Joff Thyer // This post is cross-posted from Packet Header on 3/1/16. __________ On Security Weekly Episode 452, I presented a technical segment on how to build your own small office/home office wired router. This blog post will list of the essential components, and expand upon the technical segment. Our goal is to build […]
Derek Banks // John’s hating on threat intelligence feeds post got me thinking. As a former blue team member that is now solidly purple team, I do not hate threat intelligence (sorry, John). But, I am not going to disagree with John’s take (and not just because he signs my paychecks), because he’s right. […]
Carrie Roberts // In information security, what is the difference between a vulnerability assessment and a penetration test? A penetration test is a vulnerability assessment with the addition of exploitation attempts and manual investigation. A penetration test is not a subset of a vulnerability test, it is an addition to it and has the following […]
Brian King // There’s a one-liner password spray script that a lot of folks use to see if anyone on a domain is using a bad password like LetMeIn! or Winter2015. It reads a list of users from a file, a list of passwords (or just one password, if you’ve got a healthy streak of […]
Lawrence Hoffman // Today I’ll walk through the process I use to verify ISO images before I install them. If you downloaded Linux Mint 17.3 Cinnamon on February 20th there’s some chance that you obtained an ISO with malware installed. The Linux Mint team posted notification on their blog on February 21st at around 2:00 […]
Brian Fehrman // External and Internal vulnerability scans are often part of any penetration test. Automated scanning tools, however, can’t always find the “good stuff.” Many times, some of the worst things that we find are in the results marked as Low-Severity or Informational in nature. It can be as easy as just visiting a […]
Carrie Roberts // *Guest Blog It is important to ensure that your external mail servers are properly configured to not support open relaying of mail. An open mail relay can be abused by spammers, eating up your resources and landing you on a blacklist. It is not too common to find completely open mail relays […]
Beau Bullock // This is part two of a series of posts (See part 1 here) where I am detailing multiple ways to gain access to domain user credentials without ever being on a target organization’s network. The first method involves exploiting password reuse issues where a user might have reused the same password they used for […]
Beau Bullock // In this series of posts I am going to detail multiple ways to gain access to domain user credentials without ever being on a target organization’s network. The first method involves exploiting password reuse issues where a user might have reused the same password they used for their corporate domain account on […]
