Author Archives - Black Hills Information Security: Recent Episodes
Author Archives - Black Hills Information Security
| Niccolo Arboleda | Guest Author Niccolo Arboleda is a cybersecurity enthusiast and student at the University of Toronto. He is usually found in his home lab studying different cybersecurity […]
The post At Home Detection Engineering Lab for Beginners appeared first on Black Hills Information Security.
Creating your own lab can sound like a daunting task. By the end of this blog post, you will be able to deploy your own Active Directory (AD) environment in […]
The post Deploy an Active Directory Lab Within Minutes appeared first on Black Hills Information Security.
tl;dr: Install Wifiphisher on Kali and run a basic attack. This crappy little copy/paste-able operation resulted in a functional Wifiphisher virtual environment on Kali (as of January 22, 2024). Two […]
The post How to Install and Perform Wi-Fi Attacks with Wifiphisher appeared first on Black Hills Information Security.
While social engineering attacks such as phishing are a great way to gain a foothold in a target environment, direct attacks against externally exploitable services are continuing to make headlines. […]
The post In Through the Front Door – Protecting Your Perimeter appeared first on Black Hills Information Security.
The WebSocket Protocol, standardized in 2011 with RFC 6455, enables full-duplex communication between clients and web servers over a single, persistent connection, resolving a longstanding limitation of HTTP that hindered […]
The post Can’t Stop, Won’t Stop Hijacking (CSWSH) WebSockets appeared first on Black Hills Information Security.
Quick Jump: In the constantly evolving landscape of cybersecurity, it is common to see features designed for convenience lead to negative cybersecurity consequences. Microsoft Teams, an essential tool for corporate […]
The post Wishing: Webhook Phishing in Teams appeared first on Black Hills Information Security.
Be sure to read PART 1! Metadata and a New-Fashioned Bank Robbery Let’s face it, some cases are just more interesting than others and, when you do incident response for […]
The post OSINT for Incident Response (Part 2) appeared first on Black Hills Information Security.
The Challenge As stated in PART 1 of this blog, the Windows endpoint defense technology stack in a mature organization represents a challenge for Red Teamer initial access operations. For […]
The post Initial Access Operations Part 2: Offensive DevOps appeared first on Black Hills Information Security.
Today’s endpoint defense landscape on the Windows desktop platform is rich with product offerings of quite sophisticated capabilities. Beyond the world of antivirus products, Extended Detection and Response (XDR), and […]
The post Initial Access Operations Part 1: The Windows Endpoint Defense Technology Landscape appeared first on Black Hills Information Security.
What is Hydra? Hydra is a tool that can be used for password spraying. Let’s begin by defining the term “password spray.” A password spray is where an attacker defines […]
The post Hacking with Hydra appeared first on Black Hills Information Security.
The new year has begun, and as a penetration tester at Black Hills Information Security, one thing really struck me as I reflected on 2023: a concerningly large number of […]
The post Revisiting Insecure Direct Object Reference (IDOR) appeared first on Black Hills Information Security.
In An SMB Relay Race – How To Exploit LLMNR and SMB Message Signing for Fun and Profit, Jordan Drysdale shared the dangers of lack of SMB Signing requirements and […]
The post Bypass NTLM Message Integrity Check – Drop the MIC appeared first on Black Hills Information Security.
Pentest reports sometimes include bad information under a heading like, “Weak TLS Configuration” or “Insecure SSL Certificates.” This article will explain how TLS is supposed to work, common ways it […]
The post Testing TLS and Certificates appeared first on Black Hills Information Security.
If you’ve been on a website and noticed one of the following features, there’s a good chance you’ve stumbled upon a hot spot for server-side request forgery (SSRF) bugs: Before […]
The post Hunting for SSRF Bugs in PDF Generators appeared first on Black Hills Information Security.
| Nigel Douglas As a Developer Advocate working on Project Falco, Nigel Douglas plays a key role in driving education for the Open-Source Detection and Response (D&R) segment of cloud-native […]
The post Better Together: Real Time Threat Detection for Kubernetes with Atomic Red Tests & Falco appeared first on Black Hills Information Security.
I previously blogged about spoofing Microsoft 365 using the direct send feature enabled by default when creating a business 365 Exchange Online instance (https://www.blackhillsinfosec.com/spoofing-microsoft-365-like-its-1995/). Using the direct send feature, it […]
The post Spamming Microsoft 365 Like It’s 1995 appeared first on Black Hills Information Security.
Being a digital forensics and incident response consultant is largely about unanswered questions. When we engage with a client, they know something bad happened or is happening, but they are […]
The post OSINT for Incident Response (Part 1) appeared first on Black Hills Information Security.
tl;dr Implement this ACL using whatever network gear, cloud ACL config, or uncomplicated firewall you use to protect your networks. Our IOT devices are on 10.99.99.0/24 for this example. Also, […]
The post The Simplest and Last Internet-Only ACL You’ll Ever Need appeared first on Black Hills Information Security.
The internet is a product of a global group effort to build an interoperable network connecting billions of devices, regardless of country, region, or manufacturer. That effort yielded hundreds of […]
The post Unpacking the Packet: Demystifying the Internet Protocol appeared first on Black Hills Information Security.
| Alyssa Snow In PART ONE and PART TWO of this blog series, we discussed common misconfigurations of Active Directory certificate templates. In this post, we will walk through exploitation […]
The post Abusing Active Directory Certificate Services (Part 3) appeared first on Black Hills Information Security.
| Ethan Robish It’s been nearly a year since Lastpass was breached and users’ encrypted vaults were stolen. I had already migrated to a different password manager for all my […]
The post Rotating Your Passwords After a Password Manager Breach appeared first on Black Hills Information Security.
| Sean Verity Do you have a bunch of MFA apps on your phone that leave you feeling like you can’t put your arms down? Or maybe all those MFA […]
The post Opt for TOTP to Deal With MFA App Sprawl appeared first on Black Hills Information Security.
By Beau Bullock & Steve Borosh TL;DR We built a post-compromise toolset called GraphRunner for interacting with the Microsoft Graph API. It provides various tools for performing reconnaissance, persistence, and […]
The post Introducing GraphRunner: A Post-Exploitation Toolset for Microsoft 365 appeared first on Black Hills Information Security.
| Alyssa Snow Misconfigurations in Active Directory Certificate Services (ADCS) can introduce critical vulnerabilities into an Enterprise Active Directory environment, such as paths of escalation from low privileged accounts to […]
The post Abusing Active Directory Certificate Services – Part 2 appeared first on Black Hills Information Security.
| Alyssa Snow Active Directory Certificate Services (ADCS)1 is used for public key infrastructure in an Active Directory environment. ADCS is widely used in enterprise Active Directory environments for managing […]
The post Abusing Active Directory Certificate Services – Part One appeared first on Black Hills Information Security.
Hayden Covington // Phishing is an ever-present threat, but lately, user education and spam filters have helped mitigate some of that threat. But what happens when a phish makes it […]
The post Stop Phishing Yourself: How Auto-Forwarding and Exchange Contacts Can Stab You in the Back appeared first on Black Hills Information Security.
Patterson Cake // PART 1 PART 2 In part one of “Wrangling the M365 UAL,” we talked about acquiring, parsing, and querying UAL data using PowerShell and SOF-ELK. In part […]
The post Wrangling the M365 UAL with SOF-ELK and CSV Data (Part 3 of 3) appeared first on Black Hills Information Security.
Patterson Cake // In PART 1 of “Wrangling the M365 UAL,” we talked about the value of the Unified Audit Log (UAL), some of the challenges associated with acquisition, parsing, […]
Patterson Cake // When it comes to M365 audit and investigation, the “Unified Audit Log” (UAL) is your friend. It can be surly, obstinate, and wholly inadequate, but your friend […]
Troy Wojewoda // In honor of Shark Week1, I decided to write this blog to demonstrate various techniques I’ve found useful when analyzing network traffic with Wireshark, as well as […]
Serena DiPenti // Buckle up for this one because I’m about to give you A LOT of information. As someone who works in tech and creates tech content, I am […]
ImposterKeanu // Introduction This blog post introduces the reader to “The Obfuscation Hustle”, a term I enjoy using to describe the tedious process of obfuscating and delivering files to corporate […]
Tom Smith // At Black Hills Information Security (BHIS), we deal with all manner of clients, public and private. Until a month or two ago, though, we’d never dealt with […]
The post Why Do Car Dealers Need Cybersecurity Services? appeared first on Black Hills Information Security.
shenetworks // One day at work I received a case stating a client couldn’t connect to the management interface of a new server. I asked the client to change the […]
The post Shenetworks Recommends: Using Nmap Like a Pro appeared first on Black Hills Information Security.
John Malone // Introduction Information is power. This sentiment also holds true when discussing the creation of a supporting archive. A supporting archive is something that we put together to […]
The post Six Tips for Managing Penetration Test Data appeared first on Black Hills Information Security.
rvrsh3ll // Introduction This blog post is intended to give a light overview of device codes, access tokens, and refresh tokens. Here, I focus on the technical how-to for standing […]
The post Dynamic Device Code Phishing appeared first on Black Hills Information Security.
moth // Introduction One fateful night in June of 2022, Ethan sent a message to the crew: “Anyone know ways to fool Auditd on Linux? I’m trying to figure out how to change the auid (audit […]
The post Auditd Field Spoofing: Now You Auditd Me, Now You Auditdon’t appeared first on Black Hills Information Security.
Joseph Kingstone // Are you assigned a physical penetration test and want to fly under the radar and meet all of your objectives like the elite hacker you are? Stick around […]
The post If You Don’t Ruse, You Lose: A Simple Guide to Blending in While Breaking In appeared first on Black Hills Information Security.
shenetworks // The Black Hills Information Security YouTube channel has over 400 videos available. Over the past year, I have attended many webcasts and explored plenty of the videos. I […]
The post Shenetworks Recommends: 9 Must Watch BHIS YouTube Videos appeared first on Black Hills Information Security.
kassie@blackhillsinfosec.com
The post Field Guide to the Android Manifest File appeared first on Black Hills Information Security.
Carrie Roberts // Guest Blog OK, I admit it: I might have a problem. But seriously, can you ever really have enough screen space? In this blog post, I’ll describe […]
The post Got Enough Monitors? appeared first on Black Hills Information Security.
Derek Banks // Living Off the Land Binaries, Scripts, and Libraries, known as LOLBins or LOLBAS, are legitimate components of an operating system that threat actors can use to achieve […]
The post Ssh… Don’t Tell Them I Am Not HTTPS: How Attackers Use SSH.exe as a Backdoor Into Your Network appeared first on Black Hills Information Security.
Corey Ham // Tl;dr Use a password manager instead of browser storage for passwords, credit card numbers, and other autofill items. Personal security: Do not save anything sensitive in […]
The post Your Browser is Not a Safe Space appeared first on Black Hills Information Security.
Jordan Drysdale // Tl;dr: Many parsers have been written and several are referenced here. This blog describes a simple parser for Sysmon logs through Event ID (EID) 28 for Microsoft […]
The post Parsing Sysmon Logs on Microsoft Sentinel appeared first on Black Hills Information Security.
Isaac Burton // For as long as we have known about prototype pollution vulnerabilities, there has been confusion on what they are and how they can be exploited. We’re going […]
The post Hit the Ground Running with Prototype Pollution appeared first on Black Hills Information Security.
Fernando Panizza // This was meant to be an OpenSSH how-to blog, but since I had time, I decided to read the man pages (manual pages that you can access […]
The post Forwarding Traffic Through SSH appeared first on Black Hills Information Security.
Joseph Kingstone // Looking to get into physical security? Not sure what you need to get started? Look no further. What are Physical Security Assessments? Physical security assessments evaluate an […]
The post Tales From the Pick: Intro to Physical Security Tools appeared first on Black Hills Information Security.
Have you ever been on a pentest and thought to yourself, “I wish I had a robot to do this testing for me right now cuz this is just too much work”?
The post How to Build a Pentest Robot With Selenium IDE appeared first on Black Hills Information Security.
Daniel Pizarro // What is the PNPT? The Practical Network Penetration Tester (PNPT), created by TCM Security (TCMS), is a 5-day ethical hacking certification exam that assesses a pentester’s ability […]
The post PNPT: Certification Review appeared first on Black Hills Information Security.
Joff Thyer // Introduction We have already arrived at the end of 2022; wow, that was fast. As with any industry or aspect of life, we find ourselves peering into […]
The post Forward into 2023: Browser and O/S Security Features appeared first on Black Hills Information Security.
Dale Hobbs // One thing that I almost always find when performing an internal network penetration test is Simple Network Management Protocol (SNMP) configured with default community strings. Simple Network […]
The post SNMP… Strings Attached! appeared first on Black Hills Information Security.
Kent Ickler // It’s been over two years since Jordan and I talked about a Blue Team’s perspective on Red Team tools. A Blue Team’s Perspective on Red Team Hack […]
The post PlumHound Reporting Engine for BloodHoundAD appeared first on Black Hills Information Security.
Carrie Roberts // PowerShell incorporates the handy feature of writing commands executed to a file to make them easy to refer back to later. This functionality is provided by the […]
The post New PowerShell History Defense Evasion Technique appeared first on Black Hills Information Security.
Penetration Testing is often considered a dark art that’s shrouded in mystery. This unfortunate perception can hold back organizations from being more secure and keep people from an exciting career. […]
The post Webcast: Pentester Tactics, Techniques, and Procedures TTPs w/ Chris Traynor appeared first on Black Hills Information Security.
The post Webcast: Coercions and Relays – The First Cred is the Deepest w/ Gabriel Prud’homme appeared first on Black Hills Information Security.
The post Webcast: Offensive Windows Event Logs w/ Tim Fowler appeared first on Black Hills Information Security.
The post Webcast: Demystifying Web3 Attack Vectors, w/ Beau Bullock and Steve Borosh appeared first on Black Hills Information Security.
The post Webcast: Getting Started: Cybersecurity Maturity Model Certification (CMMC) w/ CJ Cox & Adam Austin appeared first on Black Hills Information Security.
The post Webcast: How Bartending Made Me a Better Infosec Consultant w/ Ben Burkhart appeared first on Black Hills Information Security.
The post Webcast: How DNS can be abused for Command & Control w/ Troy Wojewoda appeared first on Black Hills Information Security.
The post Webcast: Introduction to Pentesting w/ Mike Felch appeared first on Black Hills Information Security.
The post Webcast: How to Detect and Respond to Business Email (M365) Compromise w/ the BHIS DFIR Team appeared first on Black Hills Information Security.
The post Webcast: How to Burn Out in Infosec (and what to do next) w/ Corey Ham and Others appeared first on Black Hills Information Security.
The post Webcast: How to Deliver Payloads in an Enterprise Attack w/ Steve Borosh appeared first on Black Hills Information Security.
The post Webcast: Looking for Needles in Needlestacks w/ Threat Hunting Toolkit appeared first on Black Hills Information Security.
The post Webcast: Getting Started in Covert .NET Tradecraft for Post-Exploitation – Kyle Avery appeared first on Black Hills Information Security.
The post How to Play Competitive Backdoors & Breaches w/ Jason Blanchard (1-Hour) appeared first on Black Hills Information Security.
The post DevOps for Hackers with Hands-On Labs w/ Ralph May (4-Hour Workshop) appeared first on Black Hills Information Security.
The post Webcast: Attack Tactics 8 – Poison the Well – Jordan Drysdale & David Fletcher appeared first on Black Hills Information Security.
Joff Thyer // I woke up this Monday morning thinking that it’s about time I spent time looking at my Domain Name Service (DNS) configuration in my network. (This thought […]
The post The DNS over HTTPS (DoH) Mess appeared first on Black Hills Information Security.
At Black Hills Information Security (BHIS), we make our living doing pentesting, but we’ve never once been paid for a pentest. Penetration Testers get paid for their reports. For their […]
The post Webcast: Hack for Show, Report For Dough: Part 2 appeared first on Black Hills Information Security.
Information takes many forms. Some of these forms are easy to understand and others less so. Some are hardly even recognizable. How do you know when you’ve found something interesting? […]
The post Webcast: Uncovering Secrets and Simplifying Your Life with CyberChef appeared first on Black Hills Information Security.
Why is blockchain security important? Blockchain usage has exploded since the Bitcoin whitepaper was first published in 2008. Many applications rely on this technology for increased trust and privacy, where […]
The post Webcast: Getting Started in Blockchain Security and Smart Contract Auditing appeared first on Black Hills Information Security.
In this Black Hills Information Security (BHIS) webcast, you will learn tools and techniques for performing penetration tests against Microsoft Azure environments. Increasingly, more organizations are migrating resources to being […]
The post Webcast: Getting Started in Pentesting The Cloud: Azure appeared first on Black Hills Information Security.
Are you responsible for the security of webapps? Are you curious about how penetration testers are able to find vulnerabilities in them? Burp Suite is the preferred tool for many […]
The post Webcast: Getting Started with Burp Suite & Webapp Pentesting appeared first on Black Hills Information Security.
Beau Bullock // Overview On offensive engagements, such as penetration tests and red team assessments, I have been seeing inconsistencies in how MFA is applied to the various Microsoft services. […]
The post Exploiting MFA Inconsistencies on Microsoft Services appeared first on Black Hills Information Security.
Moth & James Marrs // Introduction After a month of hard work, Python headaches, dependency hell, and a bit of tool necromancy, ADHD4 is here and we’re thrilled to share […]
The post Now That’s What I Call ADHD! 4 appeared first on Black Hills Information Security.
So much information about testing webapps for security problems is old. Don’t get me wrong, the old stuff still works way more often than we’d like, but there’s more to […]
The post Webcast: Modern Webapp Pentesting: How to Attack a JWT appeared first on Black Hills Information Security.
I like webapps, don’t you? Webapps have got to be the best way to learn about security. Why? Because they’re self-contained and so very transparent. You don’t need a big […]
The post Webcast: Free Tools! How to Use Developer Tools and Javascript in Webapp Pentests appeared first on Black Hills Information Security.
Brian King // Recon-ng had a major update in June 2019, from 4.9.6 to 5.0.0. This post is meant to help with the adjustment by providing a cheat sheet for […]
The post What’s Changed in Recon-ng 5.x appeared first on Black Hills Information Security.