penetration testing

External/Internal, Red Team 2FA, ask and it will be given to you, bypassing 2fa, help desk, helpful help desk, MailSniper, OWA, password policy, passwords, pen-testing, penetration testing, pentest, Pentesting, two-factor, VPN

How to Bypass Two-Factor Authentication – One Step at a Time

Sally Vandeven // Back in November Beau Bullock wrote a blog post describing how his awesome PowerShell tool MailSniper can sometimes bypass OWA portals to get mail via EWS if […]

Read the entire post here

InfoSec 201 easter eggs, low hanging fruit, pen-testing, penetration testing, Pentesting, the best parts of our job

Go Ahead, Make Our Day

Sally Vandeven & the BHIS Team // I was recently on an assessment where I was able to grab all the password hashes from the domain controller. When I extracted the hashes and […]

Read the entire post here

Author, Jordan Drysdale, Red Team, Wireless onsite, pen-testing, penetration testing, Pentesting, Wi-Fi travel kit, wireless kit

The Wi-Fi Travel Kits

Jordan Drysdale // Sally and I recently ventured to an on-site wireless engagement with a very security-mature customer. Long story short, the level of protection that WPA2 Enterprise with certificate validation provides […]

Read the entire post here

Phishing, Red Team con artistry, Marketing, pen-testing, penetration testing, Pentesting, phishing, social engineering

A Marketer’s Lessons in Con Artistry for Good & Learning

Sierra Ward* // Normally I am hidden in the back rooms at BHIS, chipping away at 10 million marketing tasks.  I show up occasionally in webcasts, lurking again in the shadows, […]

Read the entire post here

Author, Brian King, InfoSec 101, Red Team kitchen remodel, pen-testing, penetration testing, pentest, Pentesting, Red Team, red team your life, red teaming

Book Review: “Red Team – How to Succeed by Thinking Like the Enemy”

Brian B. King // Red Teaming is one of those terms popping up all over the place lately, and it seems to mean different things to different people. Is it […]

Read the entire post here

General InfoSec Tips & Tricks, InfoSec 101 be careful whom you trust, con artistry, crying babies, pen-testing, penetration testing, people are kind, people are naive, phishing, scamming, social engineering, trust

The Easiest Con – Hacking the Human & 9 Tips to Avoid Social Engineering

Heather Doerges // Of all the services we offer at BHIS, Social Engineering is the most interesting to me. It’s something (and quite possibly the only thing) I completely understand […]

Read the entire post here

Carrie Roberts, Phishing, Red Team autorun, penetration testing, pentest, Pentesting, phishing, social engineering

Phishing with PowerPoint

Carrie Roberts & Chevy Swanson // How do we make sure people open up our malicious files and execute them? We simply let Microsoft work for years and years to gain […]

Read the entire post here

External/Internal, Red Team Carrie Roberts, external network assessment, mail relays, mail servers, pen-testing, penetration testing, Pentesting, testing for open mail relays

How to Test for Open Mail Relays

Carrie Roberts // *Guest Blog It is important to ensure that your external mail servers are properly configured to not support open relaying of mail. An open mail relay can […]

Read the entire post here