Red Team

Author, Brian King, Red Team, Web App cross site tracing, http trace, OWASP, trace request, WAF bypass

Three Minutes with the HTTP TRACE Method

Brian King // All of our scanning tools tell us that we should disable the HTTP TRACE and TRACK methods. And we all think that’s because there’s something an attacker […]

Read the entire post here

C2, Red Team anti-virus, BHIS favorite office sports, blacklisting, C2, evading anti-virus, Kill your AV, macros, microsoft office, veil-evasion

Click to Enable Content

Sally Vandeven // Evading anti-virus scanners has become a bit of a sport around BHIS.  When we do C2 testing for our customers we start with a host on the […]

Read the entire post here

Author, Blue Team, Blue Team Tools, Joff Thyer, Red Team, Red Team Tools EAP Network, TSL Certificates

TLS Certificates from EAP Network Traffic

Joff Thyer // A network can authenticate a client workstation using the 802.1X and Extensible Authentication Protocol (EAP) using multiple different methods.  EAP is used both in a wired network […]

Read the entire post here

David Fletcher, Red Team, Web App Cross-Site Request Forgery, CSRF, CSRF-Token, Recursive Grep, Testing Protected Pages, XSRF

Using Recursive Grep to Test Per-Request CSRF-Token Protected Pages

David Fletcher // Cross-Site Request Forgery (CSRF or XSRF) is an attack which is used to execute a transaction on behalf of a victim user against a vulnerable web application. […]

Read the entire post here

Author, Brian King, Password Spray, Red Team bad passwords, password, passwords

Check\ Your\ Tools

Brian King // There’s a one-liner password spray script that a lot of folks use to see if anyone on a domain is using a bad password like LetMeIn! or […]

Read the entire post here

Author, Brian Fehrman, External/Internal, Red Team EyeWitness, Pentesting, vulnerability scans

EyeWitness and Why It Rocks

Brian Fehrman // External and Internal vulnerability scans are often part of any penetration test. Automated scanning tools, however, can’t always find the “good stuff.” Many times, some of the […]

Read the entire post here

External/Internal, Red Team Carrie Roberts, external network assessment, mail relays, mail servers, pen-testing, penetration testing, Pentesting, testing for open mail relays

How to Test for Open Mail Relays

Carrie Roberts // *Guest Blog It is important to ensure that your external mail servers are properly configured to not support open relaying of mail. An open mail relay can […]

Read the entire post here

Author, Beau Bullock, Recon, Red Team domain credentials, domain creds, password spraying, passwords

Password Spraying Outlook Web Access – How to Gain Access to Domain Credentials Without Being on a Target’s Network: Part 2

Beau Bullock // This is part two of a series of posts (See part 1 here) where I am detailing multiple ways to gain access to domain user credentials without ever being […]

Read the entire post here

Author, Beau Bullock, External/Internal, Password Spray, Red Team domain creds, exploiting passwords, gaining access to domain credentials, passwords, reusing passwords

Exploiting Password Reuse on Personal Accounts: How to Gain Access to Domain Credentials Without Being on a Target’s Network: Part 1

Beau Bullock // In this series of posts I am going to detail multiple ways to gain access to domain user credentials without ever being on a target organization’s network. […]

Read the entire post here