the grugq's newsletter

Subscribe
Archives
January 27, 2025

January 26, 2024

January 26, 2024

Logon scripts are as old as Active Directory....yet I still see numerous misconfigurations during internal pentests. Back in 2023 I did some research into logon script misconfigurations and abuses and came up with quite a bit of material. This tool is a result of that research.โ€ฆ pic.twitter.com/L5gqR5nnYP

โ€” spencer (@techspence) January 24, 2025

GitHub - techspence/ScriptSentry: ScriptSentry finds misconfigured and dangerous logon scripts.

ScriptSentry finds misconfigured and dangerous logon scripts. - techspence/ScriptSentry


#SpyNews - week 4 (January 19-25):
A summary of 69 espionage-related stories from week 4 coming from ๐Ÿ‡ฎ๐Ÿ‡ถ๐Ÿ‡ต๐Ÿ‡ฑ๐Ÿ‡ท๐Ÿ‡บ๐Ÿ‡บ๐Ÿ‡ธ๐Ÿ‡บ๐Ÿ‡ฆ๐Ÿ‡ต๐Ÿ‡ญ๐Ÿ‡จ๐Ÿ‡ณ๐Ÿ‡น๐Ÿ‡ท๐Ÿ‡ธ๐Ÿ‡ฐ๐Ÿ‡ท๐Ÿ‡ด๐Ÿ‡ช๐Ÿ‡น๐Ÿ‡ฐ๐Ÿ‡ช๐Ÿ‡บ๐Ÿ‡ฌ๐Ÿ‡ธ๐Ÿ‡ด๐Ÿ‡ซ๐Ÿ‡ท๐Ÿ‡จ๐Ÿ‡ฆ๐Ÿ‡ฌ๐Ÿ‡ง๐Ÿ‡ฎ๐Ÿ‡ฑ๐Ÿ‡ต๐Ÿ‡ธ๐Ÿ‡ฎ๐Ÿ‡ท๐Ÿ‡ฆ๐Ÿ‡ฟ๐Ÿ‡ฎ๐Ÿ‡ณ๐Ÿ‡ฆ๐Ÿ‡ช๐Ÿ‡จ๐Ÿ‡ด๐Ÿ‡ป๐Ÿ‡ช๐Ÿ‡ฐ๐Ÿ‡ต๐Ÿ‡ฆ๐Ÿ‡ท๐Ÿ‡ช๐Ÿ‡จ๐Ÿ‡ญ๐Ÿ‡ท๐Ÿ‡ฑ๐Ÿ‡ง๐Ÿ‡ง๐Ÿ‡ช๐Ÿ‡ญ๐Ÿ‡บ๐Ÿ‡ณ๐Ÿ‡ฑ๐Ÿ‡ต๐Ÿ‡ฐ๐Ÿ‡ง๐Ÿ‡ฉ๐Ÿ‡ง๐Ÿ‡ฌ๐Ÿ‡ด๐Ÿ‡ฒ๐Ÿ‡ณ๐Ÿ‡ฟ๐Ÿ‡ฆ๐Ÿ‡ฒ๐Ÿ‡ซ๐Ÿ‡ฎ๐Ÿ‡ฐ๐Ÿ‡ท๐Ÿ‡ฉ๐Ÿ‡ช๐Ÿ‡ธ๐Ÿ‡ฌ๐Ÿ‡ฟ๐Ÿ‡ผ๐Ÿ‡ฏ๐Ÿ‡ต๐Ÿ‡น๐Ÿ‡ผ๐Ÿ‡ญ๐Ÿ‡ฐ๐Ÿ‡ฉ๐Ÿ‡ฟ๐Ÿ‡ฎ๐Ÿ‡น https://t.co/sziJPK4lXN#OSINT #HUMINT #SIGINT #spy #espionage

โ€” Spy Collection (@SpyCollection1) January 26, 2025


We are publishing less here now. But here is a recent post by @Tuan_Linh_98 & lots of guidance by @cplearns2h4ck https://t.co/mdnnxhQv8E

โ€” starlabs (@starlabs_sg) January 25, 2025


What's your go-to cognitive weapon when you want to destroy a rival's productivity for three or four weeks? I like to deploy Norman Yarvin's usenet archive (https://t.co/j5Ujw1juG2), but the danger of blowback is very high.

โ€” Pinboard (@Pinboard) January 25, 2025

https://yarchive.net/


Just gave Operator access to my mailbox.

It accidentally opened my spam folder, clicked the first email linking to a crypto phishing site, navigated to the page, connected my wallet, and completed the fake transaction.

I lost 300$ ๐Ÿ˜’ https://t.co/9VIMemlleE

โ€” Thomas Roccia ๐Ÿค˜ (@fr0gger_) January 25, 2025

Of course, this is a satiric tweet to help you think about the security and the potential consequences of giving access to your bank information to an autonomous system. ๐Ÿ™‚

โ€” Thomas Roccia ๐Ÿค˜ (@fr0gger_) January 25, 2025

In a near future attackers wonโ€™t need to lure you anymoreโ€”they will target the agents around you. ๐Ÿคฏ

โ€” Thomas Roccia ๐Ÿค˜ (@fr0gger_) January 25, 2025


USB Army Knife: Close Access Penetest Tool created by @therealshodan

It is capable of: remote keystroke injection, VNC, USB network adapter, EvilAP, Marauder, record microphone, controlled over web interface with fancy LCD screenhttps://t.co/FtOi9n9lHx pic.twitter.com/eoAYPCHrMI

โ€” Mobile Hacker (@androidmalware2) January 24, 2025

Cool video!

You can follow me ๐Ÿ‘ˆ
And the project ๐Ÿ‘‡https://t.co/PQqVYdJduS

โ€” ไธ‚ๅ„ใ„–แ—ชๅ‚ๅ‡  - ๐Ÿ‘‹ crack fingers (@therealshodan) January 24, 2025


Here is my other blog on how to setup and enable Bluetooth (internal or external) in scanning mode on rooted Androidhttps://t.co/NsROIXgJhC #nethunter

โ€” Mobile Hacker (@androidmalware2) January 25, 2025


Anomalous Tokens in DeepSeek-V3 and r1 - by henry

A first attempt at identifying and cataloging DeepSeek's glitched tokens


Don't miss what's next. Subscribe to the grugq's newsletter:
X