by Mike Saunders | Jan 6, 2021 | Blog Posts
I recently performed an assumed breach test against what I would consider an Apex Defender organization. The security team is smart, well-funded, extremely capable, and resourceful. The team has both hardened systems and instrumented great logging and monitoring....
by Mike Saunders | Oct 30, 2020 | Blog Posts
It’s fairly well known that printers and MFDs can be a gateway to compromise on otherwise secured networks. We regularly encounter networks filled with these devices internal tests and (ab)use their functionality in various ways, including harvesting usernames,...
by Mike Saunders | Apr 16, 2020 | Blog Posts
This is the third installment in a series of blogs on user enumeration. In Part 1 – Building Name Lists, I talked about ways of building usernames from OSINT and US census data. In this installment, I’m going to discuss putting this info to work in...
by Mike Saunders | Mar 24, 2020 | Blog Posts
A common tactic used by pen testers, “red teams”, and threat actors is searching for Group Policy Preference (GPP) files with usernames and passwords. These XML files, stored in the domain SYSVOL, are used to create local administrator accounts, map...
by Mike Saunders | Mar 10, 2020 | Blog Posts
It’s not uncommon on external pen tests and red team engagements to find very little attack surface on the customer’s internet-facing networks. Customers have started shifting services to cloud providers, making it harder to find targets. This blog...
