7MS #676: Tales of Pentest Pwnage – Part 72

7 Minute Security

#Security #Software Development #Tech News #Information Security #Brian Johnson #Tech #News

39:06

"So I think this whole idea of cumulative culture is a way to make humans exceptional. But it's clear to me that humans are exceptional, and seeing it through baboon glasses, I can understand in a different way why they're exceptional. But many of the things that we think are uniquely human are actually present in other animals." - Dr. Shirley Strum Dr. Shirley Strum is a groundbreaking anthropologist who has spent over five decades living alongside wild baboons in Kenya. Her work has transformed our understanding of these intelligent, socially complex animals — their relationships, their adaptability, and the intricate societies they create. In her new book, Echoes of Our Origins , Shirley challenges long-held beliefs about evolution, the human-animal divide, and what it truly means to coexist. This conversation is about science — but it’s also about humility, hope, and the messy, beautiful complexity of life on Earth. Links: https://www.press.jhu.edu/books/title/53757/echoes-our-origins https://anthropology.ucsd.edu/people/faculty/faculty-profiles/shirley-strum.html…

about a year ago 59:34

MP3•Episode home

Today’s fun tale of pentest pwnage discuss an attack path that would, in my opinion, probably be impossible to detect…until it’s too late.

685 episodes

7MS #676: Tales of Pentest Pwnage – Part 72

7 Minute Security

232 subscribers

published about a year ago

MP3•Episode home

Today’s fun tale of pentest pwnage discuss an attack path that would, in my opinion, probably be impossible to detect…until it’s too late.

685 episodes

#Security #Software Development #Tech News #Information Security #Brian Johnson #Tech #News

All episodes

1
7MS #686: Our New Pentest Training Course is Almost Ready 23:30

3 days ago23:30

23:30

Oh man, I’m so excited I can hardly sleep. Our new three-day (4 hours per day) training is getting closer to general release. I talk about the good/bad/ugly of putting together an attack-sensitive lab that students can abuse (but hopefully not break!), and the technical/curriculum-writing challenges that go along with it.…

1
7MS #685: The Time My Neighbor Almost Got Scammed Out of $13K 22:56

10 days ago22:56

22:56

Today’s kind of a “story time with your friend Brian” episode: a tale of how my neighbor almost got scammed out of $13k. The story has a lot of red flags we can all keep in mind to keep ourselves (as well as kids/friends/parents/etc.) safer from these types of shenanigans.

1
7MS #684: Pwning Ninja Hacker Academy 22:50

17 days ago22:50

22:50

Hey friends, today we start pwning Ninja Hacker Academy – cool CTF-style lab that has you start with no cred and try to conquer domain admin on two domains!

1
7MS #683: What I'm Working on This Week - Part 4 30:50

23 days ago30:50

30:50

This week I’m working on a mixed bag of fun security and marketing things: A pentest I’m stuck on My latest lab CTF obsession: Ninja Hacker Academy A cool “about 7MinSec” marketing video that was recorded in a pro studio!

1
7MS #682: Securing Your Family During and After a Disaster – Part 7 30:59

4 weeks ago30:59

30:59

Today’s episode is a downer! We talk about things you might want to have buttoned up for when you are eventually not alive anymore: Living will Buried vs. cremated? Funeral plans Funeral PHOTOS? I also talk about how my dad broke his ribs while trying to break a chimpmunk, and how a freak 4-wheeler accident also had my ribs in agony.…

1
7MS #681: Pentesting GOAD – Part 3 18:18

5 weeks ago18:18

18:18

Today Joe “The Machine” Skeen and I pwn the third and final realm in the world of GOAD (Game of Active Directory) : essos.local! The way we go about it is to do a WinRM connection to our previously-pwned Kingslanding domain, coerce authentication out of MEEREEN (the DC for essos.local) and then capture/abuse the TGT with Rubeus! Enjoy.…

1
7MS #680: Tips for a Better Purple Team Experience 26:48

6 weeks ago26:48

26:48

Today I share some tips on creating a better purple team experience for your customers, including: Setting up communication channels and cadence Giving a heads-up on highs/criticals during testing (not waiting until report time) Where appropriate, record videos of attacks to give them more context

1
7MS #679: Tales of Pentest Pwnage – Part 73 30:12

7 weeks ago30:12

30:12

In today’s tale of pentest pwnage I talk about a cool ADCS ESC3 attack – which I also did live on this week’s Tuesday TOOLSday. I also talk about Exegol’s licensing plans (and how it might break your pentest deployments if you use ProxmoxRox ).

1
7MS #678: How to Succeed in Business Without Really Crying – Part 22 33:39

8 weeks ago33:39

33:39

Today I share some tips on presenting a wide variety of content to a wide variety of audiences, including: Knowing your audience before you touch PowerPoint Understanding your presentation physical hookups and presentation surfaces A different way to screen-share via Teams that makes resolution/smoothness way better!…

1
7MS #677: That One Time I Was a Victim of a Supply Chain Attack 13:48

9 weeks ago13:48

13:48

Hi everybody. Today I take it easy (because my brain is friend from the short week) to tell you about the time I think my HP laptop was compromised at the factory!

1
7MS #676: Tales of Pentest Pwnage – Part 72 59:34

10 weeks ago59:34

59:34

Today’s fun tale of pentest pwnage discuss an attack path that would, in my opinion, probably be impossible to detect…until it’s too late.

1
7MS #675: Pentesting GOAD – Part 2 31:41

11 weeks ago31:41

31:41

Hey friends! Today Joe “The Machine” Skeen and I tackled GOAD (Game of Active Directory) again – this time covering: SQL link abuse between two domains Forging inter-realm TGTs to conquer the coveted sevenkingdoms.local! Join us next month when we aim to overtake essos.local, which will make us rulers over all realms!…

1
7MS #674: Tales of Pentest Pwnage – Part 71 49:00

12 weeks ago49:00

49:00

Today’s tale of pentest pwnage is another great one! We talk about: The SPNless RBCD attack (covered in more detail in this episode ) Importance of looking at all “branches” of outbound permissions that your user has in BloodHound This devilishly effective MSOL-account-stealing PowerShell script (obfuscate it first!) A personal update on my frustration with ringing in my ears…

1
7MS #673: ProxmoxRox 30:31

13 weeks ago30:31

30:31

Today we’re excited to release ProxmoxRox – a repo of info and scripts to help you quickly spin up Ubuntu and Windows VMs. Also, some important news items: 7MinSec.club in-person meeting is happening Wednesday, May 14! More details here . We did our second Tuesday TOOLSday this week and showed you some local privesc techniques when you have local admin on an endpoint…

1
7MS #672: Tales of Pentest Pwnage – Part 70 55:07

14 weeks ago55:07