The Cyber Threat Perspective

In this episode, Brad and Darrius discuss recent and upcoming changes made to the BurpSuite line of products. If you're a web application penetration tester or just interested in web application security, check this out, it's a game-changer. PortSwigger Post: https://portswigger.net/blog/burp-suite-roadmap-update-january-2023 Blog: https://offsec.blog/ Youtube: https://www.youtube.com/@c...

In this episode Brad and Spencer discuss all the bad advice that's been given over the years regarding passwords and they provide insights into why the current state of passwords are the way they are. Chances are you're like us and you've made each and every one of these password mistakes before. If you want to know what to not do when it comes to passwords, this episode is exactly...

In this episode Spencer and Darrius discuss a variety of things you can and should be doing to secure your cloud environments. While the majority of these quick wins pertain to Microsoft 365 and Azure, the same concepts can be applied to AWS, Okta, Duo and others. Take the time to know your environment and secure it well. We hope this episode helps give you ideas on how to further secure your clou...

In this episode Spencer, Darrius and Brad answer the question: "What do I need to do before I have someone pentest my network or my web app or my environment?" Spencer talks about important considerations before internal pentests, Darrius talks about the critical components to focus on before a web app or even an API pentest and Brad wraps it up with two foundational security components...

In this episode Spencer and Darrius discuss some seriously free and relatively "easy" quick wins for hardening your Active Directory and internal environment. We go from talking about weak passwords to discussing nested group membership and a whole lot more. This episode is jam packed with advice, that's free and easy to implement. We hope you enjoy and get value from it! Blog: http...

In this episode Spencer and Tyler continue the Offensive Security Testing series and discuss External Penetration Testing. We discuss all things external pentesting including what is an external pentest, what is PTES, how external pentests work operationally, pros and cons of different types of external pentests and so much more. Stay until the end of the podcast because Tyler shares war stories a...

In this episode Spencer and Darrius discuss the most recent LastPass Breach. We talk all about what happened, what it means to you and I as well as what it means for firms who use LastPass on an enterprise level. At the end we discuss some thoughts and opinions around with LastPass versus finding a new password vault product and some things to pay attention to if you're in the later boat. Blo...

In this episode we've got the whole Offensive Security team at SecurIT360 on the podcast to talk about exciting moments of 2022 and what everyone is exited for as we move into 2023 and beyond. Thank you for listening and/or watching! If you enjoy our podcast we'd love to know what specifically you enjoy so we can make more of that type of content. Merry Christmas and Happy New Year! Blog...

In this episode Spencer and Darrius discuss an amazing new AI chatbot that has taken the internet by storm and captivated the infosec community. Listen to this episode to learn what ChatGPT is, how it can be used (and abused) and what the possible implications are (good and bad) of such an amazing piece of technology.  Blog: https://offsec.blog/ Youtube: https://www.youtube.com/@cyberthreatpov Twi...

CTF, or Capture The Flag, is a great way to expand your learning and understanding of various information security topics. It can also be great fun and a great way to meet people in the industry. In this episode Spencer and Darrius talk about the benefit of using CTFs to keep your pentesting skills sharp over the holiday "break." Blog: https://offsec.blog/ Youtube: https://www.youtube.co...

In this episode, Darrius and Brad talk about Portswigger's Burp Suite, how they use it, and why it's important. They also offer a sneak-peak into what's coming in 2023!  Blog: https://offsec.blog/ Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw Twitter: https://twitter.com/cyberthreatpov Work with Us: https://securit360.com Blog: https://offsec.blog/ Youtube: https...

In this episode Spencer and Brad talk about the hidden dangers of not properly protecting Microsoft WSUS Servers. That's Windows Server Update Service for those not in the know. Attackers often use legitimate functionality to gain ground and WSUS is no different. Nettitude blog discussing SharpWSUS: Introducing SharpWSUS - Nettitude Labs Spencer's fork of SharpWSUS: GitHub - techspence/S...

In this episode Brad is joined by Matt Tesauro to talk all things OWASP, API Hacking and DevSec. Matt Tesauro is a Distinguished Engineer at NoName Labs, a member of the OWASP Global Board of Directors and Founder of 10Security, the creators of DefectDojo. Matt Tesauro is a DevSecOps and AppSec guru with specialization in creating security programs, leveraging automation to maximize team velocity...

Are you looking for your first job in penetration testing? Perhaps you're looking to advance and up your skills or maybe you're a manager looking to hire a penetration tester to your team. In this episode Brad, Spencer and Darrius talk about which pentesting certs to get and why. Blog: https://offsec.blog/ Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw Twitter: https:/...

This is part 3 of a multi-episode series where the Offsec group at SecurIT360 dives into the details of various Offensive Security Tests, what they mean, what to expect, war stories and much more! Blog: https://offsec.blog/ Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw Twitter: https://twitter.com/cyberthreatpov Work with Us: https://securit360.com Blog: https://offsec.blog/ Yo...

This is part 2 of a multi-episode series where the Offsec group at SecurIT360 dives into the details of various Offensive Security Tests, what they mean, what to expect, war stories and much more! Blog: https://offsec.blog/ Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw Twitter: https://twitter.com/cyberthreatpov Work with Us: https://securit360.com Blog: https://offsec.blog/ Yo...

Coming at you LIVE from LegalSec22 in San Antonio Texas. In this episode Brad and Spencer discuss common security challenges that are unique to law firms and provide insights on ways to begin solving those challenges. Blog: https://offsec.blog/ Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw Twitter: https://twitter.com/cyberthreatpov Work with Us: https://securit360.com Blog: ht...

This is part 1 of a multi-episode series where the Offsec group at SecurIT360 dives into the details of various Offensive Security Tests, what they mean, what to expect, war stories and much more! Blog: https://offsec.blog/ Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw Twitter: https://twitter.com/cyberthreatpov Work with Us: https://securit360.com Blog: https://offsec.blog/ Yo...

Web application risks are not new, but they are different because how they have fully proliferated all aspects of modern computing. Everything lives on HTTP or HTTPS or some webservice. Tune into this episode to learn about some of the most common risks we see with web applications in the modern landscape. Blog: https://offsec.blog/ Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw...

There's essentially a 0% unemployment rate in cybersecurity. It's a very hot field, great job security, great pay and great mission. But, with that comes a high level of competition for individuals seeking cybersecurity jobs. So on today's episode, Brad and Spencer talk with Misty Stacy, Managing Partner at Trusted Cyber Talent, who is on the forefront of helping cybersecurity profe...

In this episode Brad and Spencer discuss the THREE primary ways we gain initial access on penetration tests and how to stop us! The moral of this story is that these are attack vectors we see adversaries using day in and day out to compromise organizations. We hope this episode helps you track down and close those gaps in your own environments. Blog: https://offsec.blog/ Youtube: https://www.youtu...

In this week's review Uber was hacked Microsoft Teams stores auth tokens as cleartext in Windows, Linux, Macs Ransomware Developers Turn to Intermittent Encryption to Evade Detection Blog: https://offsec.blog/ Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw Twitter: https://twitter.com/cyberthreatpov Work with Us: https://securit360.com Blog: https://offsec.blog/ Youtube: ht...

In this episode Brad and Spencer talk about what mature, proactive organizations are doing to harden and secure their environments, with the end goal of forcing attackers to make more noise which hopefully leads to quicker detection and ejection from your network. These are things that get us caught and slow us down on penetration tests and they are things that will absolutely do the same to real...

In this week's review: New EvilProxy Phishing Service Allowing Cybercriminals to Bypass 2-Factor Security New Linux Malware Evades Detection Using Multi-stage Deployment Blog: https://offsec.blog/ Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw Twitter: https://twitter.com/cyberthreatpov Work with Us: https://securit360.com Blog: https://offsec.blog/ Youtube: https://www.you...

Are you sure you're getting what you paid for when it comes to external penetration tests? In this podcast Brad and Spencer discuss 5 things that you as a consumer of penetration tests can do to get more value from them. Some of these are easy wins, some of them require work, all of them will make your external pentests better. Blog: https://offsec.blog/ Youtube: https://www.youtube.com/chann...