These days I am trying to learn AD pentest and many questions are popping up in my mind, so here's one for AD Attackers.
In LLMNR Poisoning, we're setting a server running responder that will listen to LLMNR queries and act as rogue SMB server, but how can we trick users to put some non-existent IP address or share name into their explorer? Are we just relying on a coincidence of a user mistakenly jotting down a typo?

#ActiveDirectory #Pentesting

Comparing AI agents to cybersecurity professionals in real-world pen testing

https://arxiv.org/abs/2512.09882

#HackerNews #AIagents #cybersecurity #penTesting #realWorld #comparison

I don't usually post work or business related things on here, as it's my outlet for therapeutic shitposting BUT that said, I was reminded yesterday that 2025 marked the 10th year in business for my little venture, Secure Being, an #infosec consultancy focused on issues that impact real people.

I originally set it up with two goals - 1) manage book related things, and 2) as I became more leadershippy™️ in my day job, I wanted to have the opportunity to stay hands-on, and still engage in pen-testing and forensics and all the good stuff I love.

I don't aggressively advertise the company, it's a word of mouth type thing really, I have a regular core of customers at this point, who keep me busy - but of course, always happy to add new ones.

This last year was probably the most fun I've had with it though, I done infosec work for a professional sports arena, a brand new model of jet aircraft and its avionics, and I've had about 6 or so critical findings on various products that have caused me to stop testing, and get immediate fixes in place - as the issues discovered were extremely risky to, not just businesses, but actual human people too - which of course was the main focus.

So yeah, here's to another 10 years! And if you are ever in the market for a pentester, forensicator, or anything else really - give us a look!

Cheers!

https://www.securebeing.com/

#pentesting #DFIR #forensics

I don't usually post work or business related things on here, as it's my outlet for therapeutic shitposting BUT that said, I was reminded yesterday that 2025 marked the 10th year in business for my little venture, Secure Being, an #infosec consultancy focused on issues that impact real people.

I originally set it up with two goals - 1) manage book related things, and 2) as I became more leadershippy™️ in my day job, I wanted to have the opportunity to stay hands-on, and still engage in pen-testing and forensics and all the good stuff I love.

I don't aggressively advertise the company, it's a word of mouth type thing really, I have a regular core of customers at this point, who keep me busy - but of course, always happy to add new ones.

This last year was probably the most fun I've had with it though, I done infosec work for a professional sports arena, a brand new model of jet aircraft and its avionics, and I've had about 6 or so critical findings on various products that have caused me to stop testing, and get immediate fixes in place - as the issues discovered were extremely risky to, not just businesses, but actual human people too - which of course was the main focus.

So yeah, here's to another 10 years! And if you are ever in the market for a pentester, forensicator, or anything else really - give us a look!

Cheers!

https://www.securebeing.com/

#pentesting #DFIR #forensics

#CVECrowd, your go-to place for #CVE discussions on the Fediverse and Bluesky, now supports email alerts.

https://cvecrowd.com

Here's how it works:

- You define one or more alert keywords
- Keywords are matched against vendor, product, and package names from official CVE data
- If a post mentions a CVE that matches one of your keywords, you receive an email notification

Read more below 🧵

#Pentesting #AppSec #InfoSec #CyberSecurity #BugBounty #Hacking

#CVECrowd, your go-to place for #CVE discussions on the Fediverse and Bluesky, now supports email alerts.

https://cvecrowd.com

Here's how it works:

- You define one or more alert keywords
- Keywords are matched against vendor, product, and package names from official CVE data
- If a post mentions a CVE that matches one of your keywords, you receive an email notification

Read more below 🧵

#Pentesting #AppSec #InfoSec #CyberSecurity #BugBounty #Hacking

What cool shit can I add to a response header if I found poisoning? Aside from the boring "send in a whole new page?"

#appsec #pentesting

Watch Brenno De Winter’s talk from OrangeCon 2024 on making penetration tests auditable again.
Watch here: https://www.youtube.com/watch?v=Rv0otVFKrkk
#OrangeCon2024#Pentesting#Cybersecurity#Infosec

DEF CON Training 2025
📅 August 9–12, 2025 | 4-Day Training

Join Michael Aguilar #v3ga and Alex Delifer #Cheet for a hands-on course on Medical Device Penetration Testing at #DEFCON33 @defcon

Learn more and sign up: https://training.defcon.org/collections/def-con-training-las-vegas-2025/products/michael-aguilar-v3ga-alex-delifer-cheet-medical-device-penetration-testing-dctlv2025-4-day-training

#Biohackingvillage#PenTesting#Cybersecurity #hackers#Hacking #workshop#DEFCON