Resources

Tools

Explore resources tagged with "Tools".

Latest "Tools" tagged resources

How To Securely Share Your Backups and Passwords Upon your Death

A tutorial on how to build a secure, distributed, and multiple authorization backup method to recovery your digital life.

Read more

Crossing the Log4j Horizon - A Vulnerability With No Return

A vulnerability was recently disclosed for the Java logging library, Log4j. The vulnerability is wide-reaching and affects both open-source projects and enterprise software. VMWare announced shortly after the release of… read more →

Another Log4j on the fire: Unifi

By now, you’re probably well aware of a recently disclosed vulnerability for the Java logging library, Log4j. The vulnerability is wide-reaching and affects Ubiquiti's Unifi Network Application. In this article, we’re… read more →

Never stop frontin: How to quickly setup a redirector and transparent reverse proxy

Protecting your infrastructure from prying eyes is an important part of landing a phish and maintaining access to a client’s network. The process of setting up redirectors and reverse proxies has traditionally been… read more →

How to limit cleartext password storage and fix the issue in your organization

The key to our engagements often and unfortunately involve the discovery of credentials on internal network file shares. We’re going to show you how we find cleartext password storage problems and how to address them. read more →

Pro tips for purchasing and aging phishing domains

Good command-and-control infrastructure requires a known, trusted domain. When you’re first starting out, this can be difficult to find, but luckily other testers have provided many great resources. read more →

How to: Execute passive internal recon during continuous penetration testing

When we launch continuous penetration testing in a new network, we don't want to raise suspicion of our presence. For one reason, we may be able to get credentials without doing anything intrusive at all. To do it, we… read more →

Creating Small Containers for Penetration Testing

In this article I show you how to create small containers that use up to date tools. By default, the Golang Docker container at its smallest is 123 MB. While seemingly small, this can result in annoying latency and… read more →

Penetration Testing Dropbox Part 2 - VPN Infrastructure

In part 2 we go beyond autossh and create a OpenVPN server that our dropboxes and pentesters will connect to. We'll walk through configurations and certificates needed for seamless connectivity. read more →

Getting started with MITRE CALDERA

The MITRE CALDERA project is an automated adversary emulation system. It's primary purpose is to execute a series of operations to help determine if adversarial tactics can be detected in your enterprise environment. read more →

Autored - Using Terraform to Quickly Launch Empire

This is the start of a series I'm calling Autored. My goal is to quickly stand up temporary systems I commonly use during an engagement. In this post I'll cover how to deploy an Empire server in AWS in less than 3… read more →

Protect your company with Sprocket

Know your threats when they emerge.

When your environment changes, or new threats affect your attack surface, we perform security testing. There is a lot more value from this modern approach to testing.

Request a quote Learn how it works

Continuous Penetration Testing Subscription

  • Pentests
  • Web App Testing
  • Red Teaming
  • Social Engineering
  • Adversary Simulations