Password Spray Archives - Black Hills Information Security: Recent Episodes
Password Spray Archives - Black Hills Information Security
What is Hydra? Hydra is a tool that can be used for password spraying. Let’s begin by defining the term “password spray.” A password spray is where an attacker defines […]
The post Hacking with Hydra appeared first on Black Hills Information Security.
Have you ever been on a pentest and thought to yourself, “I wish I had a robot to do this testing for me right now cuz this is just too much work”?
The post How to Build a Pentest Robot With Selenium IDE appeared first on Black Hills Information Security.
Daniel Pizarro // What is the PNPT? The Practical Network Penetration Tester (PNPT), created by TCM Security (TCMS), is a 5-day ethical hacking certification exam that assesses a pentester’s ability […]
The post PNPT: Certification Review appeared first on Black Hills Information Security.
Why are companies still recommending an 8-character password minimum? Passwords are some of the easiest targets for attackers, yet companies still allow weak passwords in their environment. Multiple service providers recommend […]
The post Podcast: Passwords: You Are the Weakest Link appeared first on Black Hills Information Security.
Why are companies still recommending an 8-character password minimum? Passwords are some of the easiest targets for attackers, yet companies still allow weak passwords in their environment. Multiple service providers recommend […]
The post Webcast: Passwords: You Are the Weakest Link appeared first on Black Hills Information Security.
Darin Roberts // “Why do you recommend a 15-character password policy when (name your favorite policy here) recommends only 8-character minimum passwords?” I have had this question posed to me […]
The post Passwords: Our First Line of Defense appeared first on Black Hills Information Security.
Beau Bullock & Mike Felch// Strategically targeting a corporation requires deep knowledge of their technologies and employees. Successfully compromising an organization can depend on the quality of reconnaissance a tester […]
The post Podcast: Weaponizing Corporate Intel. This Time, It’s Personal! appeared first on Black Hills Information Security.
Timecode links take you to YouTube: 4:11 – Infrastructure & Background8:28 – Overview & Breakdown of Attack Methodology and Plans11:35 – Start of Attack (Gaining Access), Password Spraying Toolkit15:24 – […]
The post Webcast: Attack Tactics 5 – Zero to Hero Attack appeared first on Black Hills Information Security.
Darin Roberts// IP-Go-Round – Source IP Rotation I was on an engagement recently that was blocking my password sprays based on my IP address. If I made 3 incorrect requests […]
The post How To Rotate Your Source IP Address appeared first on Black Hills Information Security.
Darin Roberts// Early in 2018 I wrote a blog about InSpy. InSpy is a great reconnaissance tool that gathers usernames from LinkedIn. My first blog can be found here. A […]
The post I Spy with InSpy v3.0 appeared first on Black Hills Information Security.
Brian Fehrman // In our experience, we see many Windows environments in which the local Administrator password is the same for many machines. We refer to this as Wide-Spread […]
The post Wide-Spread Local Admin Testing appeared first on Black Hills Information Security.
Brian King // There’s a one-liner password spray script that a lot of folks use to see if anyone on a domain is using a bad password like LetMeIn! or […]
The post Check\ Your\ Tools appeared first on Black Hills Information Security.
Beau Bullock // In this series of posts I am going to detail multiple ways to gain access to domain user credentials without ever being on a target organization’s network. […]
The post Exploiting Password Reuse on Personal Accounts: How to Gain Access to Domain Credentials Without Being on a Target’s Network: Part 1 appeared first on Black Hills Information Security.