Today’s tale of pentest pwnage is all about my new favorite attack called SPN-less RBCD. We did a teaser episode last week that actually ended up being a full episode all about the attack, and even step by step commands to pull it off.  But I didn’t want today’s episode to just be “Hey friends, check out the YouTube version of this attack!” so I also cover:

• Our first first impressions of Burp Enterprise
• Why I have a real hard time believing you have to follow all these steps to install Kali on Proxmox

Today’s prelude to a tale of pentest pwnage talks about something called “spnless RBCD” (resource-based constrained delegation).  The show notes don't format well here in the podcast notes, so head to 7minsec.com to see the notes in all their glory.

Sadly, the Broadcom acquisition of VMWare has hit 7MinSec hard – we love running ESXi on our NUCs, but ESXi free is no longer available.  To add insult to injury, our vCenter lab at OVHcloud HQ got a huge price gouge (due to license cost increase; not OVH’s fault).  Now we’re exploring Proxmox as an alternative hypervisor, so we’re using today’s episode to kick off a series about the joys and pains of this migration process.

Today we revisit a series about eating the security dog food – in other words, practicing what we preach as security gurus!  Specifically we talk about:

• We’re going to get a third-party assessment on 7MinSec (the business)
• Tips for secure email backup/storage
• Limiting the retention of sensitive data you store in cloud places

Today we’re talking about tips to deal with stress and anxiety:

• It sounds basic, but take breaks – and take them in a different place (don’t just stay in the office and do more screen/doom-scrolling)
• I’ve never gotten to a place in my workload where I go “Ahhh, all caught up!” so I should stop striving to hit that invisible goal.
• Chiropractic and back massages have done wonders for the tightness in my neck and shoulders
• For me, video games where you punch and kick things relieves stress as well (including a specific game that’s definitely not for kids!)

We did something crazy today and recorded an episode that was 7 minutes long!  Today we talk about some things that have helped us out in recent pentests:

• When using Farmer to create “trap” files that coerce authentication, I’ve found way better results using Windows Search Connectors (.searchConnector-ms) files
• This matrix of “can I relay this to that” has been super helpful, especially early in engagements

Today’s episode is all about writing reports in Sysreptor.  It’s awesome!  Main takeaways:

• The price is free (they have a paid version as well)!
• You can send findings and artifacts directly to the report server using the reptor Python module
• Warning: Sysreptor only exports to PDF (no Word version option!)
• Sysreptor has helped us write reports faster without sacrificing quality

Hey friends, today we’ve got a tale of pentest pwnage that covers:

• Passwords – make sure to look for patterns such as keyboard walks, as well as people who are picking passwords where the month the password changed is part of the password (say that five times fast)!
• Making sure you go after cached credentials
• Attacking SCCM – Misconfiguration Manager is an absolute gem to read, and The First Cred is the Deepest – Part 2 with Gabriel Prud’homme is an absolute gem to see.  Also, check out sccmhunter for all your SCCM pwnage needs.

Hey friends, today we have a super fun interview with Andrew Morris of GreyNoise to share.  Andrew chatted with us about:

• Young Andrew’s early adventures in hacking his school’s infrastructure (note: don’t try this at home, kids!)
• Meeting a pentester for the first time, and getting his first pentesting job
• Spinning up a box on the internet, having it get popped instantly, and wondering…”Are all these people trying to hack me?”
• Battling through a pentester’s least favorite part of the job: THE REPORT!
• GreyNoise’s origin story
• How to build a better honeypot/honeynet

Hey friends, sorry I’m so late with this (er, last) week’s episode but I’m back!  Today is more of a prep for tales of pentest pwnage, but topics covered include:

• Make sure when you’re snafflin‘ that you check for encrypted/obfuscated logins and login strings – it might not be too tough to decrypt them!
• On the defensive side, I’ve found myself getting *blocked* doing things like SharpHound runs, Snaffler, PowerHuntShares, etc.  Look through the readme files for these tools and try cranking down the intensity/threads of these tools and you might fly under the radar.

• How much fun I had attending and speaking at Netwrix Connect
• Being a sales guy in conference situations without being an annoying sales guy in conference situations
• A recap of the talk I co-presented about high profile breaches and lessons we can learn from them