The key to our engagements often and unfortunately involve the discovery of credentials on internal network file shares. We’re going to show you how we find cleartext password storage problems and how to address them.
I’m going to quickly go through the process of setting up GoPhish and show you how we evade defenders to increase the success rate of our phishing campaigns.
Password. Password123. Yea, you’ve seen them all when it comes to bad passwords. It comes standard when managing IT security.
But while your organization likely requires special characters, uppercase letters and even a number or two, if you don’t require longer passwords you’re not taking one of the most important steps to protect your network.
We’ve laid out 14 credible reasons to require everyone in your organization to use 14-character passwords. We’re pretty sure you’ll be convinced. If not, long live Password123.
Maybe you’ve heard your IT security team talking about attack surfaces? Or, maybe the term has come up during a virtual conference or in your newsfeed. It’s important to take a step back and understand what an attack surface is and why you need to protect it.
Trying to wrap your head around what separates Continuous Penetration Testing from other forms of network security testing? Well, we get it.
That’s why we’ve put together this handy little video. Sit back, have a snack and learn how CPT works, why it’s advantageous and how it can help you keep your organization’s network safe.
If you’re not in the cybersecurity trenches daily, it can be tough to get a clear understanding of many popular terms used by the professionals testing your organization’s network.
To lend you a hand, we’ve compiled a list of some terms you can expect to see regularly (especially if you work with us). We’ll keep this list updated regularly. And, if you don’t see a term you’ve heard just send us a note. We’ll be sure to add it.
Automated Vulnerability Scanners, on the surface, have a lot of appeal to IT directors. But the harsh reality is they provide a false sense of security and leave your network exposed. Click to learn more about understanding scanners and pentesting.
Collecting and validating an organization’s employee base is critical for any successful offensive information security operation. With this information, we’re able to conduct social engineering campaigns and password spray endpoints. Check out the full post to learn the process for fully enumerating an organization’s employee base.
When starting a penetration test, we first try to discover domains associated with our target apex domain.
To help you navigate this part of the process, we’re going to detail it, highlighting tips and tricks for working around registrant privacy services and other roadblocks you may face.
Let’s face it, Slack is a treasure trove of information for hackers. Credentials. Proprietary data. Social engineering opportunities. You get the picture – it’s an information-rich environment.
I’m going to dig into Slack workspace compromise via Mythic C2 and macOS to provide additional information and tooling you can use to leverage a stolen Slack session.