Passed the GCIH today. Also last week I won the SANS 504 CTF for the class which was much simpler than the SANS 560 CTF. Thanks to Kevin Fiscus for the great class and props for turning a mediocre social engineering attempt into a prime Read More …
Congrats to the whole team, the Voice of Victory. This year we took first place in the The Joint Cyber Competition (JCC), formerly known as the Cyber Captain’s Cup Competition. It is a 36-hour CTF that aims to inspire creativity and the development of cyber professionals Read More …
LAPS (Local Administrator Password Solution) was just released by Microsoft. LAPS is a GPO client-side extension that manages the creation and storage of unique client local administrator accounts (RID 500). This a big blow to pentesters and attackers who compromise one system’s local admin and rely Read More …
I like encryption downgrade attacks and sslstrip. I hear a lot about attacks that are based on tricking clients to accepting a false certificate but I really like attacks that are based on weaknesses in the program logic itself. Enter CVE-2015-3152 (yes it lists the CVE as Read More …
When faced with a large task, project, or looming deadline I often whip out the quote, either audibly or internally, “How do you eat an elephant?” Asking this rhetorical question is immediately self-answered with a booming, “One bite (byte) at a time.” Well when looking Read More …