7 Minute Security

Latest Episodes:

7MS #601: Breaking Up With Active Directory Dec 11, 2023

Show notes

Today our pal Nate Schmitt (you may remember him from his excellent Dealing with Rejection: A DMARC Discussion Webinar) joins us to talk about breaking up with Active Directory. He covers:

Why would you want to consider removing AD from your environment?
What are common items to plan for?
What steps should you take to efficiently plan a migration?
What common challenges or considerations will you face?

7MS #600: First Impressions of Using AI on Penetration Tests Dec 01, 2023

Show notes

Hey friends, today I share my experience working with ChatGPT, Ollama.ai, PentestGPT and privateGPT to help me pentest Active Directory, as well as a machine called Pilgrimage from HackTheBox.

Will AI replace pentesters as we know them today? In my humble opinion: not quite yet. Check out today's episode to hear more, and please join me on Wednesday, December 6 for my Webinar on this topic with Netwrix called Hack the Hackers: Exploring ChatGPT and PentestGPT in Penetration Testing!

7MS #599: Baby's First Responsible Disclosure Nov 25, 2023

Show notes

Today we talk about our first experience working through the responsible disclosure process after finding vulnerabilities in a security product. We cannot share a whole lot of details as of right now, but wanted to give you some insight into the testing/reporting process thus far, which includes the use of:

7MS #598: Hacking Billy Madison - Part 4 Nov 17, 2023

Show notes

Today our good buddy Paul and I keep trying to hack the VulnHub machine based on the movie Billy Madison (see part 1 and 2 and 3). In today's final chapter, Paul and I:

Find Eric's secret SSH back door
Locate and decrypt a hidden file with Billy's homework
Build wordlists with cewl
Save Billy from the evil clutches of Eric Gordon!!!

7MS #597: Let's JAMBOREE (Java-Android-Magisk-Burp-Objection-Root-Emulator-Easy) with Robert McCurdy Nov 11, 2023

Show notes

Today we had a blast talking with Robert McCurdy about JAMBOREE (Java-Android-Magisk-Burp-Objection-Root-Emulator-Easy)! JAMBOREE allows you to quickly spin up a portable Git/Python/Java environment and much more! From a pentesting POV, you can whip up an Android pentesting environment, BloodHound/SharpHound combo, Burp Suite...the list goes on!

7MS #596: How to Succeed in Business Without Really Crying - Part 13 Nov 04, 2023

Show notes

After about a year break (last edition of this series was in October, 2022, we're back with an updated episode of How to Succeed in Business Without Really Crying. We cover:

Why we're not planning on selling the business any time soon
Fast Google Dorks Scan
Using ProtonVPN via command line
Our pre first impressions of a pentesting SaaS tool you've almost definitely heard of

7MS #595: Choosing the Right XDR Strategy with Matt Warner of Blumira Oct 31, 2023

Show notes

Today we're joined by Matt Warner of Blumira (remember him from episodes #551 and #529 and #507?) to talk about choosing the right XDR strategy! There's a lot to unpack here. Are EDR, MDR and XDR related? Can you get them all from one vendor - and should you? Do you run them on-prem, in the cloud, or both? Join us as Matt answers these questions and more!

7MS #594: Using PatchMyPC to Auto-Update Pentest Dropboxes Oct 23, 2023

Show notes

Today we're talking about how you can use PatchMyPc to keep your home PC and/or pentest dropbox automatically updated with the latest/greatest patches!

7MS #593: Hacking Billy Madison - Part 3 Oct 15, 2023

Show notes

Hey friends, today my Paul and I kept trying to hack the VulnHub machine based on the movie Billy Madison (see part 1 and 2). In our journey we learned some good stuff:

Port knocking is awesome using utilities like knock:

/opt/knock/knock 10.0.7.124 1466 67 1469 1514 1981 1986

Sending emails via command line is made (fairly) easy with swaks:

swaks --to eric@madisonhotels.com --from vvaughn@polyfector.edu --server 192.168.110.105:2525 --body "My kid will be a soccer player" --header "Subject: My kid will be a soccer player"

You could also use telnet and do this command by command - see this article from Black Hills Information Security for more info.

Hyda works good for spraying FTP creds:

hydra -l user -P passlist.txt ftp://192.168.0.1

Check out my quick cheat sheet about bettercap (see episode #522) for some syntax on extracting WPA handshake data from cap files:

# ...it looks like the new standard hash type might be m22000 per this article (https://hashcat.net/forum/thread-10253.html). In that case, here's what I did on the pcap itself to get it ready for hashcat: sudo /usr/bin/hcxpcapngtool -o readytocrack.hc22000 wifi-handshakes.pcap # Then crack with hashcat! sudo /path/to/hashcat -m22000 readytocrack.hc2000 wordlist.txt

7MS #592: 7 Steps to Recover Your Hacked Facebook Account Oct 06, 2023

Show notes

Today we're talking about 7 steps you can take to (hopefully) reclaim a hacked Facebook account. The key steps are:

Ask Facebook for help (good luck with that)
Put out an SOS on your socials
Flag down the FBI
Call the cops!
Grumble to your attorney general
Have patience
Lock it down (once you get the account back)!

Also, I have to say that this article was a fantastic resource in helping me create the outline above.

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected