Penetration testing, adversary simulation, red teaming, purple teaming, rainbow teaming, call if what you like, the security outcome we are working towards is:
- Improved Security Posture
- Assurance of security investments and controls
- Enablement of information sharing
- Collaboration and Understanding
- Identification of strengths and weaknesses
- Optimization and Improvement Opportunities
This is to support the organisations mission, vision, goals, and objectives. Cyber security is to support and enable the organisation’s capability to execute digital services in a safe manner.Read more “Practical Security Assurance”
Oh that’s “just a Nessus scan” or that’s not a real pen test etc. is something that if you are in the infosec/cyber world for a few minutes you will probably hear.
It’s honestly a bit odd, some sort of way of diminishing something because a tool was used, which doesn’t really make a whole lot of sense given most activity involves using something that already exists (sure there are fields and scenarios where this isn’t true but I’m generalising).
So why are we as an industry obsessed with tools and obsessed with berating people for using them? It’s all rather odd.
It perhaps ties in with this Cyber Myth about penetration testing being the tool that’s good and useful in every scenario… I hate to break it to people, but it’s not the principles of security and it certainly isn’t the best/most appropriate “tool” in every scenario. Read more “When running Nessus is a good thing!”
Exploitation of common windows services is an important area of knowledge for both offense and defence.
- Server Message Block (SMB)
- Remote Desktop Protocol (RDP)
- Windows Management Instrumentation (WMI)
- Windows Remote Management (WinRM)
- File Transfer Protocol (FTP)
Other common technology platforms in the Windows Stack Include
- Active Directory Domain Services (ADDS)
- Active Directory Certificate Services (ADCS)
- Internet Information Services (IIS)
- Microsoft SQL Server (MSSQL)
For now I’m just going to look at a few of the common protocols and vectors.Read more “Common Windows Services”
When running honeypots you never have to wait too long for something to drop!
This moring we had a new hit in the pot, so I decided to invesigate but also to blog and show how we could go about investigating the logs and paylods etc.Read more “Learn to SOC: Java Webshell via confluence”
So as always there are a million things in tech and well it’s rare that someone knows EVERYTHING. I must connect to a Wireguard VPN from a KALI VM. Should be simple, well actually it was a bit more complicated as I had two errors along the way!Read more “Wireguard Client for Linux on KALI”
I created a PDF notebook a while ago when I decided on a whim to to the Pentest+. I have quite a few people ask me about getting into cyber security and well, you know when I was younger this stuff was just called IT mainly (IT + Infosec) so I thought let’s go test out the Pentest+. I did the course and exam in a week (whilst writing the notebook) (don’t think that’s a good idea but my objectives were more to make sure if I think it’s any good or not). Pleased to say I thought the course was good (I used pluralsight at 1.x speed) and the exam was fun (for an exam).
Hopefully this helps people explore the some of the world of offensive security and appsec. Read more “mRr3b00ts Pentest Plus Study Notebook”
If we have high privilege access to a domain, we will likely want to establish persistence with high privilege access. One mechanism to do this is to assign ourselves permissions to the adminSDHolder object in active directory:
Here we have the default adminSDHolder permissions. We are going to add our user “low” in here with modify or full control permissions: Read more “Abusing AdminSDHolder to enable a Domain Backdoor”
Some hashes are obvious but even then, it’s a good job to check. There are a few ways to check a hash outside of manual validation.
Using the Hashcat example list:
Using cyberchef Analyse hash:
As you can see there are range of tools available to you, and remember if you want to keep the hashes to yourself you can download Cyberchef and run it locally!