bruno
@0xbruno.bsky.social
application & cloud security stuff | philosophy, chess, weight lifting, and whiskey enjoyer
surprised I haven’t heard much from infosec community about OTP phishing
August 12, 2025 at 10:34 PM
surprised I haven’t heard much from infosec community about OTP phishing
Pentester = almost a hacker
The prefix ‘pen’ means “almost.”
peninsula = almost an island
penultimate = almost the last
peninsula = almost an island
penultimate = almost the last
March 31, 2025 at 8:01 PM
Pentester = almost a hacker
Reposted by bruno
On PTO and bored, so playing around with MCP by exposing Mythic APIs to Claude and seeing what the result. Attempting to have it emulate threat actors while operating Apollo in a lab... would make a good sparring partner :D www.youtube.com/watch?v=ZooT...
Mythic MCP - Claude Sonnet driving Mythic (Apollo)
YouTube video by Adam Chester
www.youtube.com
March 20, 2025 at 10:24 PM
On PTO and bored, so playing around with MCP by exposing Mythic APIs to Claude and seeing what the result. Attempting to have it emulate threat actors while operating Apollo in a lab... would make a good sparring partner :D www.youtube.com/watch?v=ZooT...
I’m assuming if an Entra ID tenant has Certificate Based Authentication enabled and the CAs trusted, you could pivot from on prem ADCS issues like ESC1 to the cloud ? 🤔
March 12, 2025 at 9:12 PM
I’m assuming if an Entra ID tenant has Certificate Based Authentication enabled and the CAs trusted, you could pivot from on prem ADCS issues like ESC1 to the cloud ? 🤔
Reposted by bruno
Wow, how did I not use this yet?! github.com/alufers/mitm...
GitHub - alufers/mitmproxy2swagger: Automagically reverse-engineer REST APIs via capturing traffic
Automagically reverse-engineer REST APIs via capturing traffic - alufers/mitmproxy2swagger
github.com
January 6, 2025 at 4:21 PM
Wow, how did I not use this yet?! github.com/alufers/mitm...
Reposted by bruno
[NEW BLOG]
EDR Silencer and Beyond: Exploring Methods to Block EDR Communication - Part 2
In collaboration with
@fabian.bader.cloud
academy.bluraven.io/blog/edr-sil...
#redteam
EDR Silencer and Beyond: Exploring Methods to Block EDR Communication - Part 2
In collaboration with
@fabian.bader.cloud
academy.bluraven.io/blog/edr-sil...
#redteam
EDR Silencer and Beyond: Exploring Methods to Block EDR Communication - Part 2
Alternative methods for EDR Silencers for blocking EDR communication to disable defenses.
academy.bluraven.io
December 1, 2024 at 5:32 PM
[NEW BLOG]
EDR Silencer and Beyond: Exploring Methods to Block EDR Communication - Part 2
In collaboration with
@fabian.bader.cloud
academy.bluraven.io/blog/edr-sil...
#redteam
EDR Silencer and Beyond: Exploring Methods to Block EDR Communication - Part 2
In collaboration with
@fabian.bader.cloud
academy.bluraven.io/blog/edr-sil...
#redteam
cool seeing people I look up to talk more intelligently about the EDR silencing techniques
I talked about Hosts file and a local bring-your-own HTTP CONNECT “firewall” sinkhole back in November
0xbruno.dev/posts/resear...
academy.bluraven.io/blog/edr-sil...
@cyb3rmonk.bsky.social
I talked about Hosts file and a local bring-your-own HTTP CONNECT “firewall” sinkhole back in November
0xbruno.dev/posts/resear...
academy.bluraven.io/blog/edr-sil...
@cyb3rmonk.bsky.social
EDR Silencer and Beyond: Exploring Methods to Block EDR Communication - Part 2
Alternative methods for EDR Silencers for blocking EDR communication to disable defenses.
academy.bluraven.io
January 2, 2025 at 6:39 PM
cool seeing people I look up to talk more intelligently about the EDR silencing techniques
I talked about Hosts file and a local bring-your-own HTTP CONNECT “firewall” sinkhole back in November
0xbruno.dev/posts/resear...
academy.bluraven.io/blog/edr-sil...
@cyb3rmonk.bsky.social
I talked about Hosts file and a local bring-your-own HTTP CONNECT “firewall” sinkhole back in November
0xbruno.dev/posts/resear...
academy.bluraven.io/blog/edr-sil...
@cyb3rmonk.bsky.social
Reposted by bruno
An attacker successfully phished a Cyberhaven employee.
They gained access to their Chrome Web Store admin credentials and published a malicious version of the Cyberhaven extension.
Read my full writeup here:
www.vulnu.com/p/breaking-c...
Thanks @jaimeblascob.bsky.social and @johntuckner.me
They gained access to their Chrome Web Store admin credentials and published a malicious version of the Cyberhaven extension.
Read my full writeup here:
www.vulnu.com/p/breaking-c...
Thanks @jaimeblascob.bsky.social and @johntuckner.me
Breaking: Cyberhaven Chrome Extension Compromised in Holiday Attack Campaign
An attacker successfully phished a Cyberhaven employee, gained access to Chrome Web Store admin credentials, published a malicious version of the extension
www.vulnu.com
December 27, 2024 at 3:20 AM
An attacker successfully phished a Cyberhaven employee.
They gained access to their Chrome Web Store admin credentials and published a malicious version of the Cyberhaven extension.
Read my full writeup here:
www.vulnu.com/p/breaking-c...
Thanks @jaimeblascob.bsky.social and @johntuckner.me
They gained access to their Chrome Web Store admin credentials and published a malicious version of the Cyberhaven extension.
Read my full writeup here:
www.vulnu.com/p/breaking-c...
Thanks @jaimeblascob.bsky.social and @johntuckner.me
when you have to push a remediation for a dumb security bug for compliance and devs look at you diff
December 27, 2024 at 2:12 AM
when you have to push a remediation for a dumb security bug for compliance and devs look at you diff
Reposted by bruno
The struggle is real.
December 24, 2024 at 4:24 PM
The struggle is real.
At this pace security appliances getting popped more than other software 😅
December 22, 2024 at 11:33 PM
At this pace security appliances getting popped more than other software 😅
Wonder who’s gonna be the Docker and k8s of agentic AI and orchestration. Think infosec will probably pivot to abusing the orchestration flows and architecture of agentic AI. Essentially adding an abstraction layer but we’ll still need knowledge of the underlying systems
December 20, 2024 at 7:51 PM
Wonder who’s gonna be the Docker and k8s of agentic AI and orchestration. Think infosec will probably pivot to abusing the orchestration flows and architecture of agentic AI. Essentially adding an abstraction layer but we’ll still need knowledge of the underlying systems
pentesters when they remember they left an unprotected webshell on an engagement months ago
December 12, 2024 at 6:41 PM
pentesters when they remember they left an unprotected webshell on an engagement months ago
Reposted by bruno
Reposted by bruno
ethernet? you mean the wifi cable
December 9, 2024 at 5:01 PM
ethernet? you mean the wifi cable
getting to work with people much smarter than you is such an underrated benefit
December 6, 2024 at 11:44 PM
getting to work with people much smarter than you is such an underrated benefit
Reposted by bruno
absolutely incredible attack vector
December 6, 2024 at 3:27 AM
absolutely incredible attack vector
Reposted by bruno
reading Fear and Trembling by Kierkegaard hoping for some deep insights. summary is “just trust me bro” -god
December 4, 2024 at 12:41 AM
reading Fear and Trembling by Kierkegaard hoping for some deep insights. summary is “just trust me bro” -god