11 casos · pág. 1/1
TrustedSec (author Chris Camejo) explains that FCI and CUI safeguarding obligations do not exist during the pre-contract solicitation phase unless the contractor has agreed to a specific pre-contract agreement. Prime contractors, especially large DoD primes, are increasingly pushing CMMC, FAR 52.204-21 and DFARS 252.204-7012/7021 requirem…
TrustedSec has released a major update to SpooNMAP, its open-source wrapper that combines masscan for fast port discovery with Nmap for banner grabbing. The tool now runs context-aware NSE scripts against discovered services and writes severity-sorted findings (CRITICAL/HIGH/MEDIUM/LOW) to findings.txt, findings.md and findings.json, each…
TrustedSec researcher Lilly Mayo published waf-fu, an offensive tool that pulls AWS WAF log data into a local sqlite database and enables replay of logged requests. During an engagement, the author found WAF logs in CloudWatch that captured all headers unredacted, including session cookies and other authentication material, which can be r…
TrustedSec consultant Geoff Walton published an update to LLMHaxor, his Burp Suite plugin for testing LLM-enabled applications. The post is a tooling and practitioner-methodology update, not a threat or incident report. The main change is a new proxy that collects WebSocket streaming responses and exposes them to Burp Intruder as an HTTP …
TrustedSec published Part 1 of a red-team tradecraft series on what to do after finding plaintext AWS access keys during an engagement. It is educational content, not a report of a specific incident. It explains the difference between long-term AKIA keys (IAM user) and temporary ASIA keys (STS-issued, which also need a session token and a…
TrustedSec analyzed a multi-stage malware loader that starts as obfuscated Python bytecode (.pyc, CPython 3.13) and ends in an encrypted .NET payload. The chain layers Kramer Python obfuscation, two Donut shellcode layers and a laZzzy shellcode-loader PE, so a signature for any single format misses the others. The author unpacked it with …
TrustedSec published Part 1 of a three-part reference on changes to its open-source password-cracking orchestrator hatecrack since version 2.0 (February 2026). Since then there have been 101 releases and 781 commits, adding thirteen attacks, four submenus, a rewritten LLM integration and a scripted non-interactive mode. New attacks includ…
TrustedSec's Justin Bollinger describes HashcatRosetta, an open-source tool for password-cracking practitioners (part 2 of a 3-part series on hatecrack). It translates dense hashcat rule syntax into plain-English, step-by-step explanations. It also analyzes --debug-mode 4/5 output to show which rules, basewords and wordlists actually prod…
TrustedSec (author Brandon Colley) publishes practical guidance on building an effective logging, auditing, monitoring and alerting program for Active Directory (AD). It is based on recurring logging and auditing gaps found in the firm's AD assessments, where logging is treated as a switch to flip rather than a discipline owned by someone…
TrustedSec announced that it is joining the OpenAI Daybreak Defense Network. It plans to use OpenAI models in its consulting work through Daybreak Blue and, where approved, specialized cyber models through Daybreak Red. The planned uses cover red teaming, penetration testing, application and cloud security, purple teaming, research, threa…
TrustedSec's Justin Bollinger describes how a prek pre-push hook corrupted his git index on July 30. The resulting commit deleted 85,280 lines across about 165 files and staged gitignored, local-only paths (CLAUDE.md, .claude/, docs/plans/, docs/superpowers/). The commit reached the public trustedsec/hatecrack remote before it was force-p…
