Blog
Search all our posts or browse some of our most recent entries below:
7MS #599: Baby’s First Responsible Disclosure
Today we talk about our first experience working through the responsible disclosure process after finding vulnerabilities in a security product. We cannot share a whole lot of details as of right now, but wanted to give you some insight into the testing/reporting process thus far, which includes the use of:BulletsPassViewMITMsmtpmitmproxy
7MS #598: Hacking Billy Madison – Part 4
Today our good buddy Paul and I keep trying to hack the VulnHub machine based on the movie Billy Madison (see part 1 and 2 and 3). In today's final chapter, Paul and I:Find Eric's secret SSH back doorLocate and decrypt a hidden file with Billy's homeworkBuild wordlists with cewlSave Billy from the evil clutches of Eric Gordon!!!
7MS #597: Let’s JAMBOREE (Java-Android-Magisk-Burp-Objection-Root-Emulator-Easy) with Robert McCurdy
Today we had a blast talking with Robert McCurdy about JAMBOREE (Java-Android-Magisk-Burp-Objection-Root-Emulator-Easy)! JAMBOREE allows you to quickly spin up a portable Git/Python/Java environment and much more! From a pentesting POV, you can whip up an Android pentesting environment, BloodHound/SharpHound combo, Burp Suite...give it a spin!
7MS #596: How to Succeed in Business Without Really Crying – Part 13
After about a year break (last edition of this series was in October, 2022, we're back with an updated episode of How to Succeed in Business Without Really Crying. We cover:Why we're not planning on selling the business any time soonFast Google Dorks ScanUsing ProtonVPN via command lineOur pre first impressions of a pentesting SaaS tool you've almost definitely heard of
7MS #595: Choosing the Right XDR Strategy with Matt Warner of Blumira
Today we're joined by Matt Warner of Blumira (remember him from episodes #551 and #529 and #507?) to talk about choosing the right XDR strategy! There's a lot to unpack here. Are EDR, MDR and XDR related? Can you get them all from one vendor - and should you? Do you run them on-prem, in the cloud, or both? Join us as Matt answers these [...]
7MS #594: Using PatchMyPC to Auto-Update Pentest Dropboxes
Today we're talking about how you can use PatchMyPC to keep your home PC and/or pentest dropbox automatically updated with the latest/greatest patches!
7MS #593: Hacking Billy Madison – Part 3
Hey friends, today my Paul and I kept trying to hack the VulnHub machine based on the movie Billy Madison (see part 1 and 2). In our journey we learned some good stuff:Port knocking is awesome using utilities like knock:/opt/knock/knock 10.0.7.124 1466 67 1469 1514 1981 1986Sending emails via command line is made (fairly) easy with swaks:swaks --to eric@madisonhotels.com --from vvaughn@polyfector.edu --server 192.168.110.105:2525 --body "My [...]
7MS #592: 7 Steps to Recover Your Hacked Facebook Account
Today we're talking about 7 steps you can take to (hopefully) reclaim a hacked Facebook account. The key steps are:Ask Facebook for help (good luck with that)Put out an SOS on your socialsFlag down the FBICall the cops!Grumble to your attorney generalHave patienceLock it down (once you get the account back)!Also, I have to say that this article was a fantastic resource in helping me [...]
7MS #591: Tales of Pentest Pwnage – Part 52
Today we talk about an awesome path to internal network pentest pwnage using downgraded authentication from a domain controller, a tool called ntlmv1-multi, and a boatload of cloud-cracking power on the cheap from vast.ai. Here's my chicken scratch notes for how to take the downgraded authentication hash capture (using Responder.py -I eth0 --lm) and eventually tweeze out the NTLM hash of the domain controller. Let's [...]
7MS #590: Hacking Billy Madison – Part 2
Today my Paul and I continued hacking Billy Madison (see part one here) and learned some interesting things:You can fuzz a URL with a specific file type using a format like this:wfuzz -c -z file,/root/Desktop/wordlist.txt --hc 404 http://x.x.x.x/FUZZ.capTo rip .cap files apart and make them "pretty" you can use tpick:tcpick -C -yP -r tcp_dump.pcapOr tcpflow:apt install tcpflowtcpflow -rTo do port knocking, you can use the [...]
7MS #589: Tales of Pentest Pwnage – Part 51
In today's tale of pentest pwnage we talk about:The importance of local admin and how access to even one server might mean instant, full control over their backup or virtualization infrastructureCopying files via WinRM when copying over SMB is blocked:$sess = New-PSSession -Computername SERVER-I-HAVE-LOCAL-ADMIN-ACCESS-ON -Credential *...then provide your creds...and then:copy-item c:\superimportantfile.doc -destination c:\my-local-hard-drive\superimportantfile.doc -fromsession $sessIf you come across PowerShell code that crafts a secure string [...]