fa
Feedback
APT

APT

رفتن به کانال در Telegram

This channel discusses: — Offensive Security — RedTeam — Malware Research — OSINT — etc Disclaimer: t.me/APT_Notes/6 Chat Link: t.me/APT_Notes_PublicChat

نمایش بیشتر
روسيا40 429فناوری و برنامه‌ها7 782

📈 تحلیل کانال تلگرام APT

کانال APT (@apt_notes) در بخش زبانی انگلیسی بازیگری فعال است. در حال حاضر جامعه شامل 16 236 مشترک است و جایگاه 7 782 را در دسته فناوری و برنامه‌ها و رتبه 40 429 را در منطقه روسيا دارد.

📊 شاخص‌های مخاطب و پویایی

از زمان ایجاد در невідомо، پروژه رشد سریعی داشته و 16 236 مشترک جذب کرده است.

بر اساس آخرین داده‌ها در تاریخ 29 اوت, 2026، کانال فعالیت پایداری دارد. در ۳۰ روز گذشته تغییر اعضا برابر 560 و در ۲۴ ساعت گذشته برابر 13 بوده و همچنان دسترسی گسترده‌ای حفظ شده است.

  • وضعیت تأیید: تأیید نشده
  • نرخ تعامل (ER): میانگین تعامل مخاطب 39.15% است و در ۲۴ ساعت نخست پس از انتشار، محتوا معمولاً 18.08% واکنش نسبت به کل مشترکان کسب می‌کند.
  • دسترسی پست‌ها: هر پست به طور میانگین 6 354 بازدید دریافت می‌کند. در اولین روز معمولاً 2 934 بازدید جمع‌آوری می‌شود.
  • واکنش‌ها و تعامل: مخاطبان به‌طور فعال حمایت می‌کنند؛ میانگین واکنش به هر پست 26 است.

📝 توضیح و سیاست محتوایی

نویسنده این فضا را محل بیان دیدگاه‌های شخصی توصیف می‌کند:
“This channel discusses: — Offensive Security — RedTeam — Malware Research — OSINT — etc Disclaimer: t.me/APT_Notes/6 Chat Link: t.me/APT_Notes_PublicChat”

به لطف به‌روزرسانی‌های پرتکرار (آخرین داده در تاریخ 30 اوت, 2026)، کانال همواره به‌روز و دارای دسترسی بالاست. تحلیل‌ها نشان می‌دهد مخاطبان به‌طور فعال با محتوا تعامل دارند و آن را به نقطه اثرگذاری مهم در دسته فناوری و برنامه‌ها تبدیل کرده‌اند.

16 236
مشترکین
+1324 ساعت
+1017 روز
+56030 روز
آرشیو پست ها
APT
APT
16 236
🖥 Find and execute WinAPI functions with Assembly If you want to take a happy little journey through PEB structs, PE headers
🖥 Find and execute WinAPI functions with Assembly If you want to take a happy little journey through PEB structs, PE headers and kernel32.dll Export Table to spawn some "calc.exe" on x64 using Assembly, here it is. 📚 What you will learn: — WinAPI function manual location with Assembly; — PEB Structure and PEB_LDR_DATA; — PE File Structure; — Relative Virtual Address calculation; — Export Address Table (EAT); — Windows x64 calling-convention in practice; — Writing in Assembly like a real Giga-Chad... 🔗 Source: https://print3m.github.io/blog/x64-winapi-shellcoding #maldev #winapi #x64 #shellcode #assembly

APT
APT
16 236
👩‍💻 Anyone can Access Deleted and Private Repository Data on GitHub You can access data from deleted forks, deleted reposit
👩‍💻 Anyone can Access Deleted and Private Repository Data on GitHub You can access data from deleted forks, deleted repositories and even private repositories on GitHub. And it is available forever. This is known by GitHub, and intentionally designed that way. Cross Fork Object Reference (CFOR) vulnerability occurs when one repository fork can access sensitive data from another fork (including data from private and deleted forks). — Deleted Fork Data: Still accessible. — Deleted Repo Data: Commits remain. — Private Repo Data: Can become public. 🔗 Research: https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-github #github #private #repo #cfor

APT
APT
16 236
Repost from Offensive Xwitter
😈 [ Print3M @Print3M_ ] I wrote my first calc.exe "shellcode" in NASM. I find it a little strange that a lot of people write about malware development but almost no one talks about writing your own shellcode. I decided to write something on my own. (good comments, easy readable) 🔗 https://github.com/Print3M/shellcodes/blob/main/calc-exe.asm 🐥 [ tweet ] #для_самых_маленьких

APT
APT
16 236
🛠 Adventures in Shellcode Obfuscation This series of articles explores various methods for hiding shellcode, emphasizing tec
🛠 Adventures in Shellcode Obfuscation This series of articles explores various methods for hiding shellcode, emphasizing techniques to avoid detection. The focus is on demonstrating diverse approaches to conceal shellcode. 🔗 Part 1: Overview 🔗 Part 2: Hail Caesar 🔗 Part 3: Encryption 🔗 Part 4: RC4 with a Twist 🔗 Part 5: Base64 🔗 Part 6: Two Array Method #shellcode #obfuscation #clang #maldev

APT
APT
16 236
.

APT
APT
16 236
Repost from vx-underground
How to fix the Crowdstrike thing: 1. Boot Windows into safe mode 2. Go to C:\Windows\System32\drivers\CrowdStrike 3. Delete C-00000291*.sys 4. Repeat for every host in your enterprise network including remote workers 5. If you're using BitLocker jump off a bridge

APT
APT
16 236

APT
APT
16 236
💻 Chrome Extension For Persistence How to silently install any Chrome extension and avoid common indicators of compromise (IOCs). The method avoids using CLI parameters or registry edits, and persists via the Secure Preferences file 🔗 Source: https://syntax-err0r.github.io/Silently_Install_Chrome_Extension.html #chrome #persistence #maldev #c2

APT
APT
16 236
🖥 Introduction for to Windows kernel exploitation Explore the Windows Kernel with HEVD, a vulnerable driver. Dive into stack
🖥 Introduction for to Windows kernel exploitation Explore the Windows Kernel with HEVD, a vulnerable driver. Dive into stack overflow exploits and bypass SMEP/KPTI protections using the sysret approach. A detailed guide for Windows kernel explotation: — Part 0: Where do I start? — Part 1: Will this driver ever crash? — Part 2: Is there a way to bypass kASLR, SMEP and KVA Shadow? — Part 3: Can we rop our way into triggering our shellcode? — Part 4: How do we write a shellcode to elevate privileges and gracefully return to userland? #windows #kernel #driver #hevd #hacksys

APT
APT
16 236
😎 Gigaproxy — One Proxy to Rule Them All If you’re looking for a powerful tool to help you bypass Web Application Firewalls (WAFs) during external penetration tests and bug bounty programs, you’re in the right place. Gigaproxy tool is designed to rotate IPs using mitmproxy, AWS API Gateway, and Lambda. Fireprox is great but has one major downside. You can only target a single host at a time. Gigaproxy solves this. 🔗 Research: https://www.sprocketsecurity.com/resources/gigaproxy 🔗 Source: https://github.com/Sprocket-Security/gigaproxy #ip #rotate #aws #api #gateway #proxy

APT
APT
16 236
💻 BIOS bootloader from scratch in ASM Dive into building a BIOS bootloader from scratch to boot an x86 CPU into 64-bit mode.
💻 BIOS bootloader from scratch in ASM Dive into building a BIOS bootloader from scratch to boot an x86 CPU into 64-bit mode. From ASM basics to integrating with C, unravel the complexities step-by-step. 🔗 Research: https://thasso.xyz/2024/07/13/setting-up-an-x86-cpu.html 🔗 Code: https://github.com/thass0/blog-code/tree/main/2024-07-13-setting-up-an-x86-cpu #bios #loader #asm #clang

APT
APT
16 236
Repost from RedTeam brazzers
Кросс-сессионная активация или захватываем сессию пользователя без RemotePotato0, TGSThief, mimikatz и Process Injection! Дав
Кросс-сессионная активация или захватываем сессию пользователя без RemotePotato0, TGSThief, mimikatz и Process Injection! Давным-давно я писал о способе злоупотребления интерфейсом IHxHelpPaneServer. Однако вы когда в последний раз использовали моникеры? И я давным-давно... Поэтому нужно было найти альтернативный способ исполнения кода в сессии другого пользователя, забыв про все техники внедрения. Если посмотреть на код RemotePotato0 или RemoteKrbRelay , то можно заметить использование недокументированных интерфейсов ISpecialSystemProperties и IStandartActivator. Причем не сказать, что их использование довольно редкое. Их можно встретить в любой программе, которая позволяет стащить учётные данные (имеет переключатель -session). Сами по себе, они позволяют контролировать сессию, в которой создавать COM-объект. Ранее мы ловили от них только аутентификацию, но что мешает соединить использование этих интерфейсов с описанным в SeMishaPrivilege COM-классом IHxHelpPaneServer? Конечно же ничего! И я написал небольшой POC, который выложил на GitHub . Если вам интересно подробно окунуться в принцип работы инструмента, то советую обратить внимание на нашу статью на medium :)

APT
APT
16 236
⚙️ Remote Session Enumeration The blog post explores how to enumerate remote user sessions on Windows using undocumented Wind
⚙️ Remote Session Enumeration The blog post explores how to enumerate remote user sessions on Windows using undocumented Windows APIs, specifically focusing on the implementation and usage of the WinStation API. 🔗 Research: https://0xv1n.github.io/posts/sessionenumeration/ 🔗 Source: https://github.com/0xv1n/RemoteSessionEnum/blob/main/main.cpp #windows #qwinsta #session #winapi #cpp

APT
APT
16 236
😈 dirDevil: Hiding Code and Content Within Folder Structures This article describes a method for hiding data within directory structures by using GUIDs in folder names to encode information. This approach bypasses antivirus and DLP systems since the data is stored in folder names rather than files, making it difficult to detect and analyze. 🔗 Research: https://trustedsec.com/blog/dirdevil-hiding-code-and-content-within-folder-structures 🔗 Source: https://github.com/nyxgeek/dirdevil #hide #code #folder #evasion

APT
APT
16 236
🖥 Windows KASLR bypass using prefetch side-channel A proof-of-concept tool for bypassing KASLR (kernel ASLR) on Windows 11.
🖥 Windows KASLR bypass using prefetch side-channel A proof-of-concept tool for bypassing KASLR (kernel ASLR) on Windows 11. Inspired by EntryBleed for Linux. This tool was developed as part of an exploit targetting Windows 11 24H2. CPU Support: — Intel: Reliable ✅ — AMD: Flaky ⚠️ 🔗 Research: https://exploits.forsale/24h2-nt-exploit/ 🔗 Source: https://github.com/exploits-forsale/prefetch-tool #windows11 #aslr #kaslr #research

APT
APT
16 236
🕷 ADSpider Tool for monitor Active Directory changes in real time without getting all objects. Instead of this it use replication metadata and Update Sequence Number (USN) to filter current properties of objects. 🔗 Research: https://habr.com/ru/companies/angarasecurity/articles/697938/ 🔗 Source: https://github.com/DrunkF0x/ADSpider ——— Наконец-то появилась на свет, а точнее в паблике, утилита ADSpider от моего горячо любимого @DrunkF0x. Ура-ура! 💃 #ad #windows #monitoring #tools

APT
APT
16 236
🖼️ Microsoft SharePoint Server 20219 — RCE PoC for: — CVE-2024-38094 — CVE-2024-38024 — CVE-2024-38023 🔗 Source: https://github.com/testanull/MS-SharePoint-July-Patch-RCE-PoC #sharepoint #poc #rce #cve

APT
APT
16 236
Repost from SecuriXy.kz
+1
🆕Все читали в новостях шумную новость про новый rockyou 2024🆕 https://cybernews.com/security/rockyou2024-largest-password-compilation-leak/ Мы его скачали, немного отфильтровали, а теперь делимся с Вами результатами 😎 ZIP-архив в 45 гигов в распакованном виде выдаёт текстовый файл размером 155 ГБ. При открытии с помощью less будет уведомление, что он выглядит как бинарный файл. В нём по какой-то причине добавлено приличное количество мусора... Вычистив его, получаем на выходе файл размером в 144 ГБ. Но даже в нём, достаточно бесполезных строк (Хотя если кому надо, можем выложить и его). Отфильтровали ещё немного, оставив только строки без пробелов длиной от 8 до 40 символов и вуаля - 25 гигабайт приемлемого вордлиста). Пользуйтесь 🔥

APT
APT
16 236
🔑 Dumping LSA: a story about task decorrelation Discover the art of bypassing EDRs by decorrelating attack tool behavior. Th
🔑 Dumping LSA: a story about task decorrelation Discover the art of bypassing EDRs by decorrelating attack tool behavior. This post explains the process of remote LSA secrets dumping and reveals techniques to retrieve a Windows computer's BOOTKEY without EDR detection. 🔗 Source: https://sensepost.com/blog/2024/dumping-lsa-secrets-a-story-about-task-decorrelation/ #lsa #sam #dump #edr #bypass

APT
APT
16 236
💻 VMware vCenter Server — Remote Code Execution (CVE-2024-22274) The vCenter Server contains an authenticated remote code execution vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell may exploit this issue to run arbitrary commands on the underlying operating system as the "root" user. 🔗 Source: https://github.com/mbadanoiu/CVE-2024-22275 #vmware #vcenter #rce #cve