Nostr notes by Joshua Small

All I'm going off is this blog suggesting it's the SAML ...

2026-10-04T11:40:46Z

In reply to nevent1q…8y6e
_________________________

All I'm going off is this blog suggesting it's the SAML endpoint

https://community.citrix.com/techzone-blogs/110_security-updates/security-update-guidance-for-netscaler-saml-authentication-deployments/

The write up says this is specific to SAML being enabled, so I ...

2026-10-04T11:32:25Z

In reply to nevent1q…yv75
_________________________

The write up says this is specific to SAML being enabled, so I suspect there's a saml related endpoint involved.

Yeah the big issue is the word "Documented". The worst of ...

2026-09-17T01:12:32Z

In reply to nevent1q…ac84
_________________________

Yeah the big issue is the word "Documented". The worst of Microsoft's bugs lately are documented on Reddit. Often with someone stating Microsoft have "acknowledged the issue" but only in a private support case with that person.

Then Micosoft has the "Release Dashboard" and each update documents "Known issues" and there's always a bunch of junk noone cares about while this stuff is undocumented.

Me when the BMS vendor says we need UAC disabled

2026-08-23T04:28:38Z

In reply to nevent1q…zwmz
_________________________

Me when the BMS vendor says we need UAC disabled

It's 2026 and on Windows Server 2025, attempting to create a ...

2026-08-13T06:09:54Z

It's 2026 and on Windows Server 2025, attempting to create a TLS certificate will default to a 1024 bit key and you have to find this menu and expand it to change it.

Also if your server is in Azure apparently you have to call their ...

2026-08-07T00:10:07Z

In reply to nevent1q…5wnh
_________________________

Also if your server is in Azure apparently you have to call their support to get it to apply.

Yep, if you download today's 3GB patch and the previous 3GB ...

2026-08-07T00:06:26Z

In reply to nevent1q…tp0t
_________________________

Yep, if you download today's 3GB patch and the previous 3GB patch, there is one .lua file different (and a bunch of files with version numbers). Looks like SSRF I guess.

Well I asked Claude to describe the diffs in the 3GB patches and ...

2026-08-06T23:58:38Z

In reply to nevent1q…wlfz
_________________________

Well I asked Claude to describe the diffs in the 3GB patches and it's entirely in a X-Forwarded-For header.

Oh an N-Able user I see.

2026-08-06T23:15:22Z

In reply to nevent1q…meps
_________________________

Oh an N-Able user I see.

Yeah I've responded to three Clickfix incidents from hacked ...

2026-07-21T21:52:42Z

In reply to nevent1q…msh7
_________________________

Yeah I've responded to three Clickfix incidents from hacked Wordpress sites just yesterday (for scale, my usual number is one a month) and somehow people are convinced this is a non event. I don't even know what's going on any more when the major intelligence agencies put out major alerts about "router hygiene" a few days ago are completely silent on this.

Yeah you can write a Conditional Access Policy to block a named ...

2026-07-01T00:04:10Z

In reply to nevent1q…c5jw
_________________________

Yeah you can write a Conditional Access Policy to block a named location. The big flaw is that it doesn't check CAP at all until password is verified - so it's still a viable password spray.

I just checked my M365 instance and there's literally ...

2026-06-30T23:58:15Z

In reply to nevent1q…nek3
_________________________

I just checked my M365 instance and there's literally thousands of hits per day, every day, from that IP range. Guess I'll go write an IP block rule.

Yeah, from my side, phishing tests are used so I can go to ...

2026-06-12T04:18:59Z

In reply to nevent1q…dmd5
_________________________

Yeah, from my side, phishing tests are used so I can go to management and say "The argument you don't need MFA because your employees are too smart to be phished is incorrect. In x% happily provided passwords on a test"". Individual user outcome doesn't matter.

Related issue I've seen: "I knew that email from ...

2026-06-11T22:35:11Z

In reply to nevent1q…3r2m
_________________________

Related issue I've seen: "I knew that email from theexecutiveceoofffice@gmail.com asking for VBucks gift cards was probably fake, but if I didn't do what it said and it turned out to be legit I'd be fired so...."

I will say though, this is underrated. The amount of ransomware ...

2026-06-11T22:32:52Z

In reply to nevent1q…rvms
_________________________

I will say though, this is underrated. The amount of ransomware I've seen accompanied with a "I knew that download was dodgy but didn't want to get in trouble" is pretty high.

I used to do this myself, regrettably anything doing "Message ...

2026-06-09T23:08:52Z

In reply to nevent1q…ydu3
_________________________

I used to do this myself, regrettably anything doing "Message Injection", (using the API to put it in your inbox instead of delivering mail with SMTP) bypasses Outlook policies.

Why document this "remove this entry" nonsense, why ...

2026-05-20T04:28:49Z

In reply to nevent1q…5vn4
_________________________

Why document this "remove this entry" nonsense, why wouldn't they provide a Powershell script that admins could just run without having to pick apart?

Huge round of applause for this response.

2025-11-13T21:31:37Z

In reply to nevent1q…6n4j
_________________________

Huge round of applause for this response.

Well done to this Redditor for explaining Remote Desktop. ...

2025-11-02T07:28:13Z

Well done to this Redditor for explaining Remote Desktop.

I like how you talk about this in the past tense as though I ...

2025-09-17T23:01:55Z

In reply to nevent1q…02eh
_________________________

I like how you talk about this in the past tense as though I don't use it on pentests today.

Interesting, the IOCs from support were totally different (look ...

2025-07-17T23:32:19Z

In reply to nevent1q…nsks
_________________________

Interesting, the IOCs from support were totally different (look for .php files in the web root).

What unholy mess is this? Do I need to install VS Code now to ...

2025-03-16T23:31:13Z

What unholy mess is this? Do I need to install VS Code now to edit a text file?

Nostr event nevent1qqsyzkum2rwmejmj8r2lww2w56x6uvtz4x8ax86ttz4gckqdp8vn80qzyzygywq5rt9elr0ft5a5we6lp7qmvdwv6l3hmlwtwx98vu7kfes0280d8vf

2025-02-21T11:53:08Z

In reply to nevent1q…a7hs
_________________________

Wait are they really? I'm having dreams of trading bots ...

2025-02-16T04:59:21Z

In reply to nevent1q…furp
_________________________

Wait are they really? I'm having dreams of trading bots people forgot about. Left to their own devices long enough to start improving their own algorithms, reaching AGI without anyone noticing..

You can't even patch a Fortigate :( ...

2025-02-12T02:00:37Z

In reply to nevent1q…l8cc
_________________________

You can't even patch a Fortigate :(

I like when everything got slower that night I upgraded the ...

2024-12-30T03:03:03Z

In reply to nevent1q…yur6
_________________________

I like when everything got slower that night I upgraded the servers.

(I got sick and did not do the upgrade)

<li>Get a phishing URL</li><li>Enter a fake ...

2024-10-30T22:50:42Z

<li>Get a phishing URL</li><li>Enter a fake password for a legitimate M365 account</li><li>Go look at the logs and see what IP address just tried to logon</li>Congrats, you just unmasked the real phishing host which almost certainly hid behind Cloudflare.