Red Team Tools Archives - Black Hills Information Security: Recent Episodes
Red Team Tools Archives - Black Hills Information Security
While DLL hijacking attacks can take on many different forms, this blog post will explore a specific type of attack called DLL proxying, providing insights into how it works, the potential risks it poses, and briefly the methodology for discovering these vulnerable DLLs, which led to the discovery of several zero-day vulnerable DLLs that Microsoft has acknowledged but opted to not fix at this time.
The post Proxying Your Way to Code Execution – A Different Take on DLL Hijacking appeared first on Black Hills Information Security.
by William Oldert // BHIS Intern BHIS had a problem. We needed an environment for students to learn WiFi hacking safely. Our original solution used interconnected physical network gear […]
The post WifiForge – WiFi Exploitation for the Classroom appeared first on Black Hills Information Security.
Recently, as part of our ANTISOC Continuous Penetration Testing (CPT) service, I had an opportunity to investigate how attackers can leverage Slack in cyber-attacks, similar to how we frequently use […]
The post Introducing SlackEnum: A User Enumeration Tool for Slack appeared first on Black Hills Information Security.
DLL hollowing is an age-old technique used by malware authors to have a memory-backed shellcode. However, defensive mechanisms like CFG and XFG have made it incredibly difficult to implement such […]
The post DLL Jmping: Old Hollow Trampolines in Windows DLL Land appeared first on Black Hills Information Security.
This is part three of the blog series, Offensive IoT for Red Team Implants. We will be building off from where we left off in the last post, which can […]
The post Offensive IoT for Red Team Implants (Part 3) appeared first on Black Hills Information Security.
Hi, it’s David with BHIS! You’ll be saying, “Wow,” every time you use this tool. It’s like a shammy. It’s like a towel. It’s like a sponge. A regular towel […]
The post Introducing Squeegee: The Microsoft Windows RDP Scraping Utility appeared first on Black Hills Information Security.
This is Part Two of the blog series, Offensive IoT for Red Team Implants, so if you have not read PART ONE, I would encourage you do to so first […]
The post Offensive IoT for Red Team Implants (Part 2) appeared first on Black Hills Information Security.
This is part one of a multipart blog series on researching a new generation of hardware implants and how using solutions from the world of IoT can unleash new capabilities. […]
The post Offensive IoT for Red Team Implants – Part 1 appeared first on Black Hills Information Security.
Quick Jump: In the constantly evolving landscape of cybersecurity, it is common to see features designed for convenience lead to negative cybersecurity consequences. Microsoft Teams, an essential tool for corporate […]
The post Wishing: Webhook Phishing in Teams appeared first on Black Hills Information Security.
By Beau Bullock & Steve Borosh TL;DR We built a post-compromise toolset called GraphRunner for interacting with the Microsoft Graph API. It provides various tools for performing reconnaissance, persistence, and […]
The post Introducing GraphRunner: A Post-Exploitation Toolset for Microsoft 365 appeared first on Black Hills Information Security.
| Alyssa Snow Misconfigurations in Active Directory Certificate Services (ADCS) can introduce critical vulnerabilities into an Enterprise Active Directory environment, such as paths of escalation from low privileged accounts to […]
The post Abusing Active Directory Certificate Services – Part 2 appeared first on Black Hills Information Security.
| Alyssa Snow Active Directory Certificate Services (ADCS)1 is used for public key infrastructure in an Active Directory environment. ADCS is widely used in enterprise Active Directory environments for managing […]
The post Abusing Active Directory Certificate Services – Part One appeared first on Black Hills Information Security.
Daniel Pizarro // What is the PNPT? The Practical Network Penetration Tester (PNPT), created by TCM Security (TCMS), is a 5-day ethical hacking certification exam that assesses a pentester’s ability […]
The post PNPT: Certification Review appeared first on Black Hills Information Security.
The post Webcast: Attack Tactics 8 – Poison the Well – Jordan Drysdale & David Fletcher appeared first on Black Hills Information Security.
Kyle Avery // Introduction This post compliments a presentation I gave at DEF CON 30 – “Avoiding Memory Scanners: Customizing Malware to Evade YARA, PE-sieve, and More,” which included the […]
The post Avoiding Memory Scanners appeared first on Black Hills Information Security.
Tim Fowler // Do you know what could be lurking in your Windows event logs? In May of 2022, I was sent a Threat Post article about a new technique […]
The post Windows Event Logs for Red Teams appeared first on Black Hills Information Security.
Jordan Drysdale // Overview The following description of some of Impacket’s tools and techniques is a tribute to the authors, SecureAuthCorp, and the open-source effort to maintain and extend the […]
The post Impacket Offense Basics With an Azure Lab appeared first on Black Hills Information Security.
David Fletcher // Over the past several years, attackers have gained significant traction in targeted environments by using various forms of password guessing. This situation was reflected in the 2020 Verizon […]
The post Pushing Your Way In appeared first on Black Hills Information Security.
During remote red team exercises, it can be difficult to keep from leaking information to the target organization’s security team. Every interaction with the target’s website, every email sent, and […]
The post Webcast: OPSEC Fundamentals for Remote Red Teams appeared first on Black Hills Information Security.
It is another year for the Sacred Cash Cow Tipping Webcast. For those of you who are new to our email list within the past year, this is a webcast […]
The post Webcast: Sacred Cash Cow Tipping 2021 appeared first on Black Hills Information Security.
Kent and Jordan are back to continue their journey to make the world a better place. This time around, they will be reviewing a series of tools commonly used on […]
The post Webcast: A Blue Team’s Perspective on Red Team Hack Tools appeared first on Black Hills Information Security.
Hello and welcome. My name is John Strand, and in this video, we’re going to talk a little bit about HoneyBadger. Now, in a number of other videos and a […]
The post Getting Started With Tracking Hackers With HoneyBadger appeared first on Black Hills Information Security.
Hello and welcome! My name is John Strand, and in this video, we’re going to be talking about tripwire Honeyports. Now, this is a lab that’s used in ADHD. This […]
The post Messing With Portscans With Honeyports (Cyber Deception) appeared first on Black Hills Information Security.
Justin Angel // Penetration testing and red team engagements often require operators to collect user information from various sources that can then be translated into inputs to support social engineering […]
The post Collecting and Crafting User Information from LinkedIn appeared first on Black Hills Information Security.