Felipe Molina
LightNews LightNews
banner
felmoltor.me
Felipe Molina
@felmoltor.me
93 followers 210 following 68 posts
Mastodon felmoltor@defcon.social. Now with more #OSCP than the previous version. Working @SensePost.com - Orange Cyberdefense

https://blog.felipemolina.com/
Posts Replies Media Videos
Reposted by Felipe Molina
agreenberg.bsky.social
A source shares some screenshots of the Lapsus ransomware gang celebrating the government shutdown as a disruption to the FBI investigations tracking them.

They also refer to Trump as "my king."
October 1, 2025 at 3:07 PM
felmoltor.me
Maybe it's my fault, but I'm really missing non-US related content in Bluesky. Can we talk about other countries, please?
I don't want to go back to X 😢 🙏🏼
September 11, 2025 at 9:22 AM
Reposted by Felipe Molina
leonjza.bsky.social
If you're at RomHack at the end of the month, come tell me your @github.com username and I'll give you early access to the @sensepost.com tool repo for PipeTap at the con! 🙃

Below is a demo of the proxy in action.

www.youtube.com/watch?v=or8Y...
PipeTap WIP Demo
YouTube video by Leon Jacobs
www.youtube.com
September 10, 2025 at 1:41 PM
Reposted by Felipe Molina
leonjza.bsky.social
I've been hacking on a new Windows Named Pipe tool called PipeTap which helps analyse named pipe communications. Born out of necessity while doing some vulnerability research on a target, its been super useful in reversing it's fairly complex protocol. :)
The proxy view for PipeTap, a Windows Named Pipe Analysis Tool
September 10, 2025 at 1:41 PM
Reposted by Felipe Molina
nfknanna.bsky.social
One of the pools in the Alhambra Palace complex in Granada.... had to be this one for #PalacesandGardens #Water #photography #dailyphoto #travel #Spain
Three sides of a sand-coloured building surrounding a rectangular pool. The pool is edged by a low hedge and the water reflects the surrounding buildings and the blue sky above. In the foreground water trickles down into the pool from a smaller circular stone pool. The building at the far end has a carved, arched verandah and sits below a square tower. People stroll along the sides of the building.
September 4, 2025 at 8:23 PM
Reposted by Felipe Molina
sensepost.com
Reverse engineering Microsoft’s SQLCMD.exe to implement Channel Binding support for MSSQL into Impacket’s mssqlclient.py. Storytime from Aurelien (@Defte_ on the bird site), including instructions for reproducing the test environment yourself.

sensepost.com/blog/2025/a-...
A screenshot of two windows. The top is a view of the Microsoft SQL management GUI showing that “Extended Protection” is enabled for NTLM authentication. The bottom is a terminal showing an invocation of Impacket’s mssqlclient.py successfully connecting using channel binding.
July 31, 2025 at 4:19 PM
Reposted by Felipe Molina
cloudflare.social
From June 2025 through July 2025, the Cloudflare Email Security team has been tracking a cluster of cybercriminal threat activity leveraging Proofpoint and Intermedia link wrapping to mask phishing payloads. Read more: cfl.re/4lUXBEE
Attackers abusing Proofpoint & Intermedia link wrapping to deliver phishing payloads
Attackers are exploiting Proofpoint and Intermedia link wrapping to mask phishing payloads.
cfl.re
July 30, 2025 at 1:54 PM
Reposted by Felipe Molina
campuscodi.risky.biz
There's an ongoing npm supply chain attack taking place:

socket.dev/blog/npm-phi...

x.com/AikidoSecuri...
Active Supply Chain Attack: npm Phishing Campaign Leads to P...
Popular npm packages like eslint-config-prettier were compromised after a phishing attack stole a maintainer’s token, spreading malicious updates.
socket.dev
July 19, 2025 at 11:53 AM
felmoltor.me
I've created a pull request to detect CitrixBleed 2 into Burp's Bcheck repository: github.com/PortSwigger/...
CVE-2025-5777 - CitrixBleed 2 by felmoltor · Pull Request #253 · PortSwigger/BChecks
BCheck Contributions BCheck compiles and executes as expected BCheck contains appropriate metadata (name, version, author, description and appropriate tags) Only .bcheck files have been added o...
github.com
July 17, 2025 at 6:37 AM
felmoltor.me
I wrote a tool to detect orphan scripts at a scale using Scrapy as its foundation: JsJack.

Finding vulnerabilities in high-volume traffic sites was more challenging than I initially expected, but I learned many other things from this experience: blog.felipemolina.com/posts/jsjack/
JsJack
A tool to find orphan scrips and two interesting cases
blog.felipemolina.com
July 14, 2025 at 11:15 AM
Reposted by Felipe Molina
taggart-tech.com
Oh neato, a 13 year-old vuln in

(checks notes)

all US trains that allowed anyone to control the brakes?

Cool cool cool.
Security vulnerability on U.S. trains that let anyone activate the brakes on the rear car was known for 13 years — operators refused to fix the issue until now
Wireless hardware to seriously disrupt rail transport costs less than $500.
www.tomshardware.com
July 14, 2025 at 4:10 AM
Reposted by Felipe Molina
eugenevinitsky.bsky.social
Well, a single week was enough to provide a convincing case that a Wikipedia equivalent for LLMs is necessary i.e. decentralized LLM training and serving
asking grok 4 for its opinions on israel palestine it first searches to see what Elon musk thinks
July 10, 2025 at 10:28 PM
Reposted by Felipe Molina
fernandoblancopsy.com
Y luego tenemos a unos cuantos gurús educativos proponiendo que el alumnado "le pregunte las dudas" a ChatGPT...
eugenevinitsky.bsky.social Eugene Vinitsky 🍒 @eugenevinitsky.bsky.social · Jul 10
Well, a single week was enough to provide a convincing case that a Wikipedia equivalent for LLMs is necessary i.e. decentralized LLM training and serving
asking grok 4 for its opinions on israel palestine it first searches to see what Elon musk thinks
July 11, 2025 at 6:26 AM
Reposted by Felipe Molina
campuscodi.risky.biz
These arrests are the definition of "don't shit where you eat"
techmeme.com Techmeme @techmeme.com · Jul 10
UK police arrest four people, a 20-year-old woman and three men age 17 to 19, in relation to the M&S and Co-op hacks, which started in April and caused havoc (Joe Tidy/BBC)

Main Link | Techmeme Permalink
July 10, 2025 at 12:14 PM
Reposted by Felipe Molina
evilpacket.net
The finding was for "JWT weak HMAC secret" and it said the secret was literal "secret"

A range of emotions pushed me in various directions at once. What? no.!? yes!!!!!!! let's verify...
May 10, 2025 at 7:27 PM
felmoltor.me
All hail the stupid king! Me! 🤴
In 2024 forgot that I was running a Mongo Express in a docker container without authentication (AS IT WAS ONLY INTERNALLY EXPOSED). Later, I randomly did some tests with Nginx to expose port 8081 and forgot about it... Fast forward to June 2025:
June 18, 2025 at 9:49 AM
felmoltor.me
If this is true, this is the best news I've read this week! Excited to activate my nostalgia mode with Spaceballs 2! www.ign.com/articles/spa...
Spaceballs 2 Will See Rick Moranis Return as Dark Helmet as Mel Brooks Sequel Trailer Plots a Course for 2027 - IGN
Moviemaking icon Mel Brooks and Amazon MGM Studios have published a special trailer to announce that Spaceballs 2 is moving full steam ahead with plans to premiere in 2027.
www.ign.com
June 13, 2025 at 9:35 AM
felmoltor.me
I programmed some time ago a crawler with Scrapy to detect orphan JavaScript scripts in target domains. I think I'll release that tool soon ☺️
June 13, 2025 at 8:57 AM
Reposted by Felipe Molina
itm4n.bsky.social
🆕 New blog post!

"Checking for Symantec Account Connectivity Credentials (ACCs) with PrivescCheck"

This blog post is not so much about PrivescCheck, but rather brings additional insight to the original article published by MDSec on the subject.

👉 itm4n.github.io/checking-sym...

#redteam
Sample output of PrivescCheck showing the information collected about the Symantec Management Agent (SMA).
June 11, 2025 at 3:46 PM
felmoltor.me
I was talking with someone about dependency confusion and suply chain attacks and I was confused myself with the feasibility of doing this in 2025, so I decided to take a practical aproach and create my own tool 🔨 to detect Orphan and Mispelled packages 📦: sensepost.com/blog/2025/de...
SensePost | Depscanner: find orphaned packages before the bad guys do
Leaders in Information Security
sensepost.com
June 11, 2025 at 10:04 AM
Reposted by Felipe Molina
bluetone66.bsky.social
June 9, 2025 at 10:01 PM
Reposted by Felipe Molina
astrojaz.bsky.social
sombrero galaxy - hubble vs webb:
The Sombrero Galaxy is an oblong, pale white disk with a glowing core. It appears nearly edge-on but slants slightly in the front, presenting a slight top-down view of the inner region of the galaxy and its bright core. The outer disk is darker with shades of brown and black. Different colored distant galaxies and various stars are speckled among the black background of space surrounding the galaxy. Image of a galaxy on the black background of space. The galaxy is a very oblong, brownish yellowish disk that extends from left to right at an angle (from about 10 o’clock to 5 o’clock). Mottled dark brown patches rim the edge of the disk and are particularly prominent where they cross directly in front of the galaxy. The galaxy’s center glows white and extends above and below the disk. There are different colored dots, distant galaxies, speckled among the black background of space surrounding the galaxy. At the bottom right, there is a particularly bright foreground star with Webb’s signature diffraction spikes.
June 3, 2025 at 4:40 PM
Reposted by Felipe Molina
astrojaz.bsky.social
i still think about the jwst saturn picture a lot
The background is mostly dark. At the center is a dark orange-brown circle, surrounded by several blazing bright, thick, horizontal whiteish rings. This is Saturn and its rings. There are three tiny dots in the image—one to the upper left of the planet, one to the direct left of the planet, and the lower left of the planet. These are three of Saturn’s moons: Dione, Enceladus, and Tethys, respectively. There is a slightly darker tint at the northern and southern poles of the planet. The rings surrounding Saturn are mostly broad, with a few singular narrow gaps between the broader rings. There is an innermost, thicker ring, and next to that is a brighter, wider ring. Traveling farther outward, there is a small dark gap before another thicker ring. In the thicker ring, there is a narrow faint band. There is then an outermost, faintest, thinnest ring.
June 5, 2025 at 6:44 PM
Reposted by Felipe Molina
singe.bsky.social
Wifi hacking can be a useful tool, but people are out here grinding on WPA2 handshake cracking tutorials & menu driven attack tooling. When we built the 3rd and latest iteration of the wifi hacking course for BlackHat - we did it to show what really works and how it really works. 1/7
A DALL-E generated image of a hooded person behind a computer with a large glowing wifi symbol on it. In the background are neon posters with the words WPA2 handshake cracking, PEAP relay access, certificate bypass and BLACK HAT. The style is neon cyberpunk.
June 4, 2025 at 12:01 PM
felmoltor.me
I finished watching the last chapter of The Leftovers yesterday. Oh, man! Not many series got me so hooked up to the TV and sitting at the edge of my seat as this one has. ❤️
June 4, 2025 at 1:23 PM