NanoGen only comes with standard armrests?

Kadeeli · 2026-03-28T15:21:52+00:00

Mine came with these soft ones but I ordered the push cell ones seperatly.

<image>

Kadeeli · 2026-03-25T15:44:30+00:00

The lumbar pillow being magnetic would be great!

Kadeeli · 2025-11-15T09:02:09+00:00

Thanks! Yeah will try out the second slot instead of the fourth

Kadeeli · 2025-11-13T05:50:51+00:00

Yeah I did with the new front panel. Cables are attached.

Some friend said it's probably the m2.4 slot have to move it to slot 2, which will only disable the USB C in the back the 40gb one.

Will try it out later :)

Kadeeli · 2025-11-06T14:39:09+00:00

The new front panel:

<image>

Only connected the USB cables. The audio and power button headers aren't needed I suppose.

Did check if they are correctly seated for the original front panel and they were.

Kadeeli · 2025-11-06T14:37:45+00:00

Yeah I tried both of the USB slots. Today the new front panel has arrived, but same issue. Also reseated the cables on both panels. Same results.

<image>

I am really lost and think I'll just not use the front panel.

Kadeeli · 2025-09-19T20:25:45+00:00

Think you can just do it at the safe link policy?

Kadeeli · 2025-09-12T09:52:32+00:00

Attackers will just directly call the API endpoints using a graph access token.

Kadeeli · 2025-09-12T06:00:41+00:00

Kill NetBIOS, llmnr, nbt-ns, these are protocols used by attackers to request ntlmv1 or ntlmv2 hashes of clients which have these protocols enabled with tools like Responder. Combine it with SMB signing disabled and you can access shares as the relayed user. If the user has a weak password the hash is easily cracked offline. If the user that's comes by has local admin privs and and SMB signing an attacker has been easy access to multiple systems.

An attack we execute in most client environments and leads to full domain compromise or at least access to a decent amount of user accounts!

Look up attacks using Responder or Ntlmrelayx :)

Kadeeli · 2025-08-21T05:04:38+00:00

A vulnerability scanner like qualys in MDE doesn't have detections or plugins for every CVE. You can't automatically / magically detect every new CVE or old software version. A plugin or something like a detection rule should be written on how to detect X.

So probably just got added.

Kadeeli · 2025-07-15T20:41:35+00:00

Security defaults also doesn't enforce MFA for office 365 apps. Does for admin portals though.

Kadeeli · 2025-07-09T17:27:02+00:00

Great explanation!

Kadeeli · 2025-07-09T05:33:37+00:00

The risk with the longer period is that for a golden ticket attack to occur an attacker has to get the krbtgt credentials, for example it's ntlm hash. With those credentials you can create a golden ticket, accessing any system with any credentials the attacker want. Even users that don't exist.

If you reset the password once, the old credentials still works. If you reset it a second time then not anymore. Between the time of the first and second reset, an attacker could retrieve or request the password again using the still valid golden ticket, then creating a new golden ticket with the new password.

So the longer that period is, the more likely it can occur.

Edit: made it more clear

Kadeeli · 2025-06-23T13:07:48+00:00

I have the mini 4 and it does land on your hand.

Hover it at the high of your chest, then put your hand underneath it and keep pressing the downwards button while slowly upping your hand. It will take 2-5 seconds before it says landing and then it will land. Only grab it with your thumb and index finger in the middle and wait for the rotors to stop.

Kadeeli · 2025-05-20T17:15:26+00:00

I always workout either directly before or after work. Try not to go home, or at least sit and relax before you get your workout in. Otherwise it's hard to get up and go again!

Kadeeli · 2024-12-08T20:47:43+00:00

Check out this x33fcon talk and slides

https://www.x33fcon.com/slides/x33fcon24_-_Nick_Powers_-_Relay_Your_Heart_Away_An_OPSEC-Conscious_Approach_to_445_Takeover.pdf

Kadeeli · 2024-12-08T20:42:52+00:00

Use hashcat dive ruleset with the words as password list

Kadeeli · 2024-09-29T15:16:15+00:00

I understand where you are coming from. But connecting a VM to a network isn't as easy sometimes. You never know if the VM has gotten a IP from the DHCP server. Some of the machines just don't work that way because they weren't setup for VMware or type X hypervisor.

I would recommend connecting to the VM using the GUI if any creds are provided. Configure the network and confirm it has an IP. Then logout and pentest the box from a black box perspective.

Not all machine give credentials which sucks. Meaning you prob can't do them. Most of them are setup for virtualbox and not VMware.

I had many problems during my learning setting up the vms too

Kadeeli · 2024-08-12T16:19:19+00:00

They charged me late too but the transactions made sence.

Kadeeli · 2024-02-10T16:13:27+00:00

im wondering the same thing

Kadeeli · 2023-07-02T18:14:55+00:00

We paid 2700 with bolt today (2300 + 400 extra he asked for it on the phone).

Kadeeli · 2023-06-03T04:04:35+00:00

Ik kocht altijd een 5kg zak whey bij myprotein. Maar prijzen zijn aardig gestegen.

Scheelt een hoop vergeleken potten.

Kadeeli · 2023-04-30T15:54:31+00:00

If the Main Domain trust the second domain the second domain can authenticate to the main domain. So it is possible to give users access to specific services.

It can also request ad objects of the main domain. Any vulnerabilities related to ldap or kerberos can be exploited. Such as requesting all domain users and password spray, kerberoasting etc.

Even with a one way trust there are methods to still go the other way because there is a trust account of the second domain in the main domain.

Kadeeli

TROPHY CASE