Password spraying and MFA bypasses in the modern security landscape

Any offensive security operator will tell you that guessing employee credentials is key to compromising your customer’s network – and therefore highlighting vulnerabilities – during a cyber-security engagement. The thing is, it’s easier said than done as companies increasingly continue to transition to cloud services such as Microsoft Office 365 (O365) – all of which provide multi-factor authentication (MFA)

Read More...

Crossing the Log4j Horizon - A Vulnerability With No Return

In this article, we are going to exploit Log4j vulnerabilities in VMWare Horizon, get a reverse shell, and leverage our access to add a backdoor to the VMBlastSG framework. We have also made available a GitHub repository that automates the exploitation process.

Read More...

Another Log4j on the fire: Unifi

By now, you’re probably well aware of a recently disclosed vulnerability for the Java logging library, Log4j. The vulnerability is wide-reaching and affects Ubiquiti's Unifi Network Application.

In this article, we’re going to break down the exploitation process and touch on some post-exploitation methods for leveraging access to the underlying operating system.

Read More...

How to exploit Log4j vulnerabilities in VMWare vCenter

A vulnerability was recently disclosed for the Java logging library, Log4j. The vulnerability is wide-reaching and affects both open source projects and enterprise software, meaning we need to understand how to ID and remediate it in our network environments.

Shortly after the issue was disclosed, VMWare announced that several of their products were affected. A Proof of Concept has been released for VMWare vCenter Server instances and explains how this vulnerability allows attackers to execute code as an unauthenticated user using a single HTTP request.

Read More...

Leading and Empowering Your Team During Log4j

log4j is unprecedented. Take action to support your IT team and cyber security moving forward.

Read More...

Traditional pentesting v. continuous pentesting

We get a lot of questions about what makes continuous penetration testing more valuable than traditional timebox testing. Seriously, A LOT of questions – all of which are warranted.

Take a look below, and we’re pretty sure you’ll see the benefits when the two methods are stacked side-by-side.

Read More...

Never stop frontin: How to quickly setup a redirector and transparent reverse proxy

Protecting your infrastructure from prying eyes is an important part of landing a phish and maintaining access to a client’s network. The process of setting up redirectors and reverse proxies has traditionally been difficult and hard to automate across different cloud platforms.

Today, we’re going to solve that problem with our new repository, sneaky_proxy, which will allow you to automate your efforts.

Read More...

CPT in the wild: 3 real-world examples that prove its value

We get it, regular ol’ once-a-year penetration testing is the norm. It’s what your company has budgeted for, what you’re IT team is used to, and in many cases, what your expected to do. But that doesn’t mean it’s the best way to protect your network.

Think about this: Why would you test your network security from emerging cyber-security threats only once a year. That’s like picking a random day and turning on your home’s security system. Yea, you’re safe for a moment – but only for a point in time.

Read More...

The ultimate tag team: PetitPotam and ADCS pwnage from Linux

PetitPotam and ADCS exploitation are nothing short of amazing. Exploitation is a breeze and results in full domain admin access.

With these two TTPs, an attacker can hop on a network, exploit the vulnerability, do some command-line magic and have local administrator privileges on a domain controller in under 15 minutes. So far, no one has detailed the exploitation process fully on Linux and that’s what we’re going to do today.

Read More...

#PrintNightmare – Is your company protected from this Print Spooler vulnerability?

Hey, you love printers right? They’re that reliable, steadfast piece of technology that always seems to work and never gives you any headaches ... right? Well, buckle up.

Microsoft is releasing emergency security patches to address a critical privilege escalation and remote code execution vulnerability found within the Print Spooler service.

Read More...