!!UPDATED INSTRUCTIONS FOR RELEASE 1.5.1 here !! It’s been quite some time since I wrote a guide for something, and I DID say I’d follow up my original Gone KingPhishin’ post with steps to get SSL/TLS working as well as walking through the campaign creation process…so here we go. What you’ll need to replicate this…
PowershellEmpire is basically a post-exploitation framework that utilises the widely-deployed PowerShell tool for all your system-smashing needs. It’s feels quite Metasploity with it text-driven menus, module management and execution functions, but it’s purely for generating PowerShell agents and post-exploitation evilness. Of course, Powershell being native to Windows means that AV is not a concern (for…
!!UPDATED INSTRUCTIONS FOR RELEASE 1.5.1 here !! Running a phishing campaign against your organisation is a good way to educate users against the perils of the inbox. Some of the common problems with education-based phishing runs of any reasonable size include: The pain of spinning up infrastructure for the campaign Tracking user participation and response…
Apparently, the average person in Australia carries 2.6 devices. For me, the 0.6 is my Telstra Pre-Paid 4G WiFi modem. All the main Aussie telcos have offerings in this space (Telstra/Optus/Vodafone/Virgin Mobile), and the devices provided usually are Huawei, ZTE or Sierra Wireless wifi modems. I’ve been using this ZTE MF91 device as sold by…
More boot2root fun with yet another pretty basic (but at times frustrating) challenge put together by maleus21 and hosted by the Supreme Leaders of Excellence and Quality Stickers, Vulnhub. While these kinds of hack games don’t typically represent what you may find in a live production environment, often you’re left with a reminder that the dual concepts of…
DEF CON 22 is just a couple of short weeks away and there’s sure to be some CTF fun there, so there’s no better time to brush up on the basics. At Vulnhub, you’ll find a ton of boot2root challenges that cover a wide range of security vulnerabilities. This challenge from the people at Pentester Labs is…
Our crew likes to take on a good CTF pretty regularly, and a little while back we saw that the team at NotSoSecure was planning on holding an SQLi CTF in mid-April this year (right around the corner). They also offer access to a VPN containing a ton of SQLi challenges on a variety of…
Just returned home after a quick business trip to the Middle East. The temperature was solid, the trip went smoothly and the delegation achieved what it set out to accomplish.But I was reminded that the operational effectiveness of an enterprise information security program has a strong correlation to the seniority of those who support it in…
You’re probably here because you want to know about the awesome boot2root xerxes:1, correct? This was a vulnhub challenge created by @barrebas, and was excellent! So let’s get started. I found the VM sitting on 192.168.56.102 – a quick nmap scan provided a list of available services: A close look at the web service was next…