One Size Doesn’t Fit All: Penetration Testing Maturity

August 11, 2020

As the security industry continues to progress, companies are focusing on their own security programs, trying to figure out what works and what doesn’t. One of the areas of focus that goes to the early days of the security industry is penetration testing. Penetration testing has always been a validation method to identify exposures and…

Read

Malicious Macros for Script Kiddies

August 4, 2020

Introduction Macros seem like the new hotness amongst hackers, but I thought macros were just simple scripts that some accountant in finance used to simplify their spreadsheets. How can I use and abuse these things to Hack the Planet and rule the world? How can something designed in the 90s still be relevant? In previous…

Read

Thycotic Secret Server: Offline Decryption Methodology

July 28, 2020

On offensive engagements, we frequently encounter centralized internal password managers that are used by various departments to store incredibly sensitive account information, such as Domain Admin accounts, API keys, credit card data, the works. It used to be that these systems were implemented without multi-factor authentication. “Hacking” them was as simple as finding somebody that…

Read

8 Keys to Writing Safer Code

July 9, 2020

All too often, security in code is an afterthought. There’s a reason that bug bounties are so prevalent; as codebases get larger, testing gets harder. Add in the time constraints of a “move fast and break things” mentality and it’s no wonder so many security issues arise. The basics might be there, encrypted connections, hashed…

Read

MSBuild: A Profitable Sidekick!

June 25, 2020

This blog post highlights some good techniques to use when restricted to testing an up-to-date Windows system with low-level user privileges (no local admin) through a Remote Desktop Protocol (RDP) connection. The Situation: At the start of this engagement, I faced the common task of needing to escalate privileges after acquiring low-level access to a…

Read

Workflow Improvements for Pentesters

June 16, 2020

As penetration testers, we are always on the lookout for quality of life improvements. Whether it’s scripting, automating some mundane process, or trying to conquer that all-important client report, it is in our very nature to constantly strive to make things better. One way to advance your art as a pentester is through workflow improvements….

Read

Abusing Windows Telemetry for Persistence

June 9, 2020

Today we’re going to talk about a persistence method that takes advantage of some of the wonderful telemetry that Microsoft has included in Windows versions for the last decade. The process outlined here affects Windows machines from 2008R2/Windows 7 through 2019/Windows 10. As of this posting, this persistence technique requires local admin rights to install…

Read

Introducing Proxy Helper – A New WiFi Pineapple Module

May 26, 2020

I have had several occasions when I’ve been performing a pentest against an Android or iOS application, attempting to monitor the traffic with Burp Suite, only to realize that the application is not respecting my proxy settings. Now, if you have a rooted or jailbroken device, there are some ways you can force the application…

Read

A Beginner’s Guide to Staying Safe/Anonymous Online

May 21, 2020

What is OSINT? It is probably safe to assume you have heard of OSINT at some point (Open Source INTelligence). However, if you have not, it can very generally be described as the collection and analysis of data gathered from publicly accessible sources. People who perform OSINT have a wide variety of sources they can…

Read

Practical OAuth Abuse for Offensive Operations – Part 1

May 13, 2020

Background OAuth is an open authorization standard that facilitates unrelated servers and services working together, allowing access to their assets without sharing the initial, related, single logon credential. I have been thinking of it as a kind of Kerberos for external services, without a shared domain or forest. A familiar instance would be authentication to…

Read
  • Browse by Category

  • Clear Form