Ac3lives (A-Aron)

Pen Tester / Ethical Hacker Father, Husband, and a little bit of an adrenaline junkie.

[Ac3lives (A-Aron) @ac3lives]

@UK_Daniel_Card @tazwake @EricaZelic @HackingLZ @spny811 @shotgunner101 Absolutely agreed. Was replying to Taz's comment regarding R7 and pen test services. As far as this list is concerned.. marketing rubbish

[Ac3lives (A-Aron) @ac3lives]

@tazwake @EricaZelic @HackingLZ @UK_Daniel_Card @spny811 @shotgunner101 With that said, I found this list quite amusing as well. The criteria used to grade a 'best pen test shop' does not seem to align with 'pen testing', but rather overall company offerings in the security space.

[Ac3lives (A-Aron) @ac3lives]

@tazwake @EricaZelic @HackingLZ @UK_Daniel_Card @spny811 @shotgunner101 👋Rapid7 pen tester here. Joined in 2016. Our team size is approx. 45 testers, performing traditional pen tests, red teams, purple teams, IoT, mobile, web, etc. While Rapid7 makes some great scan/test products, our team isn't a "scan and call results a pen test" shop either🙂

[Ac3lives (A-Aron) @ac3lives]

@sportss99 @gopher_marc @EndWokeness https://t.co/wZ8y4ebSQY (see pg. 10).

181,399 est. homeless in CA. 27% of the total U.S. homeless population. Also the highest number of "unsheltered" homelessness. Also in 2022's report, per 10,000 people, California had 43.95 homeless, which was the highest state.

[Ac3lives (A-Aron) @ac3lives]

@GrrCON Where ever @Badgerops gets their plextrac shirts from is my vote.

[Ac3lives (A-Aron) @ac3lives]

@vysecurity @todb Typically this resulted in a meeting with client, vendor, and ourselves to discuss the CVE, how it impacted the client, and provide any demos. Our Sagex3 unauth RCE was an example of this and it went very smoothly. Happy client, happy product vendor.

[Ac3lives (A-Aron) @ac3lives]

@vysecurity We ask to partner with the client in CVE disclosure. They use their relationship and financial contract with the vendor to file an issue, and our company as a CNA will register the CVE and handle technical disclosure. thankfully we used to have @todb to champion it all. /1

[Ac3lives (A-Aron) @ac3lives]

@lpha3ch0 It's been forever since using D2JS, but iirc, you're going to need a 32bit payload. Also, try GadgetToJScript instead.

[Ac3lives (A-Aron) @ac3lives]

@424f424f @lpha3ch0 (2) at least this is how it was in 2018. So many IT employee hashes collected 😅. I also like to do this on open SMTP relays internally, or if I compromise a user's email. Default config trusts and downloads images automatically from senders in the same organization

[Ac3lives (A-Aron) @ac3lives]

@424f424f @lpha3ch0 A fun side note on rendering the image. If the email is an apparent phishing email and the recipient just forwards it to infosec or IT to report it, outlook will download the image when fwding. The email will also become trusted, and auto download in the IT/IS clients on open (1)

[Ac3lives (A-Aron) @ac3lives]

@TheGamblingBird @GrrCON Thank you for the kind words, and attending my talk!

[Ac3lives (A-Aron) @ac3lives]

@Darklightnin1 Hey! Sorry for my delay, I did promise to drop them, but my last two weeks got away form me. Here they are: https://t.co/E58mS3GW8l

[Ac3lives (A-Aron) @ac3lives]

As mentioned during my GrrCon talk, here are my slides for "Phishing with payloads: A crash course in EDR and EPP Evasion" @GrrCON https://t.co/E58mS3GW8l

[Ac3lives (A-Aron) @ac3lives]

Unauthenticated RCE as SYSTEM in Sage X3 AdxDSrv service (Default service port is 1818). This was a fun one.
https://t.co/qgme5oEk2O

[Ac3lives (A-Aron) @ac3lives]

Generates common payload stager types (.docm, .xlsm, .accde, .hta, .hta using G2JS). Hosts them on a server. Stagers simply call back to the server to indicate if they ran. A quick way on a white box test to validate payload exec possibilities with clients https://t.co/gnQ90S4tez

[Ac3lives (A-Aron) @ac3lives]

@atlaycock @SwiftOnSecurity Most pen test companies adhere to this. Also a signed paper from someone in the C-level or with authority to approve the engagement is kept on person at all times. The statement of work clearly defines all activities conducted during testing.

[Ac3lives (A-Aron) @ac3lives]

@atlaycock @SwiftOnSecurity When we do PSE engagements, the base rules are:
All armed guards present must be aware of the test.
Automated alarm systems need to have a stop in procedure before police are called, to call our point of contact.
Point of contact must be 'on call' all night incase 💩 hits the fan

[Ac3lives (A-Aron) @ac3lives]

@RomanTheEmperor Hey Roman!
I'm thinking I have to pass this year, as much as I want to attend and speak. Lots of traveling for work lately, with multiple out of state jobs scheduled for this fourth quarter. I really appreciate the invite again, and hope to make a future event!

[Ac3lives (A-Aron) @ac3lives]

@AletheDenis @whitneynmaxwell @rapid7 @defcon209 National collegiate cyber defense competition. (Nccdc). Colleges can enter for their state competition. It's a cool competition! Red and blue activities involved.

[Ac3lives (A-Aron) @ac3lives]

Lots of questions asked on today's @Rapid7 Ask a Pen Tester anything webcast with myself and @whitneynmaxwell . Couldn't get to all of them, had to pick some generics given time and audience, but if you have any questions you wanted answered, feel free to DM me!