7 Minute Security

Hello friends! We're long overdue for a tale of pentest pwnage, and this one is a humdinger! It's actually kind of three tales in one, focusing on pentesting wins using: Manual "open heart surgery" on the root of the Active Directory domain The new totally rad DHCP poisoning module of  Responder An opportunity to abuse GPOs with  SharpGPOAbuse  (P.S. we talked about this tool about a year ago in ...

Today we're joined by Louis Evans of  Arctic Wolf  to talk about all things cyber insurance, including: History on cyber insurance - who's buying it, what it does and doesn't cover, and when it started to be something you didn't want to leave home without What are insurance companies asking/demanding of customers before writing a cyber insurance policy? What basic things organizations can do to re...

Hey friends! Today we're going to recap the SIEM/SOC players we've evaluated so far ( Arctic Wolf ,  Elastic ,  Sumo Logic ,  Milton Security ) and then talk about a  new  contender that was brought to our attention:  Blumira  (not a sponsor, but I'm really digging what I'm seeing/hearing/experiencing thus far)!

Today we're talking about  Ping Castle  (not a sponsor), an awesome tool for enumerating tons of info out of your Active Directory environment and identifying weaknesses, misconfigurations and paths to escalation! It's wonderful for both red and blue teamers. Some of Ping Castle's cool features include being able find: Kerberoastable and ASREPRoastable users Plain text passwords lingering in Group...

Today we continue our series focused on  building a security consultancy  and talk about: A phishing campaign that went off the rails, and lessons learned from it First impressions of an  awesome  tool to help add MFA to your Active Directory (not a sponsor) A tangent story about how my wife brought some thieves to justice!

Hey friends! Today I've got some exciting personal/professional news to share: our  Light Pentest eBook  - which is a practical, step-by-step playbook for internal network penetration testing - is now available for purchase! Note: this eBook and the  Light Pentest LITE  training are two separate things, but do cover some of the same topics. The Light Pentest eBook covers: Grabbing and analyzing pa...

Today our good buddy  Joe Skeen  and I virtually sit down with Matt Quammen of  Blue Team Alpha  to talk about all things incident response! Topics covered include: Top 5 things to do and  not  do during ransomware event Challenges when responding to ransomware events Opportunities to break into infosec/IR The value of tabletop exercises, and some great ideas for conducting your own Incident respo...

Today our friend Christopher Fielder from  Arctic Wolf  is back for an interview  four-peat ! We had a great chat about making sense of vendor alphabet soup terms (like SIEM, SOC, EDR/MDR/XDR, ML, AI and more!), optimizing your SOC to "see" as much as possible, tackling vendor/customer communication problems, and simplifying security product pricing to make purchases less stressful for customers!...

Today we're continuing our series called Desperately Seeking a Super SIEM for SMBs - this time with a focus on a new contender in our bake-off: Perch Security! It might help you to go back and take in  part 1  and  part 2 , but today we're focusing on the first experience I had chatting with the sales/technical folks at Perch. TLDL: I  really  liked a lot of things I was hearing and seeing. Pros (...

Today we continue our series we started recently (part 1 is  here  about finding a super SIEM for SMBs. Specifically I have some updates on (and frustrations with) Arctic Wolf, Elastic, Milton Security and Perch Security. Here's the TLDL version: Arctic Wolf They remain a strong contender in my bake-offs. They also could tick several boxes for an org as they offer continuous internal/external vuln...

Today we're continuing our discussion on phishing campaigns - including a technical "gotcha" that might redirect your phishing emails into a digital black hole if you're not careful! As I mentioned last week, I've been heavy into spinning up and tearing down phishing campaigns, so I finally got around to documenting everything in  episode 481 . This week I ran into a bizarre issue where test phish...

Today we're revisiting how to make a kick-butt cred-capturing phishing campaign with  Gophish ,  Amazon Lightsail ,  LetsEncrypt ,  ExpiredDomains.net  and a special little extra something that makes creating phishing landing pages  waaaaaaayyyyyyyyyy  easier! For some quicker review, you can check out  part 1  and also the complementary  YouTube  video, but I wanted to revisit this kick-butt proc...

Today we're talking about the SIEM bake-off for SMBs that we've recently embarked on. We're currently evaluating several solutions - either for customer-facing purposes, internal kick-the-tires fun, or both. Candiates include: Arctic Wolf Elastic Milton Security Protocol46 Sumo Logic First we're starting by running each vendor through a  series of questions , then likely following up with a demo w...

Hey friends, today we're talking about a new security training offering 7MinSec has created called  Light Pentest LITE - Live Interactive Training Experience . It's a 3-day course (with each class session being 3 hours long) consisting of live (via Zoom), hands-on, instructor-led sessions that are focused on teaching you how to find, exploit and defend against common Active Directory weaknesses! C...

Hey friends, today we're continuing our discussion of password cracking by sharing some methodology that has helped us get a high cred yield, and some tips on taking cracked passwords from multiple sources and Frankensteining them into a beautiful report for your customer. For some background, when 7MS started as a biz, we used to crack passwords in  Paperspace  but invested in an  on-prem crackin...

Today we're talking about Cobalt Strike for newbs - including how to get it up and running, as well as some tools that will help you generate beacons while evading EDR at the same time! Some helpful things mentioned in today's episode: Wherever you spin up your CS instance, it's probably a good idea to lock down the firewall to only specific IPs. With Digital Ocean, I found  this article  helpful....

**STOP!** If you didn't listen to [last week's episode](https://7ms.us/7ms-475-tales-of-internal-network-pentest-pwnage-part-27/) you might want to, since this was a two-part tale of pwnage. Either way I'll get you up to speed and talk about why this was (of course) one of my favorite pentests ever.

Yeahhhhhh! Today's another fun tale of pentest pwnage, including: The importance of starting your pentest with an AD account that actually has access to...ya know...stuff The importance of starting your pentest plugged into a network that actually has...you know...systems connected to it! This BHIS article  is awesome for finding treasures in SMB shares PowerUpSQL audits are a powerful way to get...

Hey friends! Today we're dusting off an old mini-series about password cracking in the cloud (check out  part 1  and  part 2 ) and sharing some awesome info on building a monster of a cracking rig in AWS! One reason we haven't talked about password cracking in the cloud in a while is because back in winter of 2019 I built  baby's first password cracking . Unfortunately, this week, Hashy (the name...

Hey everybody! Today  Joe  and I sat down with  Nikhil Mittal  of  Pentester Academy  and  Altered Security  to talk about a whole slew of fun security topics: How Nikhil first got involved in Pentester Academy Nikhil's hacker origin story How does Nikhil feel about his tools being used by baddies? What security tools/defenses would be good for SMBs to focus on? Active Directory security - is all...

Hey everybody! Today  Joe  and I sat down with  Nikhil Mittal  of  Pentester Academy  and  Altered Security  to talk about a whole slew of fun security topics: How Nikhil first got involved in Pentester Academy Nikhil's hacker origin story How does Nikhil feel about his tools being used by baddies? What security tools/defenses would be good for SMBs to focus on? Active Directory security - is all...

Today our good pal Christopher Fielder from  Arctic Wolf  is back for an interview  three-peat ! He joins Joe "The Machine" Skeen (a.k.a.  Gh0sthax ) and I to talk about all things ransomware, including: How the Colonial Pipeline incident may have started  from a weak VPN cred with no MFA . Silver lining (?) - they  got some of the $ back . Was the federal government's response good enough? What ...

Hey everybody, happy June! Our pal  Joe  is back to cover some great security stories with us, including: Peloton's leaky API Some Colonial Pipeline discussion ( story 1 ,  story 2 ) Amazon Sidewalk   doesn't  really share your Internet connection with neighbors/strangers. The  Hacker News article  doesn't do an awesome job of clearing that up either.  

Today we're doing something new - a  first impressions  episode of Meraki networking gear. Note: this is  not  a sponsored episode, but rather a follow up to  episode #460  where I talked about throwing all my UniFi gear into the ocean and replacing it with Meraki gear. At the end of that episode I asked if anybody was interested in a "first impressions" of the gear, and it turns out (at least 6)...

Hey friends! Today we're talking with Philippe Humeau, CEO of  CrowdSec , which is " an open-source massively multiplayer firewall able to analyze visitor behavior & provide an adapted response to all kinds of attacks. It also leverages the crowd power to generate a global IP reputation database to protect the user network ." I came into this interview not knowing much at all about CrowdSec, so I...