turbo
@turbo_sec
Followers
120
Following
3K
Media
3
Statuses
143
professional threat actor cosplayer
Joined May 2021
BloodHound OpenGraph isn’t just about AD anymore. In his latest Risky Biz interview, @jaredcatkinson breaks down how OpenGraph now maps attack paths across GitHub, AWS, SaaS, CI/CD, and beyond, allowing defenders to see what attackers see. 🎧: https://t.co/RrzPKgQmJD
2
7
27
Blogs are up!
Wanting more from today's #BHEU talk on SCOM? Check out this two part blog series! 1️⃣ @unsigned_sh0rt maps SCOM’s roles, accounts, & trust boundaries, then shows how attackers can chain insecure defaults into full management group compromise. https://t.co/Ai4TqTtc4O 🧵: 1/2
1
42
128
Thank you, Philly! Huge shoutout to everyone who stopped by the Red Team Village at @BSidesPhilly. We loved meeting you, learning with you, and seeing the community show up with so much talent and energy. And major congrats to our RTV CTF winners — you crushed it. 🏆🔴🐉 See you
0
6
21
That's a wrap! The @RedTeamVillage #CTF at @BSidesPhilly is officially over. Congratulations to the winners and everyone who participated! See the final results here: https://t.co/tZlO503vQM
#RedTeamVillage #BSidesPhilly #HackingCommunity
0
1
6
SCOM monitors critical systems, but insecure defaults make it a powerful attack vector. At #BHEU, @unsigned_sh0rt & @breakfix show how to abuse SCOM for credential theft, lateral movement, and domain escalation, plus how to defend it. https://t.co/bxW5PYyhyl
0
31
70
SCOM monitors critical systems, but insecure defaults make it a powerful attack vector. At #BHEU, @unsigned_sh0rt & @breakfix show how to abuse SCOM for credential theft, lateral movement, and domain escalation, plus how to defend it. https://t.co/bxW5PYyhyl
3
40
133
Extremely thankful for family, friends, and coworkers both former and current. I would not be where I am without you and your belief in me and support!
0
0
0
New blog post is up exploring a vuln I found in Claude Code (CVE-2025-64755) allowing arbitrary file write without a consent prompt. New tech is always fun to explore, hopefully this post gives you some hints as to future research :)
specterops.io
This blog post explores a bug, (CVE-2025-64755), I found while trying to find a command execution primitive within Claude Code to demonstrate the risks of web-hosted MCP to a client.
10
90
365
I see lots of posts from job seekers mentioning how they’ve spent many months and countless hours applying to thousands of jobs without any success. With everyone else mostly doing the same thing and with these (awful) ATS systems at play, I’m not certain this is the best use of
1
2
15
Cleaned out my cable bin. Pretty sure I will have a need for a random obscure cable once the trash comes this week.
0
0
0
I feel like @YuG0rd's briefly mentioned new dMSA account takeover mechanism in his last blog didn't get enough attention. A new account takeover mechanism is on the horizon. I wrote a blog detailing it, releasing with a new BOF I wrote called BadTakeover https://t.co/fyUkDYKAeP
specterops.io
After Microsoft patched Yuval Gordon’s BadSuccessor privilege escalation technique, BadSuccessor returned with another blog from Yuval, briefly mentioning to the community that attackers can still...
3
43
107
#MiamiHerbert earned its highest placements to date in @usnews's 2026 rankings! Read more: https://t.co/tPbTb7M8SG
2
2
8
App-Bound Encryption isn't stopping hungry attackers from getting into the cookie jar. 🍪 Join Andrew Gomez & Antero Guy at #BSidesDenver Sept 12 to learn how threat actors are still stealing browser secrets, plus a sweet EntraID cloud pivot bonus. ➡️ https://t.co/vayrK5j1Cz
1
7
16
I Just documented a cool way to authenticate proxied tooling to LDAP in an AD environment using C2 payload auth context, without stealing any tickets or hashes! Keep tooling execution off-host and away from EDR on your Red Team assessments! https://t.co/VLE2Kh4idY
specterops.io
TL;DR When operating out of a ceded access or phishing payload with no credential material, you can use low-privilege HTTP authentication from the current user context to perform a proxied relay to...
5
118
418
Trying to fly under EDR's radar? @_logangoins explains how to use HTTP-to-LDAP relay attacks to execute tooling completely off-host through the C2 payload context. Perfect for when you need LDAP access but want to avoid being caught stealing creds.
specterops.io
TL;DR When operating out of a ceded access or phishing payload with no credential material, you can use low-privilege HTTP authentication from the current user context to perform a proxied relay to...
1
74
225
New blog post just dropped! West Shepherd breaks down extending the Mythic Poseidon agent for ARM64 Dylib injection on Apple Silicon. Details include: ✅ Shellcode construction ✅ Memory allocation ✅ Runtime patching ✅ Thread creation Read more ⤵️
specterops.io
This post details how the Mythic Poseidon agent was extended to support ARM64 Dylib injection on Apple Silicon
5
46
120