psychsecurity

https://medium.com/@psychsecurity/mfa-phishing-using-novnc-and-aws-ebc781b4d093
https://mrd0x.com/browser-in-the-browser-phishing-attack/
https://github.com/kgretzky/evilginx2
https://webauthn.io
https://developer.apple.com/passkeys/
https://www.bleepingcomputer.com/news/security/evilproxy-phishing-campaign-targets-120-000-microsoft-365-users/

psychsecurity

https://github.com/psychsecurity/macUp

https://github.com/breakpointHQ/TCC-ClickJacking

https://www.sentinelone.com/labs/bypassing-macos-tcc-user-privacy-protections-by-accident-and-design/

https://www.rainforestqa.com/blog/macos-tcc-db-deep-dive

https://www.trustedsec.com/blog/macos-injection-via-third-party-frameworks/

psychsecurity

#!/usr/bin/python

# Invoke-Kerberoast output hash extractor.
#
# For when you have:
#    TicketByteHexStream  :
#    Hash                 : $krb5tgs$23$*sqlSvc$Adomain.com$MSSQLSvc/sqlserver.Adomain.com:1433*$C13BFD40143C0E
#                           ....
#    SamAccountName       : sqlSvc
#    DistinguishedName    : CN=sqlSvc,OU=ServiceAccounts,DC=Adomain,DC=com

psychsecurity

import java.io.IOException;
import java.io.InputStream;
import java.lang.ref.WeakReference;
import java.security.cert.CertificateEncodingException;
import java.util.Enumeration;
import java.util.jar.JarEntry;
import java.util.jar.JarFile;
import java.util.logging.Level;
import java.util.logging.Logger;