Traditional pentesting v. continuous pentesting

We get a lot of questions about what makes continuous penetration testing more valuable than traditional timebox testing. Seriously, A LOT of questions – all of which are warranted.

Take a look below, and we’re pretty sure you’ll see the benefits when the two methods are stacked side-by-side.

Read More...

Never stop frontin: How to quickly setup a redirector and transparent reverse proxy

Protecting your infrastructure from prying eyes is an important part of landing a phish and maintaining access to a client’s network. The process of setting up redirectors and reverse proxies has traditionally been difficult and hard to automate across different cloud platforms.

Today, we’re going to solve that problem with our new repository, sneaky_proxy, which will allow you to automate your efforts.

Read More...

CPT in the wild: 3 real-world examples that prove its value

We get it, regular ol’ once-a-year penetration testing is the norm. It’s what your company has budgeted for, what you’re IT team is used to, and in many cases, what your expected to do. But that doesn’t mean it’s the best way to protect your network.

Think about this: Why would you test your network security from emerging cyber-security threats only once a year. That’s like picking a random day and turning on your home’s security system. Yea, you’re safe for a moment – but only for a point in time.

Read More...

The ultimate tag team: PetitPotam and ADCS pwnage from Linux

PetitPotam and ADCS exploitation are nothing short of amazing. Exploitation is a breeze and results in full domain admin access.

With these two TTPs, an attacker can hop on a network, exploit the vulnerability, do some command-line magic and have local administrator privileges on a domain controller in under 15 minutes. So far, no one has detailed the exploitation process fully on Linux and that’s what we’re going to do today.

Read More...

#PrintNightmare – Is your company protected from this Print Spooler vulnerability?

Hey, you love printers right? They’re that reliable, steadfast piece of technology that always seems to work and never gives you any headaches ... right? Well, buckle up.

Microsoft is releasing emergency security patches to address a critical privilege escalation and remote code execution vulnerability found within the Print Spooler service.

Read More...

How to limit cleartext password storage and fix the issue in your organization

The key to our engagements often and unfortunately involve the discovery of credentials on internal network file shares. We’re going to show you how we find cleartext password storage problems and how to address them.

Read More...

Never had a bad day phishing. How to set up GoPhish to evade security controls.

I’m going to quickly go through the process of setting up GoPhish and show you how we evade defenders to increase the success rate of our phishing campaigns.

Read More...

Fourteen good reasons to require 14-character passwords

Password. Password123. Yea, you’ve seen them all when it comes to bad passwords. It comes standard when managing IT security.

But while your organization likely requires special characters, uppercase letters and even a number or two, if you don’t require longer passwords you’re not taking one of the most important steps to protect your network.

We’ve laid out 14 credible reasons to require everyone in your organization to use 14-character passwords. We’re pretty sure you’ll be convinced. If not, long live Password123.

Read More...

VIDEO: How Continuous Penetration Testing Works (the best)

Trying to wrap your head around what separates Continuous Penetration Testing from other forms of network security testing? Well, we get it.

That’s why we’ve put together this handy little video. Sit back, have a snack and learn how CPT works, why it’s advantageous and how it can help you keep your organization’s network safe.

Read More...

What the heck is an attack surface … and why do I need to protect it?

Maybe you’ve heard your IT security team talking about attack surfaces? Or, maybe the term has come up during a virtual conference or in your newsfeed. It’s important to take a step back and understand what an attack surface is and why you need to protect it.

Read More...