We’ve got an smb vuln and now an RCE in word. Next up @hdmoore is gonna release this cool framework called Metasploit
2000s baby. They are back https://t.co/EbkanOYfxn
If you actually want to work in detection. Please make an effort to understand the data sources you are using.
It's not EventID==X or CommandLine contains Y, just because you executed malware in your lab and checked the event log. 😭
Here a couple to think about
- Understand how event id are not unique across providers
- CommandLine can be spoofed, and you should know how easy it is.
- ETW offers a lot of hidden gems. Learn more and explore it.
- The registry contains a lot of hard to spoof evidence.
- A technique is not linked to a tool
It’s really hard to be a good internal pentester if you’ve never walked in the shoes of a sysadmin or if you’ve never been in an IT support role.
You may be able to run some tools, find vulns and even “get DA” but that’s where your effectiveness will end. That’s the easy part..
What about when questions come up about the finding or how to remediate it?
What about when something you do causes issues?
What about when the client asks how to make X thing better?
Internal pentesting is weird for me because I attribute so much of my “success” to my IT support/sysadmin days.
seriously annoyed
fresh linux, all of my peripherals, wireless devices, bluetooth devices, wi-fi, headset, mic, sound, all the games I enjoy, my whole dev setup
all worked first time zero config zero setup zero installers
where's the fight gone man
new blogpost time!!
this one's a fun writeup on a vulnerability chain i found across multiple google services that earned me a $4133.70 bounty
lots of fun css as usual! i had to recreate a bunch of drive/docs/gmail/youtube UIs c:
have fun!
https://t.co/64ZAIVHoSO
Love a good client-side exploit chain! This crazy cross-product chain targeting Google by @rebane2001 is a great example of the type of exploit that gets easier the longer you spend targeting a single company
https://t.co/mxhH2N7teW