Security Noise

Latest Episodes:

6.21 - JS-Tap Mk II: A Powerful Tool for Web Application Monitoring and Attack May 23, 2024

Show notes

On this episode, Skyler talks to Principal Security Consultant Drew Kirkpatrick who recently gave a talk at CackalackyCon where he demonstrated new features of his tool, JS-Tap. The tool allows red teams to monitor and attack web applications by rewriting code in the user's browser. Drew introduced a new feature called Mimic, which automates the process of generating custom JavaScript payloads for performing actions as the user in the application. The payloads can be integrated with a Command and Control (C2) system to execute tasks in the user's browser. Drew provided a demo of the tool using a vulnerable WordPress site. JS-Tap is a powerful tool for monitoring and attacking web applications. It allows users to log in and track client activity, including cookies, local storage, and session storage. JS-Tap can intercept form submissions and network communications, making it useful for both monitoring and attacking. It can generate custom payloads and exfiltrate data from the target application. The tool is versatile and can be used for red teaming, penetration testing, and post-exploitation. JS-TAP is available on GitHub and is open source.

Watch the podcast and demo on YouTube here - https://youtu.be/cU915mxLfTo

About this podcast

Security Noise, a TrustedSec Podcast, features our cybersecurity experts in conversation about the security topics that interest them the most. Hosted by Geoff Walton and Producer/Contributor Skyler Tuter. Listen and subscribe wherever you get your podcasts!

6.20 - Targets Operations, Co-Pwnership May 10, 2024

Show notes

In this episode, we discuss state-of-the-art red team testing with Targeted Operations Practice Lead Jason Lang and Director of Security Intelligence Carlos Perez. The conversation is focused on how to extract more value via enhanced cooperation between the red team and the IT Security organization. We conclude with Jason sharing some highlights from his talk "Modern Hackery: A Look At Current Breaches Through An Attacker's Eyes" which will be presented at NolaCon in New Orleans on May 17, 2024.

Show References: https://services.google.com/fh/files/misc/m-trends-2024.pdf

6.19 - InfoSec: Cybersecurity Education at Bedford High Apr 26, 2024

Show notes

Join us as we continue our series on developing careers in InfoSec. In this episode, we talk about a unique opportunity for students at Bedford High School in Ohio, a school that is near and dear to TrustedSec Founder and CEO David Kennedy. We chat with Dave about the cybersecurity education program that was launched recently with help from long-time Bedford teacher Darren Pocek and others. Listen to learn how this program was created and how it helps prepare students for careers in cybersecurity.

6.18 - Careers in InfoSec: Where do you want to go today? Apr 11, 2024

Show notes

Security Noise starts a multi episode look at how to start or grow a career in infoSec. We begin by talking with Senior Security Consultant Kelsey Segrue and Security Consultant Olivia Cate who took what might be considered the traditional route. They share their stories and offer some insights into how to maximize the advantage of similar opportunities.

About this podcast

6.17 - A Royal OSINT Mar 29, 2024

Show notes

On this episode of Security Noise, we are revisiting the topic of open-source intelligence (OSINT) in the wake of the theories spurred by the Royal Family's social media photo that was quickly flagged as being altered. Along with guests, Senior Security Consultants Joe Sullivan and David Boyd, we delve into various theories surrounding the Princess of Wales' controversial Mother's Day photo and the media's subsequential reaction.

Methods for spotting fake images, such as reverse image searches and metadata analysis, are discussed, highlighting the importance of scrutinizing visual content in today's digital age. Additionally, tools like AIornot.com and insights into Twitter/X's handling of metadata add depth to the discussion.

Overall, the episode sheds light on the complexities of image authenticity in the era of digital manipulation and emphasizes the need for critical thinking when consuming visual media.

Security Noise is hosted by Geoff Walton and Producer/Contributor Skyler Tuter.

Links: https://fotoforensics.com https://www.aiornot.com/ https://www.getghiro.org/ https://www.suncalc.org

6.16 - Leak Week: Plumbing the Depths of Privacy Pitfalls Mar 08, 2024

Show notes

It's Leak Week for this episode of Security Noise! Geoff and Skyler chat with Security Consultant Whitney Phillips and Senior Security Consultant Kurt Muhl about a number of recent privacy pitfalls including destructive ransomware groups such as LockBit, leaked government emails, and other data and privacy mishaps.

References:

Security Noise, a TrustedSec podcast, is hosted by Geoff Walton and Producer/Contributor Skyler Tuter in conversation with cybersecurity experts discussing the security topics that interest them the most.

6.15 - OSINT: Digital Detective or Cyber Stalking? Feb 23, 2024

Show notes

Skyler and Geoff chat with Senior Security Consultant Joe Sullivan about using open-source intelligence (OSINT) for gathering ideas and information. We discuss some of the ethical questions about what you can do with what you learn.

6.14 - Extraordinary Incident Responders and Where to Find Them Feb 02, 2024

Show notes

Geoff and Skyler talk to Incident Response Practice Lead Tyler Hudak about when you need an IR plan, what kind of relationships you should have with your IR vendor, and what things to know before perusing an IR retainer. The conversation looks at the needs for businesses of various sizes, proposes some self-assessment questions, and concludes with some war stories!

6.13 - Cyber Prophecies for 2024 Jan 19, 2024

Show notes

Geoff and Skyler make bold predictions for 2024 about AI, changes to Air Tags, and Open Source!

LINKS:

https://techcrunch.com/2024/01/04/orrick-law-firm-data-breach/

https://arstechnica.com/security/2023/12/researchers-come-up-with-better-idea-to-prevent-airtag-stalking/

https://www.theregister.com/2023/12/27/bruce_perens_post_open/

6.12 - Yule Time Tool Time Dec 08, 2023

Show notes

In this very special year-end episode, we're cranking up the heat as we explore some of our favorite InfoSec tools of 2023.

Guest Lineup:

Drew Kirkpatrick - JS-Tap Unleashed

Drew Kirkpatrick is the maestro behind "JS-Tap." He dropped this pentesting bombshell at Wild West Hackin' Fest this year with his talk, "JS-Tap: Weaponizing JavaScript for Red Teams." Skyler snagged an exclusive interview with Drew at the conference and we'll get to hear that discussion on this episode.

Luke Bremer - Hackvertor

Luke Bremer graces our podcast to dive into his blog, "What is Hackvertor (and why should I care?)." Get ready to dive into the use cases of this Burp Suite plugin and how you can utilize it on your next pentest!

Ben Mauch (Ben Ten) - Unveiling Impede

We end our discussion with Ben Mauch, aka @Ben0xA, as he unveils TrustedSec's latest software offering: Impede. Brace yourself for a deep dive into the features and innovations packed into this cybersecurity marvel.

Gather 'round and settle in for our year-end episode of SECURITY NOISE!

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected