7 Minute Security

This week your pal and mine Joe "The Machine" Skeen kept picking away at pwning  Ninja Hacker Academy .  To review where we've been in parts 1 and 2: We found a SQL injection on a box called  SQL,  got a privileged Sliver beacon on it, and dumped mimikatz info From that dump, we used the  SQL  box hash to do a BloodHound run, which revealed that we had excessive permissions over the  Computers  OU...

Happy Friday! Today's another hot pile of pentest pwnage. To make it easy on myself I'm going to share the whole narrative that I wrote up for someone else: I was on a pentest where a DA account would sweep the networks every few minutes over SMB and hit my box. But SMB signing was on literally everywhere. The fine folks here recommended I try relaying to something NOT SMB, like MSSQL. This articl...

Holy schnikes, today might be my favorite tale of pentest pwnage ever. Do I say that almost every episode? yes. Do I mean it? Yes. Here are all the commands/links to supplement today's episode: Got an SA account to a SQL server through  Snaffler -ing With that SA account, I learned how to coerce Web auth from within a SQL shell – read more about that  here I relayed that Web auth with  ntlmrelayx...

Today's tale of pentest pwnage is a classic case of "If your head is buried in the pentest sand, pop it out for a while, touch grass, and re-enumerate what you've already enumerated, because that can lead to absolute GOLD!"

Hello friends!  Today your friend and mine, Joe "The Machine" Skeen joins me as we keep chipping away at pwning  Ninja Hacker Academy !  Today's pwnage includes: "Upgrading" our Sliver C2 connection to a full system shell using  PrintSpoofer ! Abusing nanodump to do an lsass minidump….and find our first cred. Analyzing BloodHound data to find (and own) excessive permissions against Active Director...

Today I talk about a subject I love while also driving me crazy at the same time: building a pentest training course! Specifically, I dissect a fun/frustrating GPO attack that I need to build very carefully so that every student can pwn it while also not breaking the domain for everybody else. I also talk about how three different flavors of AI failed me in solving a simple task.

Hi friends, we're doing something today we haven't done in a hot minute: take a dip into the 7MinSec mail bag! Today we cover these questions: If I'm starting a solo business venture as a security consultancy, is it a good idea to join forces with other solo security business owners and form a consortium of sorts? Have you ever had anything go catastrophically wrong during a pentest?  Yes, and thi...

Oh man, I'm so excited I can hardly sleep. Our new three-day (4 hours per day) training is getting closer to general release. I talk about the good/bad/ugly of putting together an attack-sensitive lab that students can abuse (but hopefully not break!), and the technical/curriculum-writing challenges that go along with it.

Today's kind of a "story time with your friend Brian" episode: a tale of how my neighbor almost got scammed out of $13k.  The story has a lot of red flags we can all keep in mind to keep ourselves (as well as kids/friends/parents/etc.) safer from these types of shenanigans.

Hey friends, today we start pwning  Ninja Hacker Academy  – cool CTF-style lab that has you start with  no  cred and try to conquer domain admin on  two  domains!

This week I'm working on a mixed bag of fun security and marketing things: A pentest I'm stuck on My latest lab CTF obsession:  Ninja Hacker Academy A cool "about 7MinSec" marketing video that was recorded in a pro studio!

Today's episode is a downer! We talk about things you might want to have buttoned up for when you are eventually not alive anymore: Living will Buried vs. cremated? Funeral plans Funeral PHOTOS? I also talk about how my dad broke his ribs while trying to break a chimpmunk, and how a freak 4-wheeler accident also had my ribs in agony.

Today Joe "The Machine" Skeen and I pwn the third and final realm in the world of  GOAD (Game of Active Directory) : essos.local!  The way we go about it is to do a WinRM connection to our previously-pwned Kingslanding domain, coerce authentication out of MEEREEN (the DC for essos.local) and then capture/abuse the TGT with Rubeus!  Enjoy.

Today I share some tips on creating a better purple team experience for your customers, including: Setting up communication channels and cadence Giving a heads-up on highs/criticals  during  testing (not waiting until report time) Where appropriate, record videos of attacks to give them more context

In today's tale of pentest pwnage I talk about a cool ADCS ESC3 attack – which I also did live on this week's Tuesday TOOLSday.  I also talk about  Exegol's licensing plans  (and how it might break your pentest deployments if you use  ProxmoxRox ).

Today I share some tips on presenting a wide variety of content to a wide variety of audiences, including: Knowing your audience  before  you touch PowerPoint Understanding your presentation physical hookups and presentation surfaces A different way to screen-share via Teams that makes resolution/smoothness  way  better!

Hi everybody. Today I take it easy (because my brain is friend from the short week) to tell you about the time I think my HP laptop was compromised at the factory!

Today's fun tale of pentest pwnage discuss an attack path that would, in my opinion,  probably be impossible to detect…until it's too late.

Hey friends! Today Joe "The Machine" Skeen and I tackled  GOAD (Game of Active Directory)  again – this time covering: SQL link abuse between two domains Forging inter-realm TGTs to conquer the coveted sevenkingdoms.local! Join us next month when we aim to overtake essos.local, which will make us rulers over all realms!

Today's tale of pentest pwnage is another great one!  We talk about: The SPNless RBCD attack (covered in more detail in  this episode ) Importance of looking at all "branches" of outbound permissions that your user has in BloodHound This devilishly effective MSOL-account-stealing  PowerShell script  (obfuscate it first!) A personal update on my frustration with ringing in my ears

Today we're excited to release  ProxmoxRox  – a repo of info and scripts to help you quickly spin up Ubuntu and Windows VMs.  Also, some important news items: 7MinSec.club in-person meeting is happening Wednesday, May 14!  More details  here . We did our second  Tuesday TOOLSday this week and showed you some local privesc techniques when you have local admin on an endpoint

Today's a fun tale of pentest pwnage where we leveraged a WinRM service ticket in combination with the shadow credentials attack, then connected to an important system using  evil-winrm and make our getaway with some privileged Kerberos TGTs!  I also share an (intentionally) vague story about a personal struggle I could use your thoughts/prayers/vibes with.

Hello! This week Joe "The Machine" Skeen and I kicked off a series all about pentesting  GOAD (Game of Active Directory) .  In part one we covered: Checking for null session enumeration on domain controllers Enumerating systems with and without SMB signing Scraping AD user account descriptions Capturing hashes using Responder Cracking hashes with Hashcat

Hi friends, today I'm kicking off a series talking about the good/bad/ugly of hosting security services. Today I talk specifically about  transfer.zip . By self-hosting your own instance of transfer.zip, you can send and receive HUGE files that are end-to-end encrypted using WebRTC.  Sweet!  I also supplemented today's episode with a short live video over at  7MinSec.club .

Hi friends, in this edition of what I'm working on this week: 3 pulse-pounding pentests that had…problems Something I'm calling the unshadow/reshadow credentials attack Heads-up on a new video experiment I'm going to try next week