Pentesting

Informational Nessus, pentest, Pentesting, Vulnerability Scanning, vulnerability scans

What to Expect from a Vulnerability Scan

Dakota Nelson// For a lot of our customers, their first introduction to pentesting is a vulnerability scan from BHIS. This is after talking to the testers, of course, and setting […]

Read the entire post here

Author, Jordan Drysdale, Physical, Red Team Badgy, Jordan Drysdale, pen-testing, penetration testing, pentest, Pentesting, Physical Pentest

Performing a Physical Pentest? Bring This!

Jordan Drysdale// Physical Pentest Upcoming? Bring a Badgy. While badge reproduction may not be the intended use of this product, if you are a physical tester and you don’t own […]

Read the entire post here

Author, Brian Fehrman, External/Internal, Red Team Application Whitelisting, escalated, penetration testing, Pentesting, privilege escalation, whitelisting, Windows, Windows Privilege Escalation

Digging Deeper into Vulnerable Windows Services

Brian Fehrman // Privilege escalation is a common goal for threat actors after they have compromised a system. Having elevated permissions can allow for tasks such as: extracting local password-hashes, […]

Read the entire post here

Author, C2, Joff Thyer, Red Team anti-virus, AV software, C2, easy button, pen-testing, penetration testing, pentest, Pentesting, Symantec, There is NO easy button

A Morning with Cobalt Strike & Symantec

Joff Thyer // If you have been penetration testing a while, you likely have ended up in a Red Team situation or will be engaged in it soon enough. From […]

Read the entire post here

Red Team, Red Team Tools how to hide payload in MS docs, Malware, Microsoft, MS Word, pen-testing, penetration testing, pentest, Pentesting, Pentesting tips and tricks, PowerShell, PowerShell Scripts, Word

Hide Payload in MS Office Document Properties

Carrie Roberts* // Can you think of a reason why you might want to put a lengthy comment into the properties of an MS Office document? If you can, then […]

Read the entire post here

Author, Beau Bullock, Blue Team, Blue Team Tools, Webcasts CredDefense, defense, defensive tool, Pentesting, tool, toolkit

WEBCAST: CredDefense Toolkit

Beau Bullock, Brian Fehrman, & Derek Banks // Pentesting organizations as your day-to-day job quickly reveals commonalities among environments. Although each test is a bit unique, there’s a typical path […]

Read the entire post here

Author, Blue Team, Blue Team Tools, Derek Banks CredDefense, CredDefense Toolkid, End Point Log Consolidation, HoneyToken, kerberoasting, Pentesting, tool, WEF, Windows, Windows Event Forwarder

End-Point Log Consolidation with Windows Event Forwarder

Derek Banks // I want to expand on our previous blog post on consolidated endpoint event logging and use Windows Event Forwarding and live off the Microsoft land for shipping […]

Read the entire post here

Author, Beau Bullock, Blue Team, Blue Team Tools, Brian Fehrman Cred Defense Tool Kit, CredDefense, CredDefense Toolkit, event log consolidation, hardening accounts, kerberoasting, password auditing, password spraying, Pentesting, ResponderGuard

The CredDefense Toolkit

Derek Banks, Beau Bullock, & Brian Fehrman // Our clients often ask how they could have detected and prevented the post-exploitation activities we used in their environment to gain elevated […]

Read the entire post here

Author, Brian King, General InfoSec Tips & Tricks, InfoSec 201 Firefox, Firefox extentions, HTTP, penetreation testing, Pentesting, quieter Firefox, tool, webapp test

Towards a Quieter Firefox

Brian King // On a recent webapp test, I got a little frustrated with all the extra HTTP requests showing up in my Burpsuite Proxy History from connections that Firefox […]

Read the entire post here