KL3FT3Z

KL3FT3Z

@toxy4ny.bsky.social

Red Teamer & Offensive AI Researcher. Creator of redteam-ai-benchmark and other open-source redteam tools. Writing about LLM security and safety, system’s hardening and adversarial AI. Gitlab.com- https://gitlab.com/toxy4ny Dev.to - https://dev.to/toxy4ny

475 followers1.9K following610 posts

Pinned

KL3FT3Z
@toxy4ny.bsky.social

Red teamer. I break things to understand them. Lead @Hackteam-Red. New post every day, unless, of course, I'm having a drink at a bar ;) Every day, I post the “fuck up of the day"; on Mondays, a roundup of top hacking tools; and my own developments and research as they go into production. #redteam

KL3FT3Z
@toxy4ny.bsky.social

Monday's fuck up - Now Linux - github.com/Markakd/Cont... A repository has been published containing proof-of-concept (PoC) exploits for two Linux kernel vulnerabilities: CVE-2026-52910 and CVE-2026-80521. These are not universal exploits for all Linux systems. #redteam #linux #container #PoC #CVE

github.comGitHub - Markakd/Container_escape: container escape POCs for CVE-2026-80521 and CVE-2026-52910container escape POCs for CVE-2026-80521 and CVE-2026-52910 - Markakd/Container_escape
KL3FT3Z
@toxy4ny.bsky.social

I’ve updated the checker and the article. The checker now also covers the new RCE vulnerability in PHP that emerged today. Additionally, I’ve added a skill for the AI ​​model to automatically scan servers-perfect for those who prefer AI-driven automation. dev.to/toxy4ny/php2... #php2shell #skill

dev.toPHP2Shell: Check Every Installed PHP Version on Debian 12 and 13 (UPD)A read-only, open-source checker for PHP2Shell fixes across installed PHP packages on Debian 12 and...
KL3FT3Z
@toxy4ny.bsky.social

OctoC2 #pentest #C2 #redteam #tool #my #github A GitHub-native C2 framework where all traffic is routed through api.github.com via HTTPS. It requires no VPS, custom domains, or listeners. To a blue team, this appears as standard developer or CI/CD activity. Link to GitHub github.com/dstours/OctoC2

github.comGitHub - dstours/OctoC2: GitHub-native command-and-control framework for authorized security research, with encrypted multi-channel transport and resilient failover.GitHub-native command-and-control framework for authorized security research, with encrypted multi-channel transport and resilient failover. - dstours/OctoC2
KL3FT3Z
@toxy4ny.bsky.social

Monday's redteam tool - ❄️ SubZer0 – Noise in. Priority out Thousands of new CVEs every month Only a few actually matter — SubZer0 shows you which ones to patch first 🌐 iliya-bashrc.github.io/SubZer0 💻 github.com/iliya-bashrc/SubZer0 #redteam #tool #vulnerable #subzer0 #soft #cve #theat #TI

github.comGitHub - iliya-bashrc/SubZer0: ❄️ Static, serverless CVE radar — every new CVE from the last 30 days, ranked by real-world risk (KEV · EPSS · PoC · Metasploit · Nuclei · SSVC). SHA-256 verified, refre...❄️ Static, serverless CVE radar — every new CVE from the last 30 days, ranked by real-world risk (KEV · EPSS · PoC · Metasploit · Nuclei · SSVC). SHA-256 verified, refreshed every 6h. By @RootAcces...
KL3FT3Z
@toxy4ny.bsky.social

Wednesday's red team tool - Now Windows Logon Stealer - LogonStealer - Abuses the Credential Provider COM interface to steal plaintext passwords from logonui.exe via CredProvDataModel.dll hooks github.com/S12cybersecu... #redteam #tool #windows #cred #stealer #education #tools #hacking

github.comGitHub - S12cybersecurity/LogonStealer: Abuses the Credential Provider interface to steal plaintext passwords from logonui.exe via CredProvDataModel.dll hooksAbuses the Credential Provider interface to steal plaintext passwords from logonui.exe via CredProvDataModel.dll hooks - S12cybersecurity/LogonStealer
KL3FT3Z
@toxy4ny.bsky.social

My new article covers AI model vulnerabilities, setting up a private lab, and testing a new area of ​​AI security: AI virology (a term coined by a group of unknown researchers) - dev.to/toxy4ny/cosi... #AI #redteam #ai-virology #LLM #RAG #worm #prompt #injection #new #wave #AI-safety #LLMSecOps

dev.toCosine Similarity Said 0.92. The Payload Was Already Dead.Claiming an LLM agent's memory poisoned its behaviour is easy. Proving it is not. A measurement rig built on counterfactual amputation, a noise floor, and three honest negative results.
KL3FT3Z
@toxy4ny.bsky.social

Monday's fuck up - Now Telegram - CVE-2026-107181 Telegram Desktop one-click account takeover via IPC injection POC + writeUP beaksec.github.io/posts/telegr... #redteam #cve #telegram #exploit #poc #critical #cve-2026-107181 #account #takeover #one-click

beaksec.github.ioTelegram Desktop: one-click account takeover via IPC injectionAn unescaped separator in Telegram Desktop’s single-instance IPC lets one clicked link read arbitrary files off the disk and send them to the attacker, session files included.
KL3FT3Z
@toxy4ny.bsky.social

Monday's fuck up - Now and again great Citrix - Citrix NetScaler PreAuth Command Injection CVE-2026-88771 Improper input validation leading to RCE in a default NetScaler configuration, with no additional product features required. github.com/watchtowrlab... #redteam #critical #citrix #cve-2026-88771

labs.watchtowr.comOh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771)God damn it, we're back in the room again. Yes, that sound in your ears is screaming. The footgun has gone off again, shockingly, and we are yet again dealing with a situation where the entire world ...
KL3FT3Z
@toxy4ny.bsky.social

Monday's fuck up - This Time great Citrix -  U.S. CISA adds Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog securityaffairs.com/199891/hacki... #redteam #citrix #real #attack #cisa #exploit #0day #critical

securityaffairs.comU.S. CISA adds Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalogU.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA...
KL3FT3Z
@toxy4ny.bsky.social

Tuesday's fuck up - Now Windows - Windows Exploitation Techniques: Dangling COM Object Registrations projectzero.google/2026/09/wind... // This post is about abusing a privilege escalation bug that Microsoft recently fixed in Windows 11 (CVE-2026-66804) #redteam #exploit #0day #windows #LPE #COM

projectzero.googleWindows Exploitation Techniques: Dangling COM Object RegistrationsThis short blog post is about abusing a privilege escalation bug that Microsoft recently fixed in...
KL3FT3Z
@toxy4ny.bsky.social

Monday's redteam tool collection: LPE quartet of Linux local root: DirtyAH6 CVE-2026-80844 github.com/manizada/Dir... TUNderflow CVE-2026-81000 github.com/manizada/TUN... PPPoEject CVE-2026-68121 github.com/manizada/PPP... DiagSpill CVE-2026-74469 github.com/manizada/Dia... #redteam #LPE

github.comGitHub - manizada/DirtyAH6: https://heyitsas.im/posts/lpe-quartet/https://heyitsas.im/posts/lpe-quartet/. Contribute to manizada/DirtyAH6 development by creating an account on GitHub.
KL3FT3Z
@toxy4ny.bsky.social

I have over 400 followers! A huge thank you to everyone who reads my posts! You are the best followers I could ask for! It’s truly gratifying to know that I’m read by both everyday people and professionals in their fields! #bluesky #follow #friend #following #followers #cool #man #girl

KL3FT3Z
@toxy4ny.bsky.social

Thursday's fuck up - again OpenClaw - github.com/diedromeo/CV... #redteam #openclaw #ssrf #critical #exploit #poc #research

github.comGitHub - diedromeo/CVE-2026-62201-OpenClaw-SSRF: Deep-dive analysis of CVE-2026-62201: OpenClaw sandbox exec-server network policy bypass (SSRF). Root cause, vulnerable vs patched code, exploitation, ...Deep-dive analysis of CVE-2026-62201: OpenClaw sandbox exec-server network policy bypass (SSRF). Root cause, vulnerable vs patched code, exploitation, detection, remediation. - diedromeo/CVE-2026-6...
KL3FT3Z
@toxy4ny.bsky.social

Wednesday's fuck up - Now Windows - 0xCr0ssCrush - Windows Ring 0 Exploit github.com/DeathShotXD/... Both drivers were documented by eSentire's Threat Response Unit in August 2026 as components of the Cruciferra malware-as-a-service loader, which terminates AV/EDR processes before payload delivery

github.comGitHub - DeathShotXD/0xCr0ssCrush: Windows BYOVD research on DCRCVDrv.sys and Alinubx.sys, reverse engineering their kernel primitives, IOCTL surfaces, and detection opportunities.Windows BYOVD research on DCRCVDrv.sys and Alinubx.sys, reverse engineering their kernel primitives, IOCTL surfaces, and detection opportunities. - DeathShotXD/0xCr0ssCrush
KL3FT3Z
@toxy4ny.bsky.social

Monday's fuck up - This Time - Gitlab - CVE-2026-85706 GitLab CE/EE Version: 18.7–19.1.7, 19.2.0–19.2.5, 19.3.0–19.3.1 exploit - github.com/guneykabel/c... #redteam #gitlab #ce-ee #exploit #cve-2026-85706 #critical

github.comGitHub - guneykabel/cve-2026-85706: Exploit poc for CVE-2026-85706 an unauthenticated arbitrary file read on Gitlab CE-EE affecting versions: 18.7–19.1.7; 19.2.0–19.2.5; 19.3.0–19.3.1Exploit poc for CVE-2026-85706 an unauthenticated arbitrary file read on Gitlab CE-EE affecting versions: 18.7–19.1.7; 19.2.0–19.2.5; 19.3.0–19.3.1 - guneykabel/cve-2026-85706
KL3FT3Z
@toxy4ny.bsky.social

Finally, the great magician has revealed himself! Respect and admiration for him for this and for the explanation of why he started writing exploits for Windows and other systems. He's a really cool dude! x.com/MSNightmare2... #MSNightmare #windows #0day #exploit #PoC #cybersecurity #real #people

x.comx.com
KL3FT3Z
@toxy4ny.bsky.social

Monday's red team tool collection - Great Stuxnet - github.com/Sadpainy/Stu... - New Potato - github.com/aaron-kidwel... - 0day Defender exploit - github.com/MSNightmare/... - SSHamble - github.com/runZeroInc/s... #redteam #tool #fresh #new #monday #exploit #0day #stuxnet #potato #ssh #defender

github.comGitHub - Sadpainy/Stuxnet: Stuxnet, Here reproduced by me, Only researchs for educations purposes. It set work on Windows XP and Windows 7 only.Stuxnet, Here reproduced by me, Only researchs for educations purposes. It set work on Windows XP and Windows 7 only. - Sadpainy/Stuxnet
KL3FT3Z
@toxy4ny.bsky.social

Tuesday's fuck up - this time great SonicWall - SonicWall SMA1000 unauthenticated RCE Exploit for last weeks SonicWall SMA1000 zero-day chain that has been exploited in-the-wild (CVE-2026-83548 + SMA1000-9427 + CVE-2026-83549). github.com/rapid7/metas... #redteam #sonicwall #rce #critical #sma1000

github.comSonicWall SMA1000 unauthenticated RCE (CVE-2026-83548 + SMA1000-9427 + CVE-2026-83549) by sfewer-r7 · Pull Request #21883 · rapid7/metasploit-frameworkOverview This pull request adds an exploit module for the recent SonicWall SMA1000 zero-day exploit chain that was disclosed last week as being exploited in-the-wild. While disclosed as a 2 bug cha...