Organizations are implementing two-factor on more and more web services. The traditional methods for phishing credentials is no longer good enough to gain access to user accounts if 2FA is setup. In this episode Mike Felch (@ustayready) and Beau Bullock (@dafthack) demonstrate a tool that Mike wrote called CredSniper that assists in cloning portals for […]
In this episode of Tradecraft Security Weekly hosts Beau Bullock (@dafthack) and Mike Felch (@ustayready) discuss methods for evading network-based detection mechanisms. Many commercial IDS/IPS devices do a pretty decent job of detecting standard pentesting tools like Nmap when no evasion options are used. Additionally, companies are doing a better job at detecting and blocking […]
In the news, Cisco hardcoded passwords, Kali on Windows, Equifax recovers $114 million on $26.5 million in expenses from breach, and more on this episode of Paul’s Security Weekly! Larry’s Stories Cisco hardcoded passwords Memcahed DDoS will be a big deal – and some more, and a killswitch CTFR – Subdomain bruteforcing via TLS certificate transparency….scripted] Kali on windows […]
After getting a shell on a server you may or may not have root access. To gain privileged access to a Linux system it may take performing more analysis of the system to find escalation issues. In this episode of Tradecraft Security Weekly Beau Bullock (@dafthack) provides a methodology for performing various privilege escalation techniques […]
Paul reports on a flaw found in Dirty COW patch, Apache Software security updates, more hacks in 2018, and a MailSploit e-mail spoofing flaw! Jason Wood joins us to give expert commentary on a Federal Data Breach Legislation, and more on this episode of Hack Naked News! News Flaw Found In Dirty COW Patch – A […]
In this episode of Tradecraft Security Weekly, Mike Felch talks with Beau Bullock about the possibilities of using framesets in MS Office documents to send Windows password hashes remotely across the Internet. This technique has the ability to bypass many common security controls, so be sure to add it to your red team toolboxes. Mike […]
Joe Vest and Andrew Chiles from MINIS talk about Borrowing data to hide binaries. Joe Vest is the Co-Founder of the security consulting company MINIS LLC. He has over 17 years’ experience with a focus on red teaming, penetration testing, and application security. Joe is the co-author of the SANS SEC564 Red Teaming and Threat […]
Paul talks about Equifax, TPMs security flaw in Infineon smart cards, Google removes more malicious Chrome extensions from Web Store, a Linux Kernel Privilege Escalation bug discovered, and Equifax. Don Pezet from ITProTV joins us for the expert commentary. Stay tuned, on this episode of Hack Naked News! Full Show Notes Visit our website for […]
The internet isn’t ready for DNS sec, Netgear patches away, Whole Foods is the latest victim of a credit card breach, and more. Ferruh Mavituna and Sven Morgenroth of Netsparker join us to discuss Apache Struts vulnerability and the Equifax breach on this episode of Hack Naked News! News ICANN Postpones Scheduled DNS Crypto Key […]
If you are a penetration tester password cracking is something you will inevitably do. On most engagements we typically don’t have months on end to crack passwords. In an effort to help be more efficient in your cracking techniques Beau Bullock (@dafthack) describes various ways to streamline your approach to cracking in episode 17 of […]
