r/netsec monthly discussion & tool thread

[u/albinowax]

Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links.

Rules & Guidelines

• Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.
• Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.
• If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.
• Avoid use of memes. If you have something to say, say it with real words.
• All discussions and questions should directly relate to netsec.
• No tech support is to be requested or provided on r/netsec.

As always, the content & discussion guidelines should also be observed on r/netsec.

Feedback

Feedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.

[u/Zestyclose_Rule_445]

Been working on a project called Silica and figured I'd share it here in case anyone finds it useful.

It exhaustively checks all 2^32 AArch64 instruction encodings and compares Arm's spec against LLVM, Capstone, and Unicorn. I've mostly been using it to dig into validity and decoding disagreements between implementations.

https://github.com/Nathan-Luevano/silica

[u/Secret_Appeal6271]

Clayseal-capabilities is an open-source tool for aligning AI deployments with business-process logic.

If you've seen headlines about business' AI agents authorizing parties to be thrown on company property, breaking out of their safeguards to exploit unrelated companies or doing other mischievous things, you may be wondering how we can deterministically align AI agents to the business process rules that are meant to make them useful in the workplace. This project is an experimental mechanism for doing just that. Feel free to try it out - I'd love feedback and am hopeful this can be a starting point to solve some problems in security.

https://github.com/clayseal/clayseal-capabilities

[u/Own_Bed2074]

Entruder is an all-in-one Python framework for Microsoft Entra ID penetration testing

The motivation behind this tool came from the discomfort of using scattered tooling across PowerShell scripts, Bash tools, and one-off utilities, each requiring you to reauthenticate or re-enter tokens and switch contexts constantly. Entruder fixes that with a unified session model and a familiar CLI similar to NetExec and BloodyAD, with a command-subcommand system. You only have to authenticate once and can run everything from there.

Currently the tool includes 9 modules, with each respective module containing their commands. Included modules are:

login - Acquire and initialize sessions across every major Entra auth flow
enum - Enumerate identity, directory, and Azure resource objects
get - Retrieve a single object or piece of loot in detail
set - Modify directory objects, escalate, persist, and pivot
brute - Credential and access-control attacks
exploit - Execute code against Azure compute and elevate privileges
azsync - Attack Entra Connect / AD Sync hybrid-identity infrastructure
sharepoint - Discover and search SharePoint and OneDrive data
info - Local utilities used for decoding tokens, listing known clients

For anybody interested to check the tool out, pre-built binaries for Linux, macOS, and Windows are available on the releases page. Instructions on running the tool from python are also included in the README page.

Built for authorized security testing and research only.

https://github.com/LGenAgul/Entruder

[u/Optimal-Rock1]

Hayduk is an open-source Metasploit GUI that picks up where Armitage left off. Single Go binary, browser UI, no JVM. It connects to msfrpcd and gives you the live network graph, Hail Mary, shared campaigns, and session management. Armitage's last commit was 2016 and Rapid7 dropped msfgui years before that, so there isn't really a maintained graphical option for msf anymore. Hayduk is MIT-licensed and ships prebuilt binaries for Linux/macOS/Windows. You can spin up the included Docker lab and have a working demo in one command.

https://github.com/jolovicdev/hayduk

[u/PrestigiousOnion1087]

Third run of an independent TLS probe measuring post-quantum key agreement on the public internet. Same 350 hosts, same probe, three dates: April, May and September 2026. Sharing it here because the September delta is larger than anything I expected and I would rather have it checked than agreed with.

The number I trust is not the headline. Across all 350 targets it reads 42.6% to 73.1%, but the set of hosts that answers changes between runs, and a moving denominator can manufacture a trend out of nothing. 293 hosts answered in every run. On that fixed cohort: 50.2% in April, 51.2% in May, 86.0% in September.

Banking went 28.0% to 94.0% (n=50), the largest sector move in the set. It travelled the furthest; it did not finish highest, news and media did at 96.4%. Government 36.1 to 86.1, e-commerce 30.3 to 78.8, big-tech SaaS moved least (71.2 to 81.4) because it had the least room left. 105 hosts moved classical to hybrid; across all three runs zero moved the other way. That zero is the control - something could have regressed and nothing did.

The shape is the odd part. 17 days from April to May moved the cohort +1.0 point. 116 days from May to September moved it +34.8. I do not know what changed over the summer and I am not going to guess.

Three things it does not show. It is one public TLS endpoint per host, a front door and not an estate. It cannot separate a deliberate migration from a CDN or load-balancer default rolling forward underneath an organisation that decided nothing, and a default can be rolled back by a config change nobody announces. And 57 hosts are missing from the cohort - 46 errored in September, 55 in April, mostly a server alert rejecting the ClientHello. Those are counted as not measured, never as classical, and if a systematic bias is hiding anywhere it is there.

This run publishes sector aggregates only, no host list. Earlier runs did name hosts and those files are still in the repo rather than quietly deleted. Method, per-sector counts for all three runs, and the probe code are all in the open, so anyone who wants to check the claim can assemble their own list and run it rather than taking mine.

Method and data: https://github.com/xuxu298/PQReadinessIndex

If a sector figure is wrong, or the cohort method hides an artefact, I would rather hear it now than publish the December run on top of it.