💥 leonjza
@leonjza.bsky.social
[ 'cto @sensepost.com', '@orangecyberdef', 'caffeine fueled', '(╯°□°)╯︵ ┻━┻', 'security guy', 'metalhead', 'i saw your password', 'KOOBo+KXleKAv+KXlSnjgaM=' ]
Pinned
💥 leonjza
@leonjza.bsky.social
· Nov 10
Slides for our talk "TTP Emulation in(2024)" that I did with Wrath_ZA@x at 0xcon_jhb@x is now available here!
In this talk we covered a purple teaming approach that leverages custom payload development to maximise red&blue collaboration. Check it out!
github.com/leonjza/publ...
In this talk we covered a purple teaming approach that leverages custom payload development to maximise red&blue collaboration. Check it out!
github.com/leonjza/publ...
Noone asked for this, but I'm trying to get more comfortable with qemu as a whole which has resulted in this overly fancy Qemu Machine Protocol (QMP) socket client, complete with dynamic schema parsing, event subscriptions and tab completion, because why not :P
January 28, 2026 at 10:47 PM
Noone asked for this, but I'm trying to get more comfortable with qemu as a whole which has resulted in this overly fancy Qemu Machine Protocol (QMP) socket client, complete with dynamic schema parsing, event subscriptions and tab completion, because why not :P
Thank you for applying the patch carefully.
January 28, 2026 at 5:24 PM
Thank you for applying the patch carefully.
Reposted by 💥 leonjza
an easy way to remember the difference between ssh -L and ssh -R is to try both until it works
January 28, 2026 at 1:28 AM
an easy way to remember the difference between ssh -L and ssh -R is to try both until it works
Quick lunch time side quest building a simple lab to play with the inetutils-telnetd authentication bypass as disclosed on oss-sec ₁.
github.com/leonjza/inet...
₁ seclists.org/oss-sec/2026...
github.com/leonjza/inet...
₁ seclists.org/oss-sec/2026...
January 21, 2026 at 11:06 AM
Quick lunch time side quest building a simple lab to play with the inetutils-telnetd authentication bypass as disclosed on oss-sec ₁.
github.com/leonjza/inet...
₁ seclists.org/oss-sec/2026...
github.com/leonjza/inet...
₁ seclists.org/oss-sec/2026...
Really excited to present this Frida training @1ns0mn1h4ck.bsky.social with @ipmegladon.bsky.social and myself! If you've dabbled with Frida before, but want a practical learning opportunity to improve your usage and understanding, this one is for you!
Learn how to bypass security controls using Frida at #InsomniHack workshop. "Binary Instrumentation with Frida" is led by SensePost and it is made for reverse engineers, pentesters & security researchers. Get your ticket: https://ow.ly/lTxz50XVBJm
#Cybersecurity #Infosec #INSO2026 #Cyberworkshops
#Cybersecurity #Infosec #INSO2026 #Cyberworkshops
January 19, 2026 at 9:09 AM
Really excited to present this Frida training @1ns0mn1h4ck.bsky.social with @ipmegladon.bsky.social and myself! If you've dabbled with Frida before, but want a practical learning opportunity to improve your usage and understanding, this one is for you!
Reposted by 💥 leonjza
January 14, 2026 at 9:02 AM
It's a nice feeling wrapping up some research! :D
December 8, 2025 at 6:23 AM
It's a nice feeling wrapping up some research! :D
Two blog posts just dropped - one with the details on the bloatware pwning shenanigans I was up to earlier in the year, and another on pipetap, a new Windows named pipe proxy/tool.
sensepost.com/blog/2025/pw...
sensepost.com/blog/2025/pi...
sensepost.com/blog/2025/pw...
sensepost.com/blog/2025/pi...
December 7, 2025 at 7:02 AM
Two blog posts just dropped - one with the details on the bloatware pwning shenanigans I was up to earlier in the year, and another on pipetap, a new Windows named pipe proxy/tool.
sensepost.com/blog/2025/pw...
sensepost.com/blog/2025/pi...
sensepost.com/blog/2025/pw...
sensepost.com/blog/2025/pi...
It’s almost time for my @BSidesCapeTown talk, and I’ve just open sourced pipetap. My Windows named pipe proxy & multi-tool. Excited to see what you do with it!
github.com/sensepost/pi...
github.com/sensepost/pi...
December 6, 2025 at 1:56 PM
It’s almost time for my @BSidesCapeTown talk, and I’ve just open sourced pipetap. My Windows named pipe proxy & multi-tool. Excited to see what you do with it!
github.com/sensepost/pi...
github.com/sensepost/pi...
Honestly excited for this years BSides Cape Town with fellow hackers and the @sensepost.com crew! See you soon Cape Town!
December 5, 2025 at 9:58 AM
Honestly excited for this years BSides Cape Town with fellow hackers and the @sensepost.com crew! See you soon Cape Town!
Reposted by 💥 leonjza
[BLOG]
This update solved a big issue I had with merging raw assembly into PIC. I cover the new linkfunc command and the updated addhook command.
rastamouse.me/pic-symphony/
This update solved a big issue I had with merging raw assembly into PIC. I cover the new linkfunc command and the updated addhook command.
rastamouse.me/pic-symphony/
December 1, 2025 at 8:12 PM
[BLOG]
This update solved a big issue I had with merging raw assembly into PIC. I cover the new linkfunc command and the updated addhook command.
rastamouse.me/pic-symphony/
This update solved a big issue I had with merging raw assembly into PIC. I cover the new linkfunc command and the updated addhook command.
rastamouse.me/pic-symphony/
Reposted by 💥 leonjza
LibPicoManager is a unified PICO management framework that provides centralized control over PICOs in memory, enabling dynamic code loading, runtime PICO substitution, and advanced evasion techniques like sleep masking through a single RWX code block.
github.com/pard0p/LibPi...
github.com/pard0p/LibPi...
GitHub - pard0p/LibPicoManager: LibPicoManager is a unified PICO management framework that provides centralized control over Position Independent Code Objects in shared memory, enabling dynamic code l...
LibPicoManager is a unified PICO management framework that provides centralized control over Position Independent Code Objects in shared memory, enabling dynamic code loading, runtime PICO substitu...
github.com
December 1, 2025 at 11:24 PM
LibPicoManager is a unified PICO management framework that provides centralized control over PICOs in memory, enabling dynamic code loading, runtime PICO substitution, and advanced evasion techniques like sleep masking through a single RWX code block.
github.com/pard0p/LibPi...
github.com/pard0p/LibPi...
Reposted by 💥 leonjza
Where I'm going with this: we're in research territory. We may find patterns that just make sense as the way to tackle certain problems/architectural needs. And, in some cases, tightly coupling things may be the right answer.
Always keep the task/problem first, make elegance a lower priority aim.
Always keep the task/problem first, make elegance a lower priority aim.
December 2, 2025 at 3:48 AM
Where I'm going with this: we're in research territory. We may find patterns that just make sense as the way to tackle certain problems/architectural needs. And, in some cases, tightly coupling things may be the right answer.
Always keep the task/problem first, make elegance a lower priority aim.
Always keep the task/problem first, make elegance a lower priority aim.
Reposted by 💥 leonjza
🎟️ Early Bird tickets for Insomni'hack 2026 are live!
Join us in Switzerland for talks, CTF and networking with industry leaders.
Don’t miss out! Secure your spot now: https://ow.ly/iKes50XzTj3
#INSO26 #Cybersecurity #EthicalHacking #Event
Join us in Switzerland for talks, CTF and networking with industry leaders.
Don’t miss out! Secure your spot now: https://ow.ly/iKes50XzTj3
#INSO26 #Cybersecurity #EthicalHacking #Event
December 1, 2025 at 10:25 AM
🎟️ Early Bird tickets for Insomni'hack 2026 are live!
Join us in Switzerland for talks, CTF and networking with industry leaders.
Don’t miss out! Secure your spot now: https://ow.ly/iKes50XzTj3
#INSO26 #Cybersecurity #EthicalHacking #Event
Join us in Switzerland for talks, CTF and networking with industry leaders.
Don’t miss out! Secure your spot now: https://ow.ly/iKes50XzTj3
#INSO26 #Cybersecurity #EthicalHacking #Event
Reposted by 💥 leonjza
The new version of RTO II is finally available to purchase.
www.zeropointsecurity.co.uk/course/red-t...
www.zeropointsecurity.co.uk/course/red-t...
Red Team Ops II
Gain the knowledge and skills necessary to operate against advanced defences.
www.zeropointsecurity.co.uk
November 28, 2025 at 2:30 PM
The new version of RTO II is finally available to purchase.
www.zeropointsecurity.co.uk/course/red-t...
www.zeropointsecurity.co.uk/course/red-t...
Reposted by 💥 leonjza
We've been waiting 5 years for this: objection has been updated to 1.12.x with Frida17+ support. Thank you so much @leonjza.bsky.social and everyone who contributed!
github.com/sensepost/ob...
Thanks to @ipmegladon.bsky.social for updating the MASTG accordingly (OWASP/mastg/pull/3378)
github.com/sensepost/ob...
Thanks to @ipmegladon.bsky.social for updating the MASTG accordingly (OWASP/mastg/pull/3378)
Release 1.12.0 · sensepost/objection
The, wow, finally, a release release! 😂
Honestly, there has been so much that has changed, and it's hard to thank and attribute to everyone that has contributed. To that end, thank you for your con...
github.com
November 21, 2025 at 12:30 PM
We've been waiting 5 years for this: objection has been updated to 1.12.x with Frida17+ support. Thank you so much @leonjza.bsky.social and everyone who contributed!
github.com/sensepost/ob...
Thanks to @ipmegladon.bsky.social for updating the MASTG accordingly (OWASP/mastg/pull/3378)
github.com/sensepost/ob...
Thanks to @ipmegladon.bsky.social for updating the MASTG accordingly (OWASP/mastg/pull/3378)
I know it took long, and there is work to do, but I'm excited for getting back on track.
November 21, 2025 at 3:50 PM
I know it took long, and there is work to do, but I'm excited for getting back on track.
We changed two big things today.
1. Packaging is now using uv. While you can still pip install objection, you can now also run it with: uv run --with objection
2. Pushing updates to PyPi now happens on git tag, using trusted publishing: docs.pypi.org/trusted-publ....
1. Packaging is now using uv. While you can still pip install objection, you can now also run it with: uv run --with objection
2. Pushing updates to PyPi now happens on git tag, using trusted publishing: docs.pypi.org/trusted-publ....
Getting Started - PyPI Docs
docs.pypi.org
November 21, 2025 at 3:50 PM
We changed two big things today.
1. Packaging is now using uv. While you can still pip install objection, you can now also run it with: uv run --with objection
2. Pushing updates to PyPi now happens on git tag, using trusted publishing: docs.pypi.org/trusted-publ....
1. Packaging is now using uv. While you can still pip install objection, you can now also run it with: uv run --with objection
2. Pushing updates to PyPi now happens on git tag, using trusted publishing: docs.pypi.org/trusted-publ....
Apart from all of the epic effort @ipmegladon.bsky.social and other contributors have put in, I'm really happy with the new CI. Manual pypi releases are no longer needed and we can finally move fast again with tagging which is huge.
Getting Started - PyPI Docs
docs.pypi.org
November 21, 2025 at 3:50 PM
Apart from all of the epic effort @ipmegladon.bsky.social and other contributors have put in, I'm really happy with the new CI. Manual pypi releases are no longer needed and we can finally move fast again with tagging which is huge.
It's... been a while since the last objection release got tagged. We finally landed a 1.12 release today which also means pypi is up to date again, and for the foreseeable future! Work never really stopped, and plenty of bug fixes are included. More in 🧵
github.com/sensepost/ob...
github.com/sensepost/ob...
November 21, 2025 at 3:50 PM
It's... been a while since the last objection release got tagged. We finally landed a 1.12 release today which also means pypi is up to date again, and for the foreseeable future! Work never really stopped, and plenty of bug fixes are included. More in 🧵
github.com/sensepost/ob...
github.com/sensepost/ob...
Reposted by 💥 leonjza
Made this last night, it’s useful for finding a large number of domains hosting phishing kits or malware based on a consistent pattern github.com/singe/domain-p… Might be useful for some of you.
GitHub - singe/domain-probe: A utility to find identically configured domains and web-servers based on a pattern. Used to find phishing kits.
A utility to find identically configured domains and web-servers based on a pattern. Used to find phishing kits. - singe/domain-probe
github.com
November 20, 2025 at 6:22 AM
Made this last night, it’s useful for finding a large number of domains hosting phishing kits or malware based on a consistent pattern github.com/singe/domain-p… Might be useful for some of you.
Reposted by 💥 leonjza
Need to open doors from the outside without touching anything? Turns out thats possible with no touch sensors as @shifttymike.bsky.social details in his latest blog post.
sensepost.com/blog/2025/no...
sensepost.com/blog/2025/no...
November 19, 2025 at 1:29 PM
Need to open doors from the outside without touching anything? Turns out thats possible with no touch sensors as @shifttymike.bsky.social details in his latest blog post.
sensepost.com/blog/2025/no...
sensepost.com/blog/2025/no...
November 18, 2025 at 5:11 PM
Landed a new gowitness release, this time focussing on performance! 🎉 v3.1.0
github.com/sensepost/go...
github.com/sensepost/go...
Release 3.1.0 · sensepost/gowitness
A new release, this time focussing on performance and various bug fixes! Thanks to all of the contributors! Enjoy! 🎉
New
Refactor the chromedp driver, focussing on performance. The new implementat...
github.com
November 17, 2025 at 7:31 PM
Landed a new gowitness release, this time focussing on performance! 🎉 v3.1.0
github.com/sensepost/go...
github.com/sensepost/go...
Reposted by 💥 leonjza
Tradecraft Engineering with Aspect-Oriented Programming
@rastamouse.me pretty much predicted what was coming in his last blog post. attach (Win32 APIs), redirect (local funcs), capability right-sized IAT hooks, and PICO function exports.
Yes, attach can incept its PIC.
aff-wg.org/2025/11/10/t...
@rastamouse.me pretty much predicted what was coming in his last blog post. attach (Win32 APIs), redirect (local funcs), capability right-sized IAT hooks, and PICO function exports.
Yes, attach can incept its PIC.
aff-wg.org/2025/11/10/t...
Tradecraft Engineering with Aspect-Oriented Programming
It’s 2025 and apparently, I’m still a Java programmer. One of the things I never liked about Java’s culture, going back many years ago, was the tendency to hype frameworks that seemed to over-engin…
aff-wg.org
November 10, 2025 at 6:21 PM
Tradecraft Engineering with Aspect-Oriented Programming
@rastamouse.me pretty much predicted what was coming in his last blog post. attach (Win32 APIs), redirect (local funcs), capability right-sized IAT hooks, and PICO function exports.
Yes, attach can incept its PIC.
aff-wg.org/2025/11/10/t...
@rastamouse.me pretty much predicted what was coming in his last blog post. attach (Win32 APIs), redirect (local funcs), capability right-sized IAT hooks, and PICO function exports.
Yes, attach can incept its PIC.
aff-wg.org/2025/11/10/t...