My name is Spence. I'm an adverserial engineer, hax0r of life and things, based out of the Emerald Isle. It’s nice to meet you!
‘Smishing’ is a blended word comprised of “SMS” (short message service) and “phishing.” In short, it’s a social engineering attack vector that leverages text messages to deceive individuals into taking several actions (outlined later in the post).
Social engineering is an umbrella term used interchangeably when discussing various malicious activities accomplished through multiple forms of human interaction.
From streaming our favourite shows to sharing photos with friends and colleagues, cloud computing has revolutionized the way we live and work. But what exactly is the cloud, and how did it come about?
Today we have a new post covering an overview of some tips and best practices when it comes to administering/reviewing firewalls as a result of some recent engagement I undertook. The majority of the content below is not new or ground breaking, but comes from recommendations I’ve made or information I’ve collected and used as references during my time reporting on firewall reviews. Due to this and my recent work, I thought I’d write up a few things which hopefully help some folks out when it comes to these types of engagements. Possible use cases for the following information could be:
Enjoy!
What is wireless Penetration Testing
Wireless Penetration testing is the enumeration and examination of a target wireless networks configuration and hardware in use i.e. mainly access points, by either passive or active means, with the aim being to highlight any security issues or information leakage. This can be further defined by the testing scope provided for the engagement. This should detail whats required and related to your specific Wifi/WLAN assessment.
This post is going to be more results/statistics based, providing context to the benchmark tests myself and Nick carried out! It will cover the Benchmarks that we obtained from Hashcat, once we had completed the EC2 Kali instance set-up. The original post covering this can be found here, Cracking in the Cloud with Hashcat
Cracking in the cloud with Hashcat – A how to…
So first up, this post came about from a discussion with another tester centering around whether using a cloud based platform is a worthwhile venture for real-time and offline password/hash decrypting i.e. cracking.
After a quick search on the pentesters best friend, Google, it leads my colleague and I to a variety of different write-ups covering both technical details and set-up guides. Two of the best we came across can be found at the following links:
Following on from my previous blog post on NLA, a tool to help with RDP enumeration has been suggested to me to explore. The tools name is ‘rdp-sec-check’ by Portcullis Labs.
Having surfed over to the Protcullis website to check out this tool I found a handy introduction to it. As expected it covers basically what the tool is and how it goes about its business. Obviously the name gives it away, ‘rdp-sec-check’, it’s another tool for checking the RDP security configuration of a target host.
While on a test recently, I noted that several hosts had TCP port 3389 (RDP) open. I had a little extra time to play with and after reading Robin Wood’s @diginija recent blog post Show RDP login page. Great I thought, time to put this to practice! Maybe I could snag some low hanging fruit such as what @diginija got a glimpse of i.e. logged in user accounts/usernames. Now the difference in my scenario was I was using a Linux host for testing and @digininja used a Windows host, this meant I’d be using either ‘rdesktop’ or ‘Remmina/FreeRDP’ instead of the native windows application. So a few questions arose from this, “Would I be able to replicate what @diginija achieved?” and “would there be any issues in trying to achieve the same objective, though using a different host??” Only one way to find out!
As a work at home parent is someone who works from home and integrates parenting into his or her work/business activities. They are sometimes referred to as a WAHM (work at home mom) or a WAHD (work at home dad)....
I’ll start by saying that, unfortunately, I didn’t receive my Offensive Security Certified Professional (OSCP) certification on this occasion.