an0n
@an0n_r0
Followers
13K
Following
10K
Media
316
Statuses
2K
CRT(E|O|L) | OSCP | @RingZer0_CTF 1st (for 2yrs) | HackTheBox Top10 | RPISEC MBE | Flare-On completer | GoogleCTF writeup winner | SSD research | Math MSc |ðŸ‡ðŸ‡º
Joined October 2018
RT @HackingLZ: Now that there are tons of these and I can never find them when I need them, thanks @Oddvarmoe for showing me all the LOLS….
lolol.farm
Living Off the Living Off the Lands
0
45
0
RT @_l0gg: Blog for ToolShell.Disclaimer: The content of this blog is provided for educational and informational purposes only. https://t.c….
0
82
0
RT @codewhitesec: We have reproduced "ToolShell", the unauthenticated exploit chain for CVE-2025-49706 + CVE-2025-49704 used by @_l0gg to p….
0
160
0
RT @TrustedSec: Chrome Remote Desktop can offer red teamers a subtle way to bypass restrictions—if they know how to use it. In this blog, @….
trustedsec.com
0
85
0
RT @HackingLZ: Beacon Object Files – Five Years On… 🔥.
aff-wg.org
When I was active in the red teaming space, one of my stated goals was to act on problems with solutions that would have utility 5-10 years from the time of their release. This long-term thinking w…
0
35
0
RT @RedTeamPT: 🚨 Our new blog post about Windows CVE-2025-33073 which we discovered is live:. 🪞 The Reflective Kerberos Relay Attack - Remo….
blog.redteam-pentesting.de
It is a sad truth in IT security that some vulnerabilities never quite want to die and time and time again, vulnerabilities that have long been fixed get revived and come right back at you. While...
0
177
0
Played with copilot for offensive coding. Tbh it is disappointing. If I asked sth for low-level the produced code is totally false and uncompilable. It was easier to use legacy (but still awesome) stuff like Donut, +polished my loader from lasy year. Still good in some scenarios.
3
6
91
0
78
0
RT @the_yellow_fall: Critical 0-Day (CVSS 9.8) in Fortinet Products Actively Exploited. A critical Fortinet zero-day (CVE-2025-32756, CVSS….
securityexpress.info
A critical Fortinet zero-day (CVE-2025-32756, CVSS 9.8) is being actively exploited, allowing unauthenticated RCE. PoC available, patch immediately.
0
133
0
RT @theluemmel: Took @akamai_research's script for BadSuccessor and improved it a bit. - runs from non domain joined systems.- works in fo….
0
115
0
RT @Octoberfest73: Can’t win. Try to do the right thing and get told to fuck off by Microsoft, so you open source it WITH detection logic a….
0
9
0
RT @HackingLZ: If you want to be a successful red teamer in 2025, do you have to be able to code(This includes with or without the assistan….
0
5
0
One more thing about my Hikvision journey: extracted the plaintext camera passwords from the NVR by MitM (actually connected to the NVR using a camera IP) and by downgrading the default HTTP digest authentication to basic using these RTSP server replies.
gist.github.com
RTSP client responses for forcing HTTP Basic authentication - fake_rtsp_server.py
Thanks @HikvisionHQ, resetting your basic NVR device admin password (even with physical access) requires hardware hacking. I don't see any realistic threat that you are protecting your customers against, but anyway, I like it. 🙂
1
4
7
One last note about the TFTP download: the NVR uses relative path (filename without leading /), so a map file might be needed (if the TFTP server requires absolute paths).
0
1
2
The colors of the USB TTL wires are (ordered):. - black: GND.- red: power (must NOT be connected!).- white: RX (data to USB).- green: TX (data from USB). The connection should be (TX<->RX, GND<->GND):. - JST yellow <-> USB white.- JST black <-> USB green.- JST red <-> USB black.
1
2
1
The wiring of the JST-ZH connector according to the picture below:. - white: power (must NOT be connected!!!).- yellow: TX (data out from the NVR).- black: RX (data into the NVR).- red: GND (ground, it is required for reliable operation)
1
0
0