Results for “antfu”

Traces identity flows, Windows host artifacts, enterprise messaging, and lateral-movement chains in CTF sandbox challenges.

Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT using analyzeMFT and Python.

Detect and respond to Adversary-in-the-Middle (AiTM) phishing attacks that use reverse proxy kits like EvilProxy, Evilginx, and Tycoon 2FA to bypass MFA and steal session tokens.

Trace mailbox abuse chains including OAuth consent, forwarding rules, delegate access, and message rerouting in a CTF sandbox environment.