7 Minute Security

Today I recap a two week persona/biz road trip and talk about the security stuff that got sprinkled into it, including: Family members who don't care about their personal security Weakpass  – a cool collection of word lists for brute-forcing and spraying that I'd never heard of Working on two security Webinars for Netwrix (here's  part 1: Mastering Password Security & Active Directory Monitoring ,...

Today we have a fun featured interview with my new friend Stu Musil of  Ambient Consulting  I had a great time talking with Stu about bashing come common misconceptions people have about working with recruiters, plus tackling some frequently asked questions: How do you properly vet a recruiter you don't know, but who offers a job opportunity you're interested in? What questions should you ask a po...

Hey friends, today we talk about some not-so-glamorous but ever-so-important stuff related to running a cybersecurity consultancy, including: Taking an inventory of all the SaaS stuff your business uses – to keep an eye on spending, know when services are expiring, and track which credit card the services are tied to (so the services don't almost get cancelled like some did with me!) Tracking doma...

Hey friends, today we continue our series all about migrating from VMWare to the world Proxmox!  Specifically: Getting my first Proxmox-based NUCs out in the field for live engagements! Pulling the trigger on two bare-metal Proxmox servers to eventually replace my vCenter environment. OVHCloud  made it super easy to to add Proxmox to those bare-metals with a simple wizard. I couldn't figure out ho...

Hey friends, today we've got a security milkshake episode about Web app pentesting. Specifically we talk about: Burp Suite Enterprise Caido  – a lightweight alternative to Burp wfuzz  – Web fuzzer.  Using a proxy: wfuzz -c -z file,/usr/share/wfuzz/wordlist/Injections/XSS.txt –sc 200 "https://somedomain.com/shopping?&qty=%2FUZZ" -p 10.0.7.11:8080 KNOXSS  – for XSS testing – pairs nicely with this w...

Road trip time! I've been traveling this week doing some fun security projects, and thought all this highway time would be a perfect opportunity to take a dip into the 7MS mail bag!  Today's questions include: How do you price internal network penetration tests? Have you ever had to deal with a difficult client situation, and how did you resolve it? Are you done going after certs?   Spoiler: no –...

Today's tale of pentest pwnage is all about my new favorite attack called SPN-less RBCD. We did a teaser episode  last week  that actually ended up being a full episode all about the attack, and even step by step commands to pull it off.  But I didn't want today's episode to just be "Hey friends, check out the YouTube version of this attack!" so I also cover: Our  first  first impressions of  Burp...

Today's prelude to a tale of pentest pwnage talks about something called "spnless RBCD" (resource-based constrained delegation).  The show notes don't format well here in the podcast notes, so head to 7minsec.com to see the notes in all their glory.

Sadly, the  Broadcom acquisition of VMWare  has hit 7MinSec hard – we  love  running ESXi on our NUCs, but ESXi free is no longer available.  To add insult to injury, our  vCenter lab at OVHcloud HQ  got a huge price gouge (due to license cost increase; not OVH's fault).  Now we're exploring  Proxmox as an alternative hypervisor, so we're using today's episode to kick off a series about the joys a...

Today we revisit a series about eating the security dog food – in other words, practicing what we preach as security gurus!  Specifically we talk about: We're going to get a third-party assessment on 7MinSec (the business) Tips for secure email backup/storage Limiting the retention of sensitive data you store in cloud places

Today we're talking about tips to deal with stress and anxiety: It sounds basic, but  take breaks  – and take them in a different place (don't just stay in the office and do more screen/doom-scrolling) I've never gotten to a place in my workload where I go "Ahhh, all caught up!" so I should stop striving to hit that invisible goal. Chiropractic and back massages have done wonders for the tightness...

We did something crazy today and  recorded an episode that was 7 minutes long!   Today we talk about some things that have helped us out in recent pentests: When using  Farmer  to create "trap" files that coerce authentication, I've found way better results using Windows Search Connectors ( .searchConnector-ms ) files This  matrix  of "can I relay  this  to  that " has been super helpful, especial...

Today's episode is all about writing reports in  Sysreptor .  It's awesome!  Main takeaways: The price is free (they have a paid version as well)! You can send findings and artifacts directly to the report server using the  reptor Python module Warning: Sysreptor  only  exports to PDF (no Word version option!) Sysreptor has helped us write reports faster without sacrificing quality

Hey friends, today we've got a tale of pentest pwnage that covers: Passwords – make sure to look for patterns such as keyboard walks, as well as people who are picking passwords where the month the password changed is part of the password (say that five times fast)! Making sure you go after  cached credentials Attacking SCCM –  Misconfiguration Manager  is an absolute gem to read, and  The First C...

Hey friends, today we have a super fun interview with Andrew Morris of  GreyNoise  to share.  Andrew chatted with us about: Young Andrew's early adventures in hacking his school's infrastructure (note: don't try this at home, kids!) Meeting a pentester for the first time, and getting his first pentesting job Spinning up a box on the internet, having it get popped instantly, and wondering…"Are all...

Hey friends, sorry I'm so late with this (er, last) week's episode but I'm back!  Today is more of a  prep  for tales of pentest pwnage, but topics covered include: Make sure when you're  snafflin ' that you check for encrypted/obfuscated logins and login strings – it might not be too tough to decrypt them! On the defensive side, I've found myself getting *blocked* doing things like SharpHound run...

How much fun I had attending and speaking at  Netwrix Connect Being a sales guy in conference situations without being an  annoying  sales guy in conference situations A recap of the talk I co-presented about high profile breaches and lessons we can learn from them

Today's tale of pentest covers: Farming  for credentials (don't forget to  understand trusted zones  to make this happen properly!) Snaffling  for juice file shares Stealing Kerberos tickets with Rubeus

Hello friends, we're still deep in the podcast trenches this quarter and wanted to share some nuggets of cool stuff we've been learning along the way: Snaffler  – pairs nicely with  PowerHuntShares  to find juicy tidbits within file/folder shares Group3r  – helps you find interesting and potentially abusable Group Policy Object configurations Farmer – totally awesome toolkit for dropping tricky fi...

Hey friends, sorry for the late episode but I've been deep in the trenches of pentest adventures.  I'll do a more formal tale of pentest pwnage when I come up for air, but for now I wanted to share some tips I've picked up from recent engagements: GraphRunner - awesome PowerShell toolkit for interacting with Microsoft Graph API.  From a pentesting perspective, it may help you bridge the "gap" betw...

Hey friends, today we cover a funstrating (that's fun + frustrating) issue we had with our DIY pentest dropboxes. TLDL:   The preseed file got jacked because I had a bad Kali metapackage in it. While I was tinkering around with preseed files, I decided it would be more efficient to have the Kali ISO call that preseed file directly over HTTP (rather than make a new ISO every time I made a preseed c...

Hey friends, today is a first impressions episode about Sysreptor , which according to their GitHub page, is a fully customisable, offensive security reporting solution designed for pentesters, red teamers and other security-related people alike .  It is easy to stand up with Docker, has built-in MFA and a great hybrid WYSIWYG/code editor.  The only scary part?  There is no export to Word ( insert...

Hey friends, today our pal Hackernovice joins us for a tool (actually  two tools!)  release party: EvilFortiAuthenticator - it's like a regular FortiAuthenticator , but evil.  This tool allows you to capture the FortiAuthenticator API and subsequently steal the entire device's config, subsequently allowing you to restore the config to a second server and potentially steal cleartext Active Director...

Today we talk about some business-y things like: A  pre  first impressions opinion on  Sysreptor Why I'm not worried about AI replacing manual pentesting (yet) My struggle with going "full CEO" vs. staying in the weeds and working on hands-on security projects

Today our pals  Bjorn Kimminich  from  OWASP  and Paul from  Project7  and  TheUnstoppables.ai  join us as we kick off a series all about hacking the  OWASP Juice Shop , which is "probably the most modern and sophisticated insecure web application!" We got a few wins on the Juice Shop score board today: Found the score board Bullied the chatbot Fired a DOM XSS Located a confidential document Gave...