Joshua Small

Website: https://lolware.net/
Github: https://github.com/technion/
Age Key: https://lolware.net/age.txt

Public Key

npub13zprs9q6ew0cm62a8drkwhc0sxmrtnxhud7lmjm33fm884jwvr6s29wqhj

NIP-05 Address

Profile Code

nprofile1qqsg3q3czsdvh8uda9wnk3m8tu8crd34ent7xl0aedcc5ann6e8xpagprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntqy8hwumn8ghj7mn0wd68ytnddaksqdhka5

Publishing to

relay.momostr.pink

nostr.mom

nos.lol

Author Public Key

npub13zprs9q6ew0cm62a8drkwhc0sxmrtnxhud7lmjm33fm884jwvr6s29wqhj

Show more details

Last Notes

2026-10-04 11:40:46 UTC

- reply

All I'm going off is this blog suggesting it's the SAML endpoint
https://community.citrix.com/techzone-blogs/110_security-updates/security-update-guidance-for-netscaler-saml-authentication-deployments/

2026-10-04 11:32:25 UTC

- reply

The write up says this is specific to SAML being enabled, so I suspect there's a saml related endpoint involved.

2026-09-17 01:12:32 UTC

- reply

Yeah the big issue is the word "Documented". The worst of Microsoft's bugs lately are documented on Reddit. Often with someone stating Microsoft have "acknowledged the issue" but only in a private support case with that person.
Then Micosoft has the "Release Dashboard" and each update documents "Known issues" and there's always a bunch of junk noone cares about while this stuff is undocumented.

2026-08-23 04:28:38 UTC

- reply

Me when the BMS vendor says we need UAC disabled

2026-08-13 06:09:54 UTC

It's 2026 and on Windows Server 2025, attempting to create a TLS certificate will default to a 1024 bit key and you have to find this menu and expand it to change it.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/086/708/003/174/292/original/6db6751c7a6c5956.png

2026-08-07 00:10:07 UTC

- reply

Also if your server is in Azure apparently you have to call their support to get it to apply.

2026-08-07 00:06:26 UTC

- reply

Yep, if you download today's 3GB patch and the previous 3GB patch, there is one .lua file different (and a bunch of files with version numbers). Looks like SSRF I guess.

2026-08-06 23:58:38 UTC

- reply

Well I asked Claude to describe the diffs in the 3GB patches and it's entirely in a X-Forwarded-For header.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/051/269/282/209/976/original/fac88acd12c52083.png

2026-08-06 23:15:22 UTC

- reply

Oh an N-Able user I see.

2026-07-21 21:52:42 UTC

- reply

Yeah I've responded to three Clickfix incidents from hacked Wordpress sites just yesterday (for scale, my usual number is one a month) and somehow people are convinced this is a non event. I don't even know what's going on any more when the major intelligence agencies put out major alerts about "router hygiene" a few days ago are completely silent on this.

2026-07-01 00:04:10 UTC

- reply

Yeah you can write a Conditional Access Policy to block a named location. The big flaw is that it doesn't check CAP at all until password is verified - so it's still a viable password spray.

2026-06-30 23:58:15 UTC

- reply

I just checked my M365 instance and there's literally thousands of hits per day, every day, from that IP range. Guess I'll go write an IP block rule.

2026-06-12 04:18:59 UTC

- reply

Yeah, from my side, phishing tests are used so I can go to management and say "The argument you don't need MFA because your employees are too smart to be phished is incorrect. In x% happily provided passwords on a test"". Individual user outcome doesn't matter.

2026-06-11 22:35:11 UTC

- reply

Related issue I've seen: "I knew that email from theexecutiveceoofffice@gmail.com asking for VBucks gift cards was probably fake, but if I didn't do what it said and it turned out to be legit I'd be fired so...."

2026-06-11 22:32:52 UTC

- reply

I will say though, this is underrated. The amount of ransomware I've seen accompanied with a "I knew that download was dodgy but didn't want to get in trouble" is pretty high.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/733/847/362/668/045/original/1f476a455a219a6b.png

2026-06-09 23:08:52 UTC

- reply

I used to do this myself, regrettably anything doing "Message Injection", (using the API to put it in your inbox instead of delivering mail with SMTP) bypasses Outlook policies.

2026-05-20 04:28:49 UTC

- reply

Why document this "remove this entry" nonsense, why wouldn't they provide a Powershell script that admins could just run without having to pick apart?

2025-11-13 21:31:37 UTC

- reply

Huge round of applause for this response.

2025-11-02 07:28:13 UTC

Well done to this Redditor for explaining Remote Desktop.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/478/919/910/177/491/original/a1740f2b8def76f1.png

2025-09-17 23:01:55 UTC

- reply

I like how you talk about this in the past tense as though I don't use it on pentests today.

2025-07-17 23:32:19 UTC

- reply

Interesting, the IOCs from support were totally different (look for .php files in the web root).

2025-03-16 23:31:13 UTC

What unholy mess is this? Do I need to install VS Code now to edit a text file?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/174/707/717/869/360/original/3ec45eb412945fed.png

2025-02-21 11:53:08 UTC

- reply

https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/041/734/695/069/082/original/f56d4765f2880b99.png

2025-02-16 04:59:21 UTC

- reply

Wait are they really? I'm having dreams of trading bots people forgot about. Left to their own devices long enough to start improving their own algorithms, reaching AGI without anyone noticing..

2025-02-12 02:00:37 UTC

- reply

You can't even patch a Fortigate :(
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/988/443/457/634/073/original/c867163ef08a7b14.png

2024-12-30 03:03:03 UTC

- reply

I like when everything got slower that night I upgraded the servers.
(I got sick and did not do the upgrade)

2024-10-30 22:50:42 UTC

<li>Get a phishing URL</li><li>Enter a fake password for a legitimate M365 account</li><li>Go look at the logs and see what IP address just tried to logon</li>Congrats, you just unmasked the real phishing host which almost certainly hid behind Cloudflare.