External/Internal, Red Team Brute Forcing, Listeners, PowerShell, SET

Adding Egress Brute Force to PowerShell Payloads

Guest post* by Robert Schwass // We’ve all been there. You craft the perfect phishing email, register a great domain name, your multi handler is set up ever so perfectly. And […]

Read the entire post here

InfoSec 201 fun with social networks, kony2012, social engineering, social media mining

Mining Mary’s Social Media Antics for Social Engineering

Christine Sorensen // Let’s talk about Mary. Mary Watson is a girl in her twenties and just graduated from Midtown University with her bachelors in Fashion Merchandising. Mary is now […]

Read the entire post here

External/Internal, Red Team Burp, Duct Tape, Mechanical Engineering, password spraying, pen-testing

Downloading an Address Book from an Outlook Web App (OWA) Portal

Carrie Roberts //  Update 10/03/16: Want to download the address book automatically with PowerShell? Check out Beau Bullocks latest additions to MailSniper As part of a penetration test, you’ve gained access […]

Read the entire post here

Physical, Red Team breech, defeating access controls, getting in, insiders, olivia newton john, physical pen test, physical pen testing

Let’s Get Physical* Part 1; Defeating Wetware Access Controls

Sally Vandeven // I found myself with a little extra time one day (and I didn’t tell my project manager) so I thought it would be a great time to […]

Read the entire post here

Author, Blue Team, Blue Team Tools, John Strand ADHD, honeyports

Honeyports & ADHD!!!

John Strand // Lets take a look at how to use HoneyPorts on the new Active Defense Harbinger Distribution. For those of you who do not know, this is a […]

Read the entire post here

Author, Ethan Robish, How-To encryption, Let's Encrypt, SSL/TLS certificate

How Does Let’s Encrypt Gain Your Browser’s Trust?

Ethan Robish // Let’s Encrypt is a free service that allows you to obtain a free (as in beer) SSL/TLS domain validation certificate to use as you wish.  Here is what […]

Read the entire post here

News Darkweb Scanning, Dropbox, Election 2016, Election Fraud, Linux, network packet filtering support cgroups, OnionScan, Voter Fraud

Lawrence’s List 090216

Lawrence Hoffmann // Election fraud is something I’ve mentioned here recently. The reality we must face here is that any time a digital system is used for voting there is […]

Read the entire post here

Author, Beau Bullock, Brian Fehrman, Red Team, Red Team Tools how to bypass Anti Virus, How to bypass AV, How to bypass whitelisting, PowerShell, PowerShell without PowerShell, What to do when PowerShell is banned

Powershell Without Powershell – How To Bypass Application Whitelisting, Environment Restrictions & AV

Brian Fehrman (With shout outs to: Kelsey Bellew, Beau Bullock) // In a previous blog post, we talked about bypassing AV and Application Whitelisting by using a method developed by Casey Smith. In […]

Read the entire post here

Author, InfoSec 201, Jordan Drysdale apricorn, bash history, evading content filters with SSH, exif-tool, histcontrol, peach jam, personal google maintenance, photo scrubbing, pickles, yubico, yubikey

Reminders – Simple Security and Finding Sanity In the Digital Age

Jordan Drysdale // As I wander through life, in what now seems like a world gone entirely mad, disconnecting from digital is my newest hobby. Information overload constantly smashes us […]

Read the entire post here