PinnedA Red Team Guide for a Hardware Penetration TestPart 2: Using security risks from the Modern Open Web Application Security Project to help hack hardware — This blog serves as a guide to helping demystify some of the bugs and issues discovered during hardware assessments. I’ve shared some of the lessons learned from years of applied logic, and reason to find problems that do not exist. …4 min read4 min read
Mar 10, 2020Wireless Penetration TipsA list for all things wireless that you may find useful while assessing a real world Wi-Fi Enterprise Network. How-to: Evil Twin, KARMA, MANA, EAP-GTC Downgrade, passivity perform wireless recon, capture WPA2 handshakes (WPA2 full, half, PKMID), and test guest networks for known misconfigurations. Overview Ive tried to consolidate information from…5 min read5 min read
Dec 29, 2019Compatible Wireless Penetration Hardware for Kali RollingThis blog is to help consolidate the existing information about what USB devices are compatible with the latest Kali Linux Release.This is not meant to be an exhaustive post, but to provide well tested and easily obtainable hardware to perform a wireless penetration assessment. Kali Linux 2019.4 Release Time to grab yourself a drink, this will take a while! We are incredibly excited to announce our fourth and final…www.kali.orgCheatsheet2 min readCheatsheet2 min read
Nov 26, 2019New Hot Spot 2.0 Wifi Evil Twin AttackIn this new wireless attack, I’ll walk you through the process of creating a Hot Spot 2.0 Evil Twin. …4 min read4 min read
Sep 30, 2019A Red Team Guide for a Hardware Penetration Test: Part 1When looking at different routing and networking technology it’s easy to be overwhelmed, with how to assess an embedded device. I like many other penetration testers and red teamer’s, did not feel I was capable of finding any 0-days or bugs in such fortified devices. …Security3 min readSecurity3 min read
Jun 5, 2019How to create an EVIL LTE TwinBe very careful when playing with any cellular bands. Denial of service attacks can have devastating and sometimes jail worthy consequences. All testing was done within a Faraday Cage. The cellular world is cryptic and confusing. Although we’re constantly engrossed in our phones, or tied to some device talking to…5 min read5 min read
Apr 22, 2019Using Responder on Mac Os to MITM Outlook Office 365 credentialsIn this article we’ll discuss how to get clear text credentials from Outlook 2016 using Responder on Mac OS High Sierra. From password spraying SSO endpoints, to abusing Azure programs and Office applications — Office 365 and Microsoft Communication products are often the target of credential theft. As shown below…2 min read2 min read
Apr 17, 2019Password Spraying- Common mistakes and how to avoid themWhen password spraying attacks are executed properly, coordinated and scoped properly during an authorized engagement — they can identify and illustrate the dangers of weak passwords and how extremely dangerous, even one legacy Internet facing endpoint can be. Password spraying can lead to domain administrator before lunch. Remember you can…Security4 min readSecurity4 min read
Mar 6, 2019Top 5 Ways The Red Team breached and assessed the Physical EnvironmentWe tailgate, skim and clone. Social engineer and deceived to employee and CISO alike, to get onsite and hit our “Breach” Physical, or “Red Team” goal. In my years performing physical security assessments, these are some of the techniques my peers and I found successful. Some say that as the…Security5 min readSecurity5 min read
Aug 6, 2018New attack on WPA/WPA2 using PMKIDNew attack on WPA/WPA2 using PMKID In this short blog, I will walk you through the process of obtaining a valid PMKID packet, and converting those frames of data to hashcat format for cracking. …Wireless4 min readWireless4 min read
