Automating Screenshots to Quickly Assess Many WebApps - Tradecraft Security Weekly #12

Tradecraft Security Weekly (Audio)

Player FM - Internet Radio Done Right

29 subscribers

Hozzáadva nyolc éve

A tartalmat a Security Weekly biztosítja. Az összes podcast-tartalmat, beleértve az epizódokat, grafikákat és podcast-leírásokat, közvetlenül a Security Weekly vagy a podcast platform partnere tölti fel és biztosítja. Ha úgy gondolja, hogy valaki az Ön engedélye nélkül használja fel a szerzői joggal védett művét, kövesse az itt leírt folyamatot https://hu.player.fm/legal.

This Is Woman's Work with Nicole Kalil

1
QUALIFIED: How Competency Checking and Race Collide at Work with Shari Dunn | 284 33:58

7 napja33:58

Lejátszás később

Listák

Tetszik

Kedvelt

33:58

In this episode, we delve into the concept of being "qualified" in the workplace, examining who gets labeled as such, who doesn't, and the underlying reasons. We explore "competency checking"—the practice of scrutinizing individuals' abilities—and how it disproportionately affects underrepresented groups, often going unnoticed or unchallenged. Our discussion aims to redefine qualifications in a fair, equitable, and actionable manner. Our guest, Shari Dunn , is an accomplished journalist, former attorney, news anchor, CEO, university professor, and sought-after speaker. She has been recognized as Executive of the Year and a Woman of Influence, with her work appearing in Fortune Magazine, The Wall Street Journal, Ad Age, and more. Her new book, Qualified: How Competency Checking and Race Collide at Work , unpacks what it truly means to be deserving and capable—and why systemic barriers, not personal deficits, are often the real problem. Her insights challenge the narratives that hold so many of us back and offer practical solutions for building a more equitable future. Together, we can build workplaces and communities that don’t just reflect the world we live in, but the one we want to create. A world where being qualified is about recognizing the talent and potential that’s been overlooked for far too long. It’s not just about getting a seat at the table—it’s about building an entirely new table, one designed with space for all of us. Connect with Our Guest Shari Dunn Website& Book - Qualified: https://thesharidunn.com LI: https://www.linkedin.com/today/author/sharidunn TikTok: https://www.tiktok.com/@thesharidunn Related Podcast Episodes: How To Build Emotionally Mature Leaders with Dr. Christie Smith | 272 Holding It Together: Women As America's Safety Net with Jessica Calarco | 215 How To Defy Expectations with Dr. Sunita Sah | 271 Share the Love: If you found this episode insightful, please share it with a friend, tag us on social media, and leave a review on your favorite podcast platform! 🔗 Subscribe & Review: Apple Podcasts | Spotify | Amazon Music…

8 éve 9:29

MP3•Epizód kép

Full Show Notes: https://wiki.securityweekly.com/TS_Episode12

LINKS: EyeWitness - https://github.com/ChrisTruncer/EyeWitness Rawr - https://bitbucket.org/al14s/rawr/wiki/Home httpscreenshot - https://github.com/breenmachine/httpscreenshot Peeping Tom - https://bitbucket.org/LaNMaSteR53/peepingtom/ PowerWebShot - https://github.com/dafthack/PowerWebShot

14 epizódok

#Tech #Hacking #Security #Securityhowto #Securitypodcast #Securitytraining #Technicalsegment #Tech News #News #Security Weekly

Tradecraft Security Weekly (Audio)

Automating Screenshots to Quickly Assess Many WebApps - Tradecraft Security Weekly #12

Tradecraft Security Weekly (Audio)

29 subscribers

published 8 éve

Megosztás

MP3•Epizód kép

Full Show Notes: https://wiki.securityweekly.com/TS_Episode12

14 epizódok

#Tech #Hacking #Security #Securityhowto #Securitypodcast #Securitytraining #Technicalsegment #Tech News #News #Security Weekly

Minden epizód

Tradecraft Security Weekly (Audio)

1
Black Hat & DEF CON 2018 - Tradecraft Security Weekly #28 14:20

7 years14:20

14:20

This is the Hacker Summer Camp 2018 edition of Tradecraft Security Weekly. In this week's episode Beau Bullock (@dafthack) talks about some of the more interesting items he saw come out of the Black Hat and DEF CON conferences this year. For Show Links: https://wiki.securityweekly.com/TS_Episode28

Tradecraft Security Weekly (Audio)

1
Phishing 2FA Tokens with CredSniper - Tradecraft Security Weekly #25 19:06

7 years19:06

19:06

Organizations are implementing two-factor on more and more web services. The traditional methods for phishing credentials is no longer good enough to gain access to user accounts if 2FA is setup. In this episode Mike Felch (@ustayready) and Beau Bullock (@dafthack) demonstrate a tool that Mike wrote called CredSniper that assists in cloning portals for harvesting two-factor tokens. Links: https://github.com/ustayready/CredSniper…

Tradecraft Security Weekly (Audio)

1
Evading Network-Based Detection Mechanisms - Tradecraft Security Weekly #24 19:41

7 years19:41

19:41

In this episode of Tradecraft Security Weekly hosts Beau Bullock (@dafthack) and Mike Felch (@ustayready) discuss methods for evading network-based detection mechanisms. Many commercial IDS/IPS devices do a pretty decent job of detecting standard pentesting tools like Nmap when no evasion options are used. Additionally, companies are doing a better job at detecting and blocking IP addresses performing password attacks. Proxycannon is a tool that allows pentesters to spin up multiple servers to proxy attempts through to bypass some of these detection mechanisms. Links: Nmap Evasion Options - https://nmap.org/book/man-bypass-firewalls-ids.html ProxyCannon - https://www.shellntel.com/blog/2016/1/14/update-to-proxycannon…

Tradecraft Security Weekly (Audio)

1
HTML5 Storage Exfil via XSS - Tradecraft Security Weekly #23 14:31

7 years14:31

14:31

It is fairly common for pentesters to discover Cross-Site Scripting (XSS) vulnerabilities on web application assessments. Exploiting these issues potentially allow access to a user's session tokens enabling attackers to navigate a site as the victim in the context of the web application. In this episode the hosts Beau Bullock (@dafthack) & Mike Felch (@ustayready) demonstrate how to exploit a XSS vulnerability to access HTML5 local storage to steal a cookie. (Sorry the camera video feed froze at 9 minutes)…

Tradecraft Security Weekly (Audio)

1
Leaking Windows Creds Externally Via MS Office - Tradecraft Security Weekly #21 12:56

7 years12:56

12:56

In this episode of Tradecraft Security Weekly, Mike Felch discusses with Beau Bullock about the possibilities of using framesets in MS Office documents to send Windows password hashes remotely across the Internet. This technique has the ability to bypass many common security controls so add it to your red team toolboxes. Mike Felch (@ustayready) Beau Bullock (@dafthack) LINKS: SensePost Blog - https://www.dropbox.com/s/hmna48mc6qodlrw/TSW%20Episode%2021.mp4?dl=0…

Tradecraft Security Weekly (Audio)

1
Google Event Injection - Tradecraft Security Weekly 20 13:12

7 years13:12

13:12

Google provides the ability to automatically add events to a calendar directly from emails received by Gmail. This provides a unique situation for phishing attempts as most users haven't been trained to watch their calendar events for social engineering attempts. In this episode Beau Bullock (@dafthack) and Michael Felch (@ustayready) show how to inject events into a targets calendar using MailSniper bypassing some security controls that Google has in place. Links: Blog Post: https://www.blackhillsinfosec.com/google-calendar-event-injection-mailsniper/…

Tradecraft Security Weekly (Audio)

1
Domain Fronting - Tradecraft Security Weekly #18 15:33

7 years15:33

15:33

Domain fronting is a technique used to mask command and control (C2) traffic. It is possible for C2 channels to be proxied through CDN's like Cloudfront to make it appear like normal Internet traffic. It is very difficult to detect and block for defenders as it appears as if clients on a network are connecting to valid CDN domains. But, in reality it is transporting a command and control channel. In this episode of Tradecraft Security Weekly Beau Bullock (@dafthack) is joined by Ralph May (@ralphte1) to talk about what domain fronting is and how to set it up using Cloudfront and PowerShell Empire. LINKS: https://blog.cobaltstrike.com/2017/02/06/high-reputation-redirectors-and-domain-fronting/ https://signal.org/blog/doodles-stickers-censorship/ https://www.securityartwork.es/2017/01/24/camouflage-at-encryption-layer-domain-fronting/ https://trac.torproject.org/projects/tor/wiki/doc/meek http://bryceboe.com/2012/03/12/bypassing-gogos-inflight-internet-authentication/ Full Show Notes: https://wiki.securityweekly.com/TS_Episode18…

Tradecraft Security Weekly (Audio)

1
Cracking Password Hashes Efficiently - Tradecraft Security Weekly #17 16:00

8 years16:00

16:00

If you are a penetration tester password cracking is something you will inevitably do. On most engagements we typically don't have months on end to crack passwords. In an effort to help be more efficient in your cracking techniques Beau Bullock (@dafthack) describes various ways to streamline your approach to cracking in episode 17 of Tradecraft Security Weekly. LINKS: Beau's blog post on password cracking - http://www.dafthack.com/blog/howtocrackpasswordhashesefficiently Hashcat Hash Examples - https://hashcat.net/wiki/doku.php?id=example_hashes…

Tradecraft Security Weekly (Audio)

1
Automating Screenshots to Quickly Assess Many WebApps - Tradecraft Security Weekly #12 9:29

8 years9:29

9:29

On penetration tests we are often-times faced with very large external or internal attack surfaces that are made up of multiple web applications. When there is a need to assess thousands of webapps quickly manually navigating each page with a browser would be very inefficient. In this episode of Tradecraft Security Weekly Beau Bullock (@dafthack) details how to automatically screenshot multiple web applications for quick analysis. Full Show Notes: https://wiki.securityweekly.com/TS_Episode12 LINKS: EyeWitness - https://github.com/ChrisTruncer/EyeWitness Rawr - https://bitbucket.org/al14s/rawr/wiki/Home httpscreenshot - https://github.com/breenmachine/httpscreenshot Peeping Tom - https://bitbucket.org/LaNMaSteR53/peepingtom/ PowerWebShot - https://github.com/dafthack/PowerWebShot…

Tradecraft Security Weekly (Audio)

1
Situational Awareness with HostRecon - Tradecraft Security Weekly #7 11:00

8 years11:00

11:00

After exploiting a system on a remote & unfamiliar network it is extremely important to gain situational awareness as quickly, and quietly as possible. This will help ensure success moving forward with other attacks. In this episode of Tradecraft Security Weekly Beau Bullock (@dafthack) will show how to use PowerShell to query information about the current computer, user, and domain to avoid running built-in commands like 'net', 'ipconfig', or 'netstat'. LINKS: HostRecon: https://github.com/dafthack/HostRecon More on HostRecon: https://www.blackhillsinfosec.com/?p=5824…

Tradecraft Security Weekly (Audio)

1
Windows Privilege Escalation Techniques - Tradecraft Security Weekly #2 11:11

8 years11:11

11:11

Tradecraft Security Weekly (Audio)

1
Meterpreter with Categorized Domains & Trusted Certs - Tradecraft Security Weekly #4 12:06

8 years12:06

12:06

It is common for organizations to proxy web traffic so they can place restrictions on what websites can be visited by employees. To make the management of allowing or denying access to a large number of sites easier many web proxies utilize categorization engines to group sites into various subjects. Uncategorized sites are generally blocked. In this episode I show how it's easy to locate recently expired domains that have been categorized already, and can be utilized to get past web proxy filters. Additionally, I show how easy it is to set up a trusted certificate on the payload handler to encrypt the session using a custom cert. Links: DomainHunter - https://github.com/minisllc/domainhunter Brian Fehrman Blog Post - http://www.blackhillsinfosec.com/?p=5831…

Tradecraft Security Weekly (Audio)

1
Attacking Exchange/OWA to Gain Access to AD Accounts - Tradecraft Security Weekly #3 12:39

8 years12:39

12:39

Microsoft Exchange and Office365 are extremely popular products that organizations use for enterprise email. These services can be exploited by remote attackers to potentially gain access to Active Directory user credentials. In this Tradecraft Security Weekly episode Beau Bullock (@dafthack) demonstrates how to utilize MailSniper to enumerate internal domains, enumerate usernames, perform password spraying attacks, and get the global address list from Exchange and Office365 portals. Links: MailSniper - https://github.com/dafthack/MailSniper…

Tradecraft Security Weekly (Audio)

1
Public File Metadata Analysis - Tradecraft Security Weekly #1 11:18

8 years11:18

11:18

Public File Metadata Analysis with PowerMeta - It is very common for organizations to post files (docx, pdf, xlsx, etc.) to publicly available websites on the Internet. Often times these organizations have not taken the time to strip the metadata attached to these files. This leaves the potential for remote attackers to discover sensitive information from them including usernames, software used to create them, or system names. In this episode Beau demonstrates a PowerShell tool called PowerMeta that can be used to discover these files on a target site and extract the metadata from them. PowerMeta: https://github.com/dafthack/PowerMeta Strip Word Docs of Metadata: https://support.office.com/en-us/article/Remove-hidden-data-and-personal-information-by-inspecting-documents-356b7b5d-77af-44fe-a07f-9aa4d085966f Strip PDFs of Metadata: https://blog.joshlemon.com.au/protecting-your-pdf-files-and-metadata/ Strip Photos of Metadata: http://www.makeuseof.com/tag/3-ways-to-remove-exif-metadata-from-photos-and-why-you-might-want-to/…

Üdvözlünk a Player FM-nél!

A Player FM lejátszó az internetet böngészi a kiváló minőségű podcastok után, hogy ön élvezhesse azokat. Ez a legjobb podcast-alkalmazás, Androidon, iPhone-on és a weben is működik. Jelentkezzen be az feliratkozások szinkronizálásához az eszközök között.