#metasploit — Public Fediverse posts

CVE-2026-77806, a CVSS 9.8 SPIP unauthenticated RCE, is exploited in the wild. A public Metasploit module and full details are now available.

#CVE202677806 #SPIP #RCE #ExploitedInTheWild #Metasploit #CMS

https://securityonline.info/cve-2026-77806-spip-unauthenticated-rce/?utm_source=mastodon&utm_medium=jetpack_social

@schrotthaufen ten years ago there were like two or three dozen people who routinely published stuff like this on the weekly. it was so glorious. i remember sitting on freenode in the #metasploit channel and participating in late saturday night 'oh hey so i just pushed this to the dev branch of msf, who wants to help test?'. miss those days. twitter changed their policy and it all went underground

🛡️ METASPLOIT CHEAT SHEET

Metasploit is one of the most powerful and widely used penetration testing frameworks. 💻⚡ From exploit modules and payloads to auxiliary tools, sessions and post-exploitation, understanding its structure is an essential skill for security professionals.

This cheat sheet covers the core Metasploit concepts and commands you need to navigate the framework, configure modules and work efficiently inside msfconsole. 🔐🚀

⚠️ For cybersecurity education and authorized security testing only.

💬 Comment “METASPLOIT” if you want more cybersecurity cheat sheets.

#Metasploit #CyberSecurity #Pentesting #EthicalHacking #CyberKid

Книга: «The Ultimate Kali Linux Book: Использование Nmap, Metasploit, Aircrack-ng и Empire для пентестинга. 3-е изд.»

Привет, Хаброжители! Откройте для себя захватывающий мир Kali Linux — ведущей платформы для продвинутого тестирования на проникновение. Оттачивайте навыки, проводите сложные пентесты в корпоративных сетях — Kali Linux предоставляет специалистам по кибербезопасности все необходимые для этого инструменты. Наиболее полное руководство по этичному взлому и тестированию на проникновение в Kali Linux для новичков и профессионалов.

https://habr.com/ru/companies/piter/articles/1065340/

#kali_linux #nmap #metasploit #aircrackng #empire #пентестинг

Extract Kerberos tickets from Windows targets using Kiwi in Meterpreter. Load Mimikatz into LSASS memory, then use kerberos_ticket_list to enumerate and kerberos_ticket_use to import tickets. Works on Windows 10 and Server 2012+. #metasploit #kiwi #ValtersIT

https://www.valtersit.com/vault/postexploitation-kerberos-ticket-extraction-with-kiwi-93b8d8/

The new #BashCore CLI build is ready! ✨

​Integrated OpenCode AI directly into the terminal. Tested it by letting the agent autonomously run #nmap and #Metasploit modules to pentest my custom hardware VPN gateway. It delivered a full security audit in seconds using minimal tokens.

​Looking back to a few years ago when I was just moving my first steps in cybersecurity and custom distros, seeing this architecture work feels amazing 🫠

​Uploading to the site soon!

​ #AI #Infosec #Privacy #Linux

New blog post!

I recently completed the OffSec Expert Penetration Tester (OSEP) certificate.

Here are my thoughts on it:

https://ti-kallisti.com/infosec/certs/osep.html

#InfoSec #RedTeam #RedTeaming #EDR #Offsec #Metasploit

Как наказать цифрового воробья или как я проходил таск PigeonsRevenge от платформы ACLabs.pro

Данный таск был частью 5 сезона CTF, который проходил на площадке ACLabs. Машина необычная с увлекательным сюжетом и интересными уязвимостями. Условие задачи: Борис — старый почтовый голубь. Катя, его голубка, улетела к наглому Воробью. Три дня Борис пил дешёвое пойло и строчил план мести. Теперь этот план у тебя. Помоги Борису пробраться в цифровое гнездо Воробья, украсть его аккаунт и стать рутом. Следуй за пьяными записками — там всё сказано и даже больше. Внимание, стенд будет полностью готов только по истечении обратного времени отсчета, даже если адрес появился раньше! Цепочка атаки Атакующая цепочка «PigeonsRevenge» комбинирует одну реальную критическую CVE (Webmin 1.910 — CVE-2019-15107, 9.8 CRITICAL) с набором классических техник ATT&CK : активная разведка → port knocking → эксплуатация публичного приложения → Metasploit reverse-shell → туннелирование Ligolo-ng → инъекция через переменную окружения в кастомный бинарник → обход фильтра табуляцией → закрепление с root -привилегиями.

https://habr.com/ru/articles/1024360/

#nmap #bash #docker #ssh #ghidra #cve #webmin #metasploit #privelege_escalation #pivoting

Metasploit Framework is here with 5 new modules! Exploits for FreeScout (CVE-2026-28289) and Grav CMS (CVE-2025-50286) RCEs, plus a generic HTTP command execution module and a new Windows persistence technique. We also have a slew of bug fixes and enhancements including SOCKS proxy performance improvements #Metasploit https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-04-03-2026/1

The latest #Metasploit Wrapup is here! 🎉 This week brings enhanced SMB NTLM relaying for better client compatibility (including smbclient), plus new modules for RCE in Eclipse Che (CVE-2025-12548), Barracuda ESG command injection (CVE-2023-2868), and an ESC/POS printer injector.

Check it out at https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-03-27-2026/

No bad luck here! 🍀 The Metasploit weekly wrapup is live with 3 new modules: LeakIX Search, Linux RC4 payload packer, and an unauthenticated RCE for SPIP Saisies (CVE-2025-71243). Plus, check out Metasploit Pro 5.0.0!

Read the full details: https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-03-13-2026/ #Metasploit

Encoder exposed! 💥 Get the details on the latest Metasploit Framework release: new encoder options for better payload control, fresh RCE exploits (Tactical RMM SSTI, MajorDoMo), and Linux RC4 Packer for in-memory execution. Read the full wrap-up: https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-03-06-2026/ #Metasploit

Lateral movement w Active Directory z wykorzystaniem WinRM

Lateral movement (często tłumaczony jako ruch boczny) w środowiskach Active Directory bardzo rzadko opiera się na podatnościach w rozumieniu tych dostępnych w ramach bazy CVE. W praktyce znacznie częściej jest to konsekwencja nadużycia wbudowanych mechanizmów administracyjnych, które zostały zaprojektowane z myślą o automatyzacji i zdalnym zarządzaniu systemami z rodziny Windows....

#Teksty #Metasploit #Mimikatz #Netsec #Poradnik #Powershell #Winrm

https://sekurak.pl/lateral-movement-w-active-directory-z-wykorzystaniem-winrm/

Stop reading theory without results.

This bundle combines the Master #Hacker ebook with hands-on video walkthroughs that turn recon, #Metasploit exploitation, AV evasion, and #Python #scripting into practical skills you can deploy immediately:

https://hackersarise.thinkific.com/bundles/master-hacker-bundle
#cybersecurity #infosec

Metasploit erweitert Arsenal mit sieben neuen Exploit-Modulen

FreePBX-Module kombinieren Authentifizierungsumgehung mit Code-Ausführung

https://www.all-about-security.de/metasploit-erweitert-arsenal-mit-sieben-neuen-exploit-modulen/

#metasploit #freepbx

Recently fixed HPE OneView flaw is being exploited (CVE-2025-37164) https://www.helpnetsecurity.com/2026/01/08/hpe-oneview-cve-2025-37164-exploited/ #securityupdate #vulnerability #datacenter #Metasploit #Don'tmiss #Hotstuff #Rapid7 #News #CISA #HPE

I was working on the new BashCore build when the process suddenly failed because the Metasploit #APT #repository returned a “file has unexpected size” error... 😳😩🤔

Seems like a temporary #checksum #mismatch during #mirror #sync, hopefully nothing serious. Rebuilding now to see if it’s fixed.

#BashCore #Debian #Metasploit #LiveBuild #LinuxDev #FOSS

🚀 Beginner’s Guide to Penetration Testing — Start Your Ethical Hacking Journey

Learn the five core phases of a pentest (recon → scanning → gaining access → post-exploitation → reporting), the essential tools you’ll use, and the ethical mindset to practice safely and legally. Perfect for beginners who want a practical, hands-on path into cybersecurity. 🛡️🧭

#penetrationtesting #ethicalhacking #cybersecurity #Infosec #pentest #BeginnerGuide #KaliLinux #Nmap #Metasploit #HackingTools #SecurityTesting #WhiteHat #AxximumInfoSolutions

🐉 Top 10 Kali Linux Tools — Essential Picks

Quick list of 10 widely-used Kali tools for recon, web testing, exploitation, and forensics — use only in labs or with explicit permission. ⚡🛡️

#KaliLinux #PenTesting #InfoSec #EthicalHacking #Nmap #Wireshark #Metasploit #BurpSuite #Hashcat #Forensics

Having some trouble updating BashCore on bookworm before it fades into oblivion.

Planning to release both BashCore and BashCoreX with kernel 6.1 and the very last updates (Metasploit is giving me headaches).

The fun part? I’m using BashCoreTX via SSH into BashCore for debugging, all running on VirtualBox.

#BashCore #Linux #Debian #Metasploit #Bookworm #SSH #Virtualbox #Trixie

Используем Python и metasploit для автоматизации рутинных задач эксплуатации

Эксплуатация уязвимостей — это не обязательно тысяча ручных шагов. Особенно, если есть Python и Metasploit. В этой статье я расскажу, как автоматизировать атаку и постэксплуатацию так, чтобы всё работало, а вы — отдыхали.

https://habr.com/ru/companies/pm/articles/934088/

#python_3 #python #metasploit #nuclei #шаблонизаторы #информационная_безопасность #автоматизация #автоматизация_тестирования #zimbra

#openBSD
#VulnHUB
#MatrixBreakOut
#mitmproxy
#metasploit
#infosec

🎯 NOW PUBLISHING: On-Location Coverage from #BlackHatUSA 2025!

We're back in the office and excited to start sharing all the conversations we captured on location in Las Vegas with our amazing sponsors and editorial coverage!

🔔 Follow ITSPmagazine, Sean Martin, CISSP, and Marco Ciappelli to get this content fresh as it drops!

We're honored to share this eye-opening Brand Story conversation thanks to our friends at runZero 🙏

The Often-Overlooked Truth in #Cybersecurity: Seeing the Unseen in Vulnerability Management

Most successful breaches don't happen because defenders ignored known vulnerabilities. They happen because attackers exploited assets that organizations never knew existed.

HD‏​​​​​​​​​​‏ ⁢​​​​Moore, founder and CEO of runZero and creator of #Metasploit, reveals the uncomfortable truth: organizations routinely miss half their actual attack surface. Through decades of penetration testing high-security environments, Moore discovered that traditional discovery methods only find properly managed systems while #shadowIT, legacy hardware, and misconfigured devices remain invisible.

Key insights from our conversation:

• When using attacker-grade discovery techniques, asset counts typically DOUBLE what organizations thought they had

• The industry's CVE obsession creates false security while real attacks exploit misconfigurations and zero-days

• Unknown assets—from IoT devices to forgotten servers—bypass even sophisticated security controls

• Traditional agent-based tools can't see what attackers see

#RunZero inverts the traditional model by starting with unauthenticated discovery that mirrors how attackers actually probe networks. This reveals the true attack surface and transforms vulnerability management from reactive patching to strategic risk reduction.

📺 Watch the video: https://youtu.be/hkKJsKUugIU

🎧 Listen to the podcast: https://brand-stories-podcast.simplecast.com/episodes/the-often-overlooked-truth-in-cybersecurity-seeing-the-unseen-in-vulnerability-management-a-brand-story-with-hd-moore-founder-and-ceo-of-runzero-a-black-hat-usa-2025-conference-on-location-brand-story-bM0PrkAw 📖 Read the blog: https://www.itspmagazine.com/their-stories/the-often-overlooked-truth-in-cybersecurity-seeing-the-unseen-in-vulnerability-management-a-brand-story-with-hd-moore-founder-and-ceo-of-runzero-a-black-hat-usa-2025-conference-on-location-brand-story

➤ Learn more about RunZero: https://itspm.ag/runzero-5733

✦ Catch more stories from RunZero: https://www.itspmagazine.com/directory/runzero

🎪 Follow all of our #BHUSA 2025 coverage: https://www.itspmagazine.com/bhusa25

#Cybersecurity #VulnerabilityManagement #AssetDiscovery #AttackSurface #BlackHatUSA #BHUSA25 #ShadowIT #SecurityVisibility #Metasploit #ZeroDay #tech #technology #cybersecurity

Metasploit on BashCoreT: LoadError - cannot load such file: parallel.

Translation: “Nice build you have there… shame if something happened to it.” 😅

Time to tear it down and start over...

#BashCoreT #Linux #Pentesting #Metasploit #DevLife

@stux heh, yeah the msf folks are pretty fast :D

years ago i used to chill in #metasploit on freenode with them all and it was super awesome to be part of the discussion when a new thing landed.

it was SUPER SUPER COMMON for some crazy bullshit vuln to land at like 9pm on a friday night, and we'd spend all weekend screwing around making payloads.

the good ol days :D

Oh wow, someone already made #Metasploit modules that target CVE-2025-53770 and CVE-2025-53771 in the recent #SharePoint 0-Day vulnerabilities

Testing #BashCore #Injector on the worst laptop alive:
💻 Acer Aspire One D160 (2009) – Atom 450, 2GB RAM.

Ubuntu Server + Injector = full CLI pentesting kit:
🔎 #nmap #amass #dirb
💥 #hydra #sqlmap #metasploit
🕸️ #tshark #proxychains4 #tor
🛠️ #vim #curl #python3 #R + more.

Let’s see if this relic can still hack it 🤟🤞

#bashcore #ubuntu #lowend #pentesting #linux #cli #bashcoreinjector