My buddy Aamir Lakhani wrote about a cool reconnaissance tool called recon-ng. This tool can automate researching a target using multiple sources. The original post can be found HERE.
Reconnaissance techniques are the one of the first steps penetration testers practice when learning how to exploit systems for vulnerabilities. Traditional reconnaissance techniques are used to gather intelligence, define scope, and identifying weaknesses. Continue reading →
Kellep Charlesfrom SecurityOrb interviewed me a few weeks back about my book as well as other general security topics. You can find the recording HERE or on the SecurityORB website. I was fighting a cold so my apologies for the raspy voice.
For those interested in the book, below is a discount code you can use provided by SecurityORB. The link to the book is on the right side of this blog. Continue reading →
I’m often asked “why did my system get infected when I had the latest system updates and anti-virus enabled?” Well, a fundamental concept behind security products is they can only look for so many things or use so many detection techniques before they must permit traffic. This means your defenses will fail if an attack uses a method that your detection system can’t see or scanner does not have an existing signature to scan against. This is why attackers hide exploits using techniques such as obfuscation to bypass security detection. Continue reading →
I’ve been asked about suggested training for penetration testing. The most popular programs are the Certified Ethical Hacker CEH (found HERE) and SANs courses (found HERE). There are many books such as the one I wrote with my buddy Aamir (HERE) as well as others I have recommended HERE.
I was provided access to a video series through Packt Publishing titled “Expert Metasploit Penetration Testing [Video]” and found it to be pretty useful for those looking to learn how to use Metasploit. Continue reading →
My buddy Aamir Lakhani wrote a great post covering the recently exposed security vulnerability that impacts more than half of the websites on the Internet. Its something everybody needs to be aware of. The original article can be found HERE.
Heartbleed is a serious vulnerability affecting OpenSSL cryptographic libraries. The Heartbleed vulnerability allows an attacker to steal information protected under normal SSL TLS conditions.
Here is what you need to know:
This is a very serious vulnerability.
It harms personal computers and everyday users. Attackers could possibly steal user information.
Many popular websites, including social media, search, email, banking, and health sites are vulnerable.
The bug is found on most systems and has been present since 2012.
Most likely, attackers knew about the vulnerability, and may have been exploiting it for a long time.
Patching and updating systems will not protect owners from attackers who have already captured data.
I have recently seen a uptick in DDoS / DoS attacks against my customers and asked questions such as “how easy is it to perform these attacks?”, “who launches these attacks?” and “how can I defend against such attacks?”. I have spoke about this topic in the past however will provide both the executing and defending side of DoS in this post. Continue reading →
I’ve had people ask about the Darknet and decided to provide a brief overview. To summarize, the Darknet is not some evil network designed to cause chaos. I find it funny when articles refer to the Darknet as some form of attack or thing to watch out for. To put it simply, the Darknet is a closed or hidden network meaning you can’t access webpages using standard Internet browsers. In order to find dark resources, you need specific software and sometimes special permission to access parts of the network. The next screenshot is one method using a TOR browser. Continue reading →
I wrote about one of my favorite hot-spot honeypot tools known as the WiFI pineapple Mark III last year HERE. The pineapple only cost $100 dollars and can be found at the HAK5 store.
To summarize what this bad boy does, it is a small portable attack tool that can run things such as Karma used to spoof trusted SSIDs and SSL strip to remove trusted connections while sniffing traffic. So for example, lets say your home network is PUPPYDOG123. When you’re at home, your wireless devices will look for PUPPYDOG123 and connect if they see it. When the pineapple is present and running Karma, it can say back “Hey, I’m PUPPYDOG123 … connect to me”. Your device will think its your network and connect. Traffic will go through the Pineapple so you think you are on a trusted network however the pineapple is between aka a man-in-the-middle attack. Continue reading →
If you are familiar with penetration tools, then you should know Metasploit. For those that love GUIs, there is a fantastic open source GUI management for Metasploit known as Armitage (found HERE). The same developers of Armitage created a more advanced penetration testing package for a $2,500 annual cost. The tool is called cobalt Strike (CS) and can be downloaded at www.advancedpentest.com for a 21day trail. They also have a 4-hour lab that lets you try out the core cobalt Strike features. It is worth spending the time to test the tool and get some lab time even though the lab itself is is pretty easy. Continue reading →