Below you will find a collection of videos covering all different topics in information security provided by Red Siege. You can catch up on a past SiegeCast or discover various talks from previous events on things like Assumed Breach Method
Penetration testing Web API’s can be difficult without an effective approach, so Charles Shirer is here to provide you with a few tips and tricks! Charles breaks down the fundamentals of hacking Web API’s and the methodology that he has used during his career to perform successful and effective Web API penetration tests over the years.
Red Siege team wants to open up the conversation. This time, we are giving direct access to each member and their various experiences and expertise from the beginning of the discussion. We know that, even with all the information out there, sometimes just lending your ear to whomever needs some questions answer can be just as useful. This is open to everyone! From those in the early stages of their career looking to get into some conversations about various topics to advanced professionals wanting some fresh eyes or possible problem solving. Curious about penetration testing or information security in general, this is the place for all.
Tim breaks down the simplest red team tricks and hacks with real impact he has encountered over the years. We are going to take the Advanced out of APT, because so few attackers really need to use advanced or overly complicated techniques to achieve their goals. We will also discuss the simple defenses that make an attacker’s life much more difficult.
There are lots of us who want to know more but are either overwhelmed by the idea that buffer overflows are beyond their capabilities or just don’t know where to get started. This is a 101-level talk; Mike Saunders talks about how a buffer overflow works, how to fuzz an app to identify an overflow opportunity, and how to create a simple overflow that will result in a compromise of a target system. By the end, you will have the information and resources needed to write your first overflow.
Want to understand how Kerberos works? Would you like to understand modern Kerberos attacks? Tim Medin walks you through how to attack Kerberos with ticket attacks and Kerberoasting. He covers the basics of Kerberos authentication and then show you how the trust model can be exploited for persistence, pivoting, and privilege escalation. At the conclusion, he discusses defenses for these various attacks.
As a continuation of “ASSUMED BREACH PART I” with Tim Medin – We will be taking an even deeper and more critical look at today’s current penetration test standard. The current model for penetration testing is broken. The typical scan and exploit model doesn’t reflect how real attackers operate after establishing a foothold. At the same time, most organizations aren’t mature enough to need a proper red team assessment. It’s time to start adopting the assumed breach model. In this talk, Mike will discuss techniques for assumed breach assessments that provide a better model for emulating the techniques attackers use once they’ve established a foothold inside a typical network.
Traditional penetration testing often concede internal access to the tester, but then the tester does a lot of scanning and poking around. This is not representative of most breaches. Most breaches start with a phish and adversary effectively starts with access as one of your users on one of your systems. Are you prepared to defend? In this talk, Tim Medin will discuss the shortcomings of the traditional penetration test, and talk you through ways to deliver (and receive) a higher value penetration test.
Want to be more offensive in the office? Many defenders want to try their hand at offense. The trick is, they can and they should! You can do bits of pen testing in your defensive role and management will likely thank you for it. In this talk, Tim Medin will discuss how he used his defensive roll to pivot into offense. Even if you don’t want to leave defense (because defense is fun too) you might want to spend some time looking at the other side.
Corey Overstreet talks intelligence gathering made easy. Ever wonder how attackers gather information on a target organization? Knowing where to look can uncover a wealth of information leading to a successful phish or first foothold. In this talk, we will cover different intelligence gathering techniques targeting an organization’s external services and staff all while leaving little to no trace of our actions.
Tim Medin and Mike Saunders show you tools and techniques to find vulnerabilities and demonstrate risk, without using Domain Administrator access. Domain Admin access is the goal for many penetration tests and red teams, but it is misguided. Domain Admin is a tool, not a destination. Sometimes, a penetration tester or red team will be unable to obtain this access, but it does not mean that the test is without value.
Tim Medin discuss the dumbest red team tricks and hacks encountered over the years. We are going to take the A out of APT, because so few attackers really need to use advanced techniques. You often don’t have to do advanced attacks to have significant impact. This is an updated version of the original talk with new stories and examples.
Getting started with testing web apps can be a daunting task. “Ooh, shiny!” rabbit holes are just around the corner with every click. Without a good plan and a road map, it can be very easy to get lost in these holes and run out of time before reaching your goal. This talk covers how to identify the goal and set up a plan that will help you avoid the rabbit holes, identify the points you should focus on, and ultimately help you become an effective application tester.
Tim Medin discuss the dumbest red team tricks and hacks encountered over the years. We are going to take the A out of APT, because so few attackers really need to use advanced techniques. You often don’t have to do advanced attacks to have significant impact.
Blue of being blue? Want to be more offensive in the office? Many defenders what want to try their hand at offense. The trick is, they can! You can do bits of pen testing in your defensive role and management will likely thank you for it. In this presentation, Tim discusses how he used his defensive roll to pivot into offense. Even if you don’t want to leave defense (because defense is fun too) you might want to spend some time looking at the other side.
Meteor is a game-changing framework for rapid software development and is the top-rated web framework on Github. Meteor offers a number of benefits including offering real-time applications by default. With its great benefits, we are likely to see more Meteor applications…
…And you should know how to hack it!