Profile avatar
felmoltor.me
Mastodon [email protected]. Now with more #OSCP than the previous version. Working @SensePost.com - Orange Cyberdefense https://blog.felipemolina.com/
37 posts 78 followers 176 following
Prolific Poster

I need to tell you about a Russian tech exec named Vladislav Klyushin. He was convicted in the US of orchestrating one of the biggest insider trading cases ever. He was convinced he'd never do real time. That's because Klyushin had a powerful patron in the Kremlin. www.wired.com/story/russia...

Instead of relying on RemCom, what if we had a python client to interact with the latest, Microsoft signed PSExec? In this post Aurélien details how he and the team did exactly this, including a tool, some PSExec internals and detection opportunities! sensepost.com/blog/2025/ps...

I was trying to do something here, but I guess my drawing skills hit their top at my sixteens

A slow clap for Cupertino geniuses at Apple 👏. I hate the cringy AI logo for this application that has been pushed down with the last MacOS update. I thought initially that I installed some shady Adware from then 90's, but no. And there's no way to remove it! Beautiful and professional 👏

AD attackers often hunt for hosts with Unconstrained Delegation enabled. Use these scripts to create Ghost-Servers advertising Unconstrained Delegation (but alerting you to it's usage). blog.thinkst.com/2025/02/almo... __ * Also featuring "why we aren't shipping this in Canary"

The downing of flight MH17 in 2014 inspired a movement of online researchers to search for answers... Now, you can see how the Bellingcat team helped uncover those answers in a new three-part documentary series on National Geographic.

❗️❗️❗️ Estoy 𝗵𝗮𝗿𝘁𝗼 de que cada vez que hablo del sindiós de la atención a la ciudadanía en la Administración pública salte —bienintencionado— un funcionario y me diga resignado: —Es que tenemos una falta de personal tremenda. 📣 ¡𝗡𝗼! ¡No, no, no y mil veces no! typefully.com/JaimeObrego...

Ahora que @elmundotoday.com se ha dejado de postear en X, necesitan más que nunca nuestra panoja. Orgulloso de ayudar a La Verdad con mi sucio capital.

deepseek-code really hopes that it cleared my confusion 😵‍💫

C IS LEGAL AGAIN

If you are overhearing think "thats me frfr" you should come work with us at glitchsecure.com

Interesting read. I've always strugged to box a complex vulnerability into a number form 0 to 10 and looks like the curl and golang projects feels the same about it.

I thought Arcane was targeted only to gen-z, but, oh boy, it has me sooo hooked right now. And I've never played LoL once.

I discovered my favourite feature in Spotify today ❤️

mitmproxy 11.1 is out! 🥳 We now support *Local Capture Mode* on Windows, macOS, and - new - Linux! This allows users to intercept local applications even if they don't have proxy settings. More details are at mitmproxy.org/posts/local-.... Super proud of this team effort. 😃

Me: *trying hard to focus* My brain: Let's search for the best Monkey Island theme in youtube! www.youtube.com/watch?v=23yQ...

Just three social media CEOs posting on their platform today.

It was not enough holidays if you still remember your password when coming back to work.

Saturn, Venus and Moon last night 🪐🌒

Christmas is beautiful with kids ❤️

I bought 3 video games this last week in sales. I have installed one, which I played for 25 minutes, before I had to deal with home things. ... In what universe do I think I'm having time for new videogames? ... I don't learn.

Just finished playing Darq. A bit short, but it was a really good and challenging puzzle game with the same vibes as Little Nightmares.

New module on #NetExec : wam Dump #Entra access tokens from Windows Token Broker Cache, and make your way to Entra 🚀 Thanks @xpnsec.com for the technique! More info on his blog : blog.xpnsec.com/wam-bam/

New research: We've been monitoring a threat actor publishing dozens of trojanized GitHub repositories targeting threat actors, leaking hundreds of thousands of credentials along the way securitylabs.datadoghq.com/articles/mut...

The Microsoft intern after finishing sanitising the 13 million records

Another week is over, time for new stats regarding traffic to @heiseonline: It seems like there is a new balance with #Mastodon in front, #Bluesky brings now half as much. Although we stopped posting to #X, it still brings in more than #Threads and roughly as much as #Flipboard. (🧵 1/4)

It is worth communicating that there is not currently a known technical fix for removing AI slop imagery and web content from search results, so we’re headed for an information crisis of unprecedented proportions. Really.

You can now relay any protocol to SMB over Kerberos with krbrelayx.py and the latest PRs from Hugo Vincent. Thanks @dirkjanm.io for merging it! Here is an example from SMB to SMB:

💡 Attackers act fast on public PoC code — sometimes within hours. On Dec 5, PoC for two Mitel MiCollab CVEs dropped, and GreyNoise immediately detected attacker activity. 🔎 Real-time intelligence is critical.

Is it only me of it makes no sense that Microsoft now recommends for not forcing password changes to user but keep the shitty eight characters minimum length? This is going to make my life so easy now... Erm... 🤯 learn.microsoft.com/en-us/micros...

The fossil hunt today was bountiful. And includes a vertebrae! 🐌🎣

European cops compromised another another encrypted messaging service used by criminals // cc @josephcox.bsky.social www.europol.europa.eu/media-press/...

finally finished downloading my limewire wrapped after 20 years

"We cannot continue to participate in the social network feed of a man who proclaims the death of the media and therefore of journalists... X is a platform that no longer serves the public interest at all, but the special ideological and financial interests of its owner and his political allies"

👋 Bluesky!

Excited to share a tool I've been working on - ShadowHound. ShadowHound is a PowerShell alternative to SharpHound for Active Directory enumeration, using native PowerShell or ADModule (ADWS). As a bonus I also talk about some MDI detections and how to avoid them. blog.fndsec.net/2024/11/25/s...

#ProgrammingJokes

There's something I need people to understand. The studio that made this released some numbers. They had to produce 85 minutes of footage to find 15 usable seconds for this ad. The machine that creates moving images out of nothing has a failure rate of 340:1 and the best 15 seconds... is this.

I usually change the radio station or skip the spotify song if they play the bazzillion times played 'Take Me Out' from Franz Ferdinanz, but I have to say his last single is really good! Made me move my head while writting a report, which is a good sign 🕺 open.spotify.com/track/0Yty54...

One of my favourite vim tips: delete everything between braces and then end up in insert mode ready to type a replacement: ci{ My mnemonic is "Change In {" This works for other types of braces, quotes, and a bunch of other situations See :help object-select for more :)

I'm glad to release the tool I have been working hard on the last month: #KrbRelayEx A Kerberos relay & forwarder for MiTM attacks! >Relays Kerberos AP-REQ tickets >Manages multiple SMB consoles >Works on Win& Linux with .NET 8.0 >... GitHub: github.com/decoder-it/K...

This is a weird feeling, I have been in Twitter for a long time, but I don't want to be in any politician's social network anymore, RIP x.com/felmoltor 🫡