rob Fuller retweeted
@BSides_NoVA OCT 31st Keynote: @mubix
Stories from the Red Side
Creating tools, wielding donuts, walking on water, etc.
With 25 years of experience, Rob's been though crazy situations.
And we're gonna hear about it!
Info: bsidesnova-2026.sessionize.com/session/1357825
Tickets: eventbrite.com/e/bsidesnova-2…
Stories from the Red Side
Creating tools, wielding donuts, walking on water, etc.
With 25 years of experience, Rob's been though crazy situations.
And we're gonna hear about it!
Info: bsidesnova-2026.sessionize.com/session/1357825
Tickets: eventbrite.com/e/bsidesnova-2…
0
6
8
1,189
Rob Fuller retweeted
It’s hard to believe 11 years have passed since @gentilkiwi encouraged me to open-source DSInternals and start tweeting about my research, with him being my very first Twitter follower. Thank you, Benjamin! #MyXAnniversary
0
3
27
2,289
PastySpace - dead simple modern pastebin that runs in docker, and easy URLs to type URLs. I Ai'd it because I couldn't find something to move files and clipboards around to other systems easily.
github.com/mubix/pastyspa…
pastyspace.com
github.com/mubix/pastyspa…
pastyspace.com
1
7
49
3,498
Every time I hear about the advances in Ai and the fears about what it could do and what it is doing to society, I remember this quote from Jurassic Park 1:
3
6
25
2,608
Rob Fuller retweeted
1/4 NetScaler exploitation IOCs (CVE-2026-88771 suspected) 🚨
Sharing detection info from a failed exploitation attempt seen on 22 Sep. Unauthenticated, two-stage, fully automated. Shared for detection only, so you can check your own logs.
#NetScaler #Citrix #DFIR
Sharing detection info from a failed exploitation attempt seen on 22 Sep. Unauthenticated, two-stage, fully automated. Shared for detection only, so you can check your own logs.
#NetScaler #Citrix #DFIR
6
32
127
13,073
Rob Fuller retweeted
We’re doing this again. hobocon 3 is coming.
hobocon 2 put 68 hackers, makers, radio nerds, and assorted weirdos in one train car.
For hobocon 3, we’re planning at least twice the nonsense: two train cars and 136 people.
Interest form: hobocon.com
hobocon 2 put 68 hackers, makers, radio nerds, and assorted weirdos in one train car.
For hobocon 3, we’re planning at least twice the nonsense: two train cars and 136 people.
Interest form: hobocon.com
1
9
20
1,413
Rob Fuller retweeted
ScreenConnect is 74.5% of the abused remote-access tools @HuntressLabs sees.
So I detonated two real samples and hunted both on Defender and Elastic. Full hunt notes and every query in the Article.
So I detonated two real samples and hunted both on Defender and Elastic. Full hunt notes and every query in the Article.
2
33
128
18,269
Made a Golang port of it heavily using AI to do so: github.com/mubix/ntlmscou… - workflow built out most of the binary versions someone would need.
Amazing concept and work by @BoydHacks
Amazing concept and work by @BoydHacks
Just released ntlmscout, a single-file, zero-dependency recon tool for internet-exposed NTLM endpoints. Combines the best parts of several tools all in one.
Decodes the Type-2 challenge across HTTP/SMB/MSSQL/mail/LDAP/RDP, recovers the internal IP (OXID, IIS host-header, cert SANs), flags DCs, and sprays lockout-safe.
Hack the Planet!
github.com/boydhacks/ntlm…
1
4
41
6,054
Rob Fuller retweeted
@mubix great stuff mate, I did something similar: github.com/stratomarco/ai…
0
1
13
1,325
Added more training to the AI-CTF (it won't be fast but you can run this on a halfway decent laptop) - github.com/mubix/ai-ctf
It teaches prompt injection and other paths prompt injection can take. All the answers are in the repo so it isn't about getting the flags but learning.
It teaches prompt injection and other paths prompt injection can take. All the answers are in the repo so it isn't about getting the flags but learning.
15
63
330
17,230
Finally had some time to update IOXIDResolver thanks to a few people submitting changes/issues: github.com/mubix/IOXIDRes…
0
4
30
3,093
Rob Fuller retweeted
ItsNotAlwaysSMB: DPAPI in other protocols🔥
SMB is monitored closely nowadays, stopping attacks like looting DPAPI secrets. Thanks to @_zblurx, NetExec got a huge upgrade, extending DPAPI credential dumping to other protocols such as WMI, WinRM and MSSQL and various modules🔑
SMB is monitored closely nowadays, stopping attacks like looting DPAPI secrets. Thanks to @_zblurx, NetExec got a huge upgrade, extending DPAPI credential dumping to other protocols such as WMI, WinRM and MSSQL and various modules🔑
4
110
402
15,473
Rob Fuller retweeted
Friday afternoon (vibe)coding project that was on my to-do for a while: obtaining Entra ID tokens from an endpoint by asking the WAM. This alternative to using the PRT cookie follows the legitimate SSO flow used by apps like Teams to obtain tokens. Code: github.com/dirkjanm/askWAM
7
76
234
18,886
Rob Fuller retweeted
Outflank's ntlmrain takes Google's ~8 TiB NetNTLMv1 rainbow tables and losslessly compresses them to ~3.99 TB using globally sorted endpoints, packed 39 bit chain starts, delta encoding + Rice-16 coding, and a global GIDX index.
The result is ~1 min SSD table lookups, precomputation/verification, and ~7 min end-to-end cracking on an RTX 4070 Ti.
More Explanation in their blog: outflank.nl/blog/2026/09/0…
Github tool: github.com/outflanknl/ntl…
NTLMRain Table: lookup.ntlmrain.com
#NetNTLMv1
The result is ~1 min SSD table lookups, precomputation/verification, and ~7 min end-to-end cracking on an RTX 4070 Ti.
More Explanation in their blog: outflank.nl/blog/2026/09/0…
Github tool: github.com/outflanknl/ntl…
NTLMRain Table: lookup.ntlmrain.com
#NetNTLMv1
1
16
132
6,370
Made a Cybersecurity Resume Reviewer AI skill that I've been using for some mentees, made it public for anyone who is interested in using it as well. Hope others find it useful (also open to feedback or pull requests). github.com/mubix/cyber-re…
12
105
523
28,434
