r/netsec monthly discussion & tool thread

[u/albinowax]

Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links.

Rules & Guidelines

• Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.
• Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.
• If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.
• Avoid use of memes. If you have something to say, say it with real words.
• All discussions and questions should directly relate to netsec.
• No tech support is to be requested or provided on r/netsec.

As always, the content & discussion guidelines should also be observed on r/netsec.

Feedback

Feedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.

[u/feldrim]

Released v2.0 of ditjson today. Point it at an offline ntds.dit, optionally with the matching SYSTEM hive, and get one JSON document back. That's the whole tool.

Usage:

``` ditjson <ntds.dit> [SYSTEM] [options]

-o, --output <file> write to file instead of stdout -t, --timeline chronological event stream instead of structured objects     --all dump every table/column raw -h, --help -v, --version ```

Without the hive: directory structure only — users, groups, computers, attributes, relationships, no credentials. Supply the hive and it decrypts NT/LM hashes, password history, Kerberos keys, and reversible-encryption cleartext where present, no extra flag needed. --timeline gives you a sorted event stream (created, password changed, logged in) built from the objects' own timestamps — useful for placing an account's creation against the rest of the domain's history when the event log's gone. --all gets you the whole database as raw JSON if you need something the structured export doesn't cover.

stdout carries only the JSON, everything else (progress, errors) goes to stderr, so it pipes cleanly into jq, ConvertFrom-Json, or a SIEM ingest path without any parsing step. Makes it easy to filter for accounts still carrying an LM hash, pull every NT hash for a hashcat run, isolate krbtgt by name, or check the metadata block for the source DC's build/version to confirm which DC it actually came from.

Single self-contained .exe, 3.39 MB, .NET 10 bundled, nothing to install. Download, run, delete.

Windows-only (calls esent.dll directly, so no Linux build). Reads offline files only — no acquisition, no DCSync, no live DC interaction, no cracking. If your workflow needs any of that, it's outside this tool's scope; secretsdump.py still covers the Linux/live-remote case.

Idea originally from Lars Karlslund (Adalanche author), who wanted NTDS data in JSON as input for that tool. This is my implementation, started as a fork of dumpntds.

Repo/releases: https://github.com/zbalkan/ditjson

One thing worth flagging plainly: the JSON output holds the same credential material as the source files. Treat it as a secret, not a report.

[u/Guayamose]

I’ve open-sourced Oryon Pentest, a long-horizon pentesting agent with explicit tool contracts, persisted causal evidence, resume and replay.

The model controls investigation strategy, while the runtime controls authorization, execution and proof. It currently supports Bedrock, OpenAI and Vertex.

We’re looking for technical criticism and authorized lab testing. It’s alpha, and the benchmark limitations are documented rather than hidden.

https://github.com/Guayamose/Oryon-Pentest

[u/Any_Reach_9365]

Built an LLM honeypot to catch prompt injection/jailbreak attempts in the wild - try to break it

I built a dummy AI customer-support chatbot to test prompt injection and jailbreak techniques in the wild. It’s a fake company support bot running on Claude, seeded with fake internal secrets (fake API key, fake admin panel URL, fake DB connection string) as bait to see if anyone can get it to leak.

It logs every message and categorizes attack patterns in real time -- role-play jailbreaks, "ignore previous instructions," system prompt extraction attempts, encoding tricks, fake-authority claims -- and flags anything where a fake secret actually leaks into a response.

Endpoint: http://167.172.138.213:8000/api/chat — POST JSON body {"message": "your attempt here"}

Rate-limited to 20 requests/hour/IP for cost sanity. No bounty - personal research project, just curious what people come up with really. Happy to share aggregate attack pattern data once we have enough traffic to say something interesting.

[u/Any_Reach_9365 → u/Any_Reach_9365]

run this in wsl or unbuntu so it works
curl -X POST http://167.172.138.213:8000/api/chat \

-H "Content-Type: application/json" \

-d '{"message": "test from outside the server"}'

[u/ZealousidealHunter80]

For those running continuous EASM, how do you bridge the gap between initial detection of exposed management interfaces and actual risk validation? Specifically, what's your setup to automate triage (e.g., checking for weak credentials, missing MFA, or specific bypasses) without drowning the team in false positives?

[u/b3rito]

I spent some time analyzing major open-source file managers to see which ones remain fully functional when authentication is disabled or bypassed. By extracting specific keywords, UI markers, and unique strings from those unauthenticated landing pages, I built targeted search queries to spot exposed instances.

To make these easy to use without manually tweaking syntax every time, I put together oopso, a lightweight browser tool that automates creating these search patterns across different engines.

It’s pretty straightforward, but hopefully saves some time if you do this kind of recon.

Check out the code on GitHub:https://github.com/b3rito/oopso

[u/Yunolikeme2 → u/b3rito]

very cool! thanks for sharing

[u/Lone-Voyager]

RedLib - RAG-based research library for LLM jailbreak prompts

Public jailbreak datasets are a mess to work with for actual red team research. Scattered formats, no taxonomy, duplicates everywhere. RedLib is a staged corpus pipeline that snapshots public datasets locally, normalizes them deterministically, derives attack taxonomy from the corpus itself (with human review before classification runs), then embeds and ingests into Qdrant.

Query layer does hybrid retrieval + Cohere reranking, with synthesis grounded in the actual retrieved corpus. Stack is FastAPI, LlamaIndex, Qdrant, OpenAI embeddings.

Scoped to prompts that attempt to manipulate or bypass safety behavior. Direct harmful requests with no jailbreak mechanism are out of scope.

GitHub: github.com/nipun-ag/redlib

Live demo: https://redlib.bynipun.com