7 Minute Security

This podcast is sponsored by Arctic Wolf, whose Concierge Security teams Monitor, Detect and Respond to Cyber threats 24/7 for thousands of customers around the world. Arctic Wolf. Redefining cybersecurity. Visit  Arcticwolf.com/7MS  to learn more. In today's episode we talk more about eating the security dog food (following the best practices we preach!). Specifically, we focus on keeping that bl...

SafePass.me is the only enterprise solution to protect organizations against credential stuffing and password spraying attacks. Visit SafePass.me for more details, and tell them 7 Minute Security sent you to get a 10% discount! Today we talk about configuring your Active Directory with MFA protection thanks to  AuthLite . In the tangent department, we give you a short, non-spoilery review of the f...

Today we're excited to kick off a new series all about blue team bliss - in other words, we're talking about pentest stories where the blue team controls kicked our butt a little bit! Topics include: The  ms-ds-machineaccount-quota  value is not an "all or nothing" option! Check out  Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment...

Today we revisit a series we haven't touched  in a long time  all about eating the security dog food. TLDL about this series is I often find myself preaching security best practices, but don't always follow them as a consultancy. So today we talk about: How the internal 7MS infosec policy development is coming along Why I'm no longer going to be "product agnostic" going forward Some first impressi...

Hey friends! Today we're giving you a first impressions episode all about  Airlock Digital , an application allowlisting solution. They were kind enough to let us play with it in our lab with the intention of exploring its bells and whistles, so we're excited to report back our findings in podcast form. TLDL: we really like this solution! It is easy to deploy (see  this YouTube video  for a quick...

In today's episode we share some tips we've picked up in the last few weeks of pentesting, with hopes it will save you from at least a few rounds of smashing your face into the keyboard. Tips include: If you find yourself with "owns" rights to a bajillion hosts in BloodHound, this query will give you a nice list of those systems, one system per line: cat export-from-bloodhound.json | jq '.nodes[]....

Today we're so excited to welcome  Amanda Berlin , Lead Incident Detection Engineer at  Blumira , back to the show (did you miss Amanda's first appearance on the show?  Check it out  here )!  You might already be familiar with Amanda's awesome  Defensive Security Handbook  or her work with the  Mental Health Hackers  organization.  Today we virtually sat down to tackle a variety of topics and ques...

Today's episode covers three remediation-focused topics that kind of grind my gears and/or get me frustrated with myself. I'm curious for your thoughts on these, so reach out via  Slack  or  Twitter  and maybe we'll do a future  live stream  on this topic. How do you get clients to actually  care  when we explain the threats on their network that are a  literal  10/10 on the CVSS scale? Password p...

Hey friends, today we share the (hopefully) thrilling conclusion of  last week's pentest . Here are some key points: If you find you have local admin on a bunch of privileges and want to quickly loop through a secretsdump of ALL systems and save the output to a text file, this little hacky script will do it! #!/bin/bash File="localadmin.txt" Lines=$(cat $File) for Line in $Lines do echo --- $Line...

Ok, ok, I know.  I almost always say something like "Today is my favorite tale of pentest pwnage."  And guess what?  Today  is  my favorite tale of pentest pwnage, and I don't even know how it's going to end yet, so stay tuned to next week's (hopefully) exciting conclusion.  For today, though, I've got some pentest tips to hopefully help you in your journeys of pwnage: PowerHuntShares  is awesome...

Hey friends, wow...we're up to  thirty-nine  episodes of pwnage? Should we make a cake when we hit the big  4-0 ?! Anyway, today's TLDL is this: If you get a nagging suspicion about something you find during enumeration, make sure to either come back to it later, or exhaust the path right away so you don't miss something! Because I did :-/ A tip that's been helping me speed along my use of  CrackM...

Today we're joined by some of our friends at Arctic Wolf - Eugene Grant and Christopher Fielder - to talk about compliance. Now hold on - don't leave yet! I know for many folks, compliance makes them want to bleach their eyeballs. But compliance is super important - especially because it is  not  the same as being secure. So we discuss the differences between security and compliance, and practical...

Hey friends, we have another fun tale of pwnage for you today. I loved this one because I got to learn some new tools I hadn't used before, such as: Get-InternalSubnets.ps1  - for getting internal subnets Adalanche  for grabbing Active Directory info (similar to SharpHound) This tool worked well for me with this syntax: adalanche-windows-x64-v2022.5.19.exe collect activedirectory --domain victim.d...

Today we're featuring a great interview with Matthew Warner, CTO and co-founder of  Blumira . You might remember Matt from such podcasts as  this one ) when Matt gave us a fountain of info on why out-of-the-box Windows logging isn't awesome, and how to get it turned up to 11! Today, we talk about a cool report that Blumira put out called  2022 Blumira's State of Detection & Response , and dive int...

In today's episode, I try to get us thinking about our extended family's emergency/DR plan. Why? Because I recently had a close family member suffer a health scare, and it brought to light some questions we didn't have all the answers for: Do we have creds to log onto his computer? How about his email accounts? Do we have usernames/passwords for retirement accounts, bank accounts, etc.? For vehicl...

In today's episode we talk about  Purple Knight , a free tool to help assess your organization's Active Directory security. I stuck Purple Knight in our  Light Pentest LITE pentest training lab  and did an informal compare-and-contrast of its detection capabilities versus  PingCastle , which we talked about in depth in  episode #489 . 

Today's another fun tale of pentest pwnage - specifically focused on cracking a hash type I'd never paid much attention to before:  cached domain credentials . I also learned that you can at least partially protect against this type of hash being captured by checking out  this article , which has you set the following setting in GPO: Under  Computer Configuration > Policies > Windows Settings > Se...

Today we're sharing an updates to  episode #512  where we ran Rapid7's  InsightIDR  through a bunch of attacks: Active Directory enumeration via  SharpHound Password spraying through  Rubeus Kerberoasting and ASREPRoasting via  Rubeus Network protocol poisoning with  Inveigh . Looking for a free way to detect protocol poisoning? Check out  CanaryPi . Hash dumping using  Impacket . I also talk abou...

I'm extra psyched today, because today's episode (which is all about updating your VMWare ESXi version via command line) is complemented by  video : https://www.youtube.com/watch?v=0-XAO32LEPY Shortly after recording this video, I found  this awesome article  which walks you through a different way to tackle these updates: List all upgrade profiles: esxcli software sources profile list --depot=htt...

Well friends, it has been a while since we talked about Microsoft's awesome  Local Administrator Password Solution  - specifically, the last time was  way back in 2017 ! Lately I've been training some companies on how to install it by giving them a live walkthrough in our  Light Pentest LITE  lab, so I thought it would be a good time to write up a refreshed, down and dirty install guide. Here we g...

Hey friends, a while back in  episode #505  we talked about pwning wifi PSKs and PMKIDs with Bettercap. Today I'm revisiting that with even some more fun command line kung fu to help you zero in on  just  the networks you're interested in and filter out a bunch of noisy events from  bettercap in the process.

Hey friends! Today's another swell tale of pentest pwnage, and it's probably my favorite one yet (again)! This tale involves  resource based constrained delegation , which is just jolly good evil fun! Here are my quick notes for pwning things using RBCD: # From non-domain joined machine, get a cmd.exe running in the context of a user with ownership rights over a victim system: runas /netonly /user...

Hey friends, today we're giving another peek behind the curtain of what it's like to run a cybersecurity consultancy. Topics include: Setting the right communication cadence - and communication channels - with a customer during a pentest. Tips for collaborating well with contractors so that the customer experience feels like "a single human pane of glass" (insert barf emoji here). How we're using ...

Hey friends, it's another fun tale of pentest pwnage today! This one talks about cool things you can do when you have full rights over an OU in Active Directory. Important links to review: BloodHound edges DACL Trouble: Generic All on OUs AD prep bug in Windows Server 2016

Today we're pumped to share a featured interview with  Amanda Berlin , Lead Incident Detection Engineer at  Blumira . You might already be familiar with Amanda's awesome  Defensive Security Handbook  or fine work with  Mental Health Hackers . We polled our  Slack  friends and structured this interview as an AAA (Ask Amanda Anything). That resulted in a really fun chat that covered many things tech...