by Mike Saunders | Apr 16, 2020 | Blog Posts
This is the third installment in a series of blogs on user enumeration. In Part 1 – Building Name Lists, I talked about ways of building usernames from OSINT and US census data. In this installment, I’m going to discuss putting this info to work in...
by Mike Saunders | Mar 10, 2020 | Blog Posts
It’s not uncommon on external pen tests and red team engagements to find very little attack surface on the customer’s internet-facing networks. Customers have started shifting services to cloud providers, making it harder to find targets. This blog...
by Mike Saunders | Jan 30, 2020 | Blog Posts
A common part of pen tests – both network and web app – is password spraying. In order to do that, you need usernames. But how do you find out what your target’s usernames are? This is the first in a series of posts to discuss user enumeration and...
by Mike Saunders | Mar 27, 2019 | Blog Posts
Lots of pen test and red team blogs follow the same model: we came, we saw, we conquered, blue team tears flowed. This is not one of those blogs. TL/DR; Pen testing isn’t about finding vulnerabilities. It’s about finding opportunities for your client to...
by Mike Saunders | Nov 30, 2018 | Blog Posts
Did you know you can use DNS queries to exfiltrate data from a database via SQLi? No? Then continue reading! I’ll walk through some techniques you can use to enumerate and exfiltrate data from a DB server via blind SQLi. On a recent web app test, I encountered a...
