PODCAST · technology
Tradecraft Security Weekly (Video)
by Security Weekly
Want to learn about all of the latest security tools and techniques? This is the show for you! We show you how to install, configure and use a wide variety of security tools for both offense and defense. Whether you are a penetration tester or defending enterprise networks, this show will help you
Episodes
-
Evilginx2 Man-in-the-Middle Attacks - Tradecraft Security Weekly #29
Evilginx2 is a man-in-the-middle framework that can be utilized to intercept credentials including two-factor methods victims utilize when logging in to a web application. Instead of just duplicating the target web application it proxies traffic to it making the experience seamless to the victim....
-
Black Hat & DEF CON 2018 - Tradecraft Security Weekly #28
This is the Hacker Summer Camp 2018 edition of Tradecraft Security Weekly. In this week's episode Beau Bullock (@dafthack) talks about some of the more interesting items he saw come out of the Black Hat and DEF CON conferences this year. For Show Links: https://wiki.securityweekly.com/TS_Episode28
-
PXE Boot Attacks - Tradecraft Security Weekly #27
Network administrators often utilize Pre-boot Execution Environment (PXE) to rapidly deploy new systems on a network easily. Golden system images can be created with all the software and settings already in place for new systems. In this episode of Tradecraft Security Weekly Beau Bullock...
-
OSINT & External Recon Pt. 2: Contact Discovery - Tradecraft Security Weekly #26
During the reconnaissance phase of a penetration test being able to discover employee names and email addresses of an organization is extremely important. It is also important to do so as stealthily as possible. Using open-source techniques and tools it is possible to enumerate employee names and...
-
Phishing 2FA Tokens with CredSniper - Tradecraft Security Weekly #25
Organizations are implementing two-factor on more and more web services. The traditional methods for phishing credentials is no longer good enough to gain access to user accounts if 2FA is setup. In this episode Mike Felch (@ustayready) and Beau Bullock (@dafthack) demonstrate a tool that Mike...
-
Evading Network-Based Detection Mechanisms - Tradecraft Security Weekly #24
In this episode of Tradecraft Security Weekly hosts Beau Bullock (@dafthack) and Mike Felch (@ustayready) discuss methods for evading network-based detection mechanisms. Many commercial IDS/IPS devices do a pretty decent job of detecting standard pentesting tools like Nmap when no evasion options...
-
HTML5 Storage Exfil via XSS - Tradecraft Security Weekly #23
It is fairly common for pentesters to discover Cross-Site Scripting (XSS) vulnerabilities on web application assessments. Exploiting these issues potentially allow access to a user's session tokens enabling attackers to navigate a site as the victim in the context of the web application. In this...
-
Linux Privilege Escalation - Tradecraft Security Weekly #22
After getting a shell on a server you may or may not have root access. To gain privileged access to a Linux system it may take performing more analysis of the system to find escalation issues. In this episode of Tradecraft Security Weekly Beau Bullock (@dafthack) provides a methodology for...
-
Leaking Windows Creds Externally Via MS Office - Tradecraft Security Weekly #21
In this episode of Tradecraft Security Weekly, Mike Felch discusses with Beau Bullock about the possibilities of using framesets in MS Office documents to send Windows password hashes remotely across the Internet. This technique has the ability to bypass many common security controls so add it to...
-
Google Event Injection - Tradecraft Security Weekly #20
Google provides the ability to automatically add events to a calendar directly from emails received by Gmail. This provides a unique situation for phishing attempts as most users haven't been trained to watch their calendar events for social engineering attempts. In this episode Beau Bullock...
-
Dissecting XXE Attacks - Tradecraft Security Weekly #19
When pentesting web services or an application that leverage XML files, XML External Entity (XXE) attacks are a great way to start. By injecting an XXE into a well crafted XML payload before it's sent to the server, a penetration tester can trick the parser into executing other actions that the...
-
Domain Fronting - Tradecraft Security Weekly #18
Domain fronting is a technique used to mask command and control (C2) traffic. It is possible for C2 channels to be proxied through CDN's like Cloudfront to make it appear like normal Internet traffic. It is very difficult to detect and block for defenders as it appears as if clients on a network...
-
Cracking Password Hashes Efficiently - Tradecraft Security Weekly #17
If you are a penetration tester password cracking is something you will inevitably do. On most engagements we typically don't have months on end to crack passwords. In an effort to help be more efficient in your cracking techniques Beau Bullock (@dafthack) describes various ways to streamline…
more -
Pivoting Tools Through Meterpreter - Tradecraft Security Weekly #16
There are a ton of modules in Metasploit that are extremely useful for performing various attacks post-exploitation. But sometimes there are external tools that you might want to use that are not included in Metasploit. It's possible to proxy other external tools through a Meterpreter session…
more -
Identifying Weak Session Tokens Using Entropy - Tradecraft Security Weekly #15
Session management in web applications is extremely important in regards to securing user credentials and integrity within the application. Sometimes session tokens can be predicted provided the overall randomness is weak. If this is possible a remote attacker may be able to compromise the…
more -
Relaying NTLMv1/v2 - Tradecraft Security Weekly #14
A very common attack that many networks are vulnerable to is called LLMNR or NBT-NS poisoning. Through this attack it is possible to gain access to a user's NTLMv1 or v2 password hash. A more interesting attack can be carried out under the same premise though. Instead of just obtaining a password...
-
Black Hat & DEF CON 2017 - Tradecraft Security Weekly #13
There were a lot of amazing new tools and techniques released at Hacker Summer Camp 2017. In this week's episode of Tradecraft Security Weekly Beau Bullock (@dafthack) talks about some of the more interesting items he saw at the Black Hat and DEF CON conferences. Full Show Notes:...
-
Automating Screenshots to Quickly Assess Many WebApps - Tradecraft Security Weekly #12
On penetration tests we are often-times faced with very large external or internal attack surfaces that are made up of multiple web applications. When there is a need to assess thousands of webapps quickly manually navigating each page with a browser would be very inefficient. In this episode of...
-
Sensitive Data Discovery in Email with MailSniper - Tradecraft Security Weekly #11
Email tends to be the primary communication platform for employees of an organization. Often times sensitive data is transmitted from one internal employee to another via this mechanism with no regard for security. In this episode of Tradecraft Security Weekly Beau Bullock (@dafthack) shows how…
more -
Live Response with Google Rapid Response (Blue Team Edition) - Tradecraft Security Weekly #10
How do you perform incident response on systems in your environment at scale or when the system that needs to be analyzed is in a geographically different location than your analysts? What if you need to do this and have no real budget to work with to use commercial tools? The answer is Google...
-
Command & Control 101: Transports - Tradecraft Security Weekly #9
After an attacker is successful in getting a payload onto a system and getting it to run they still have to worry about whether there will be a successful connection out to a command and control server. There are a number of different transport mechanisms that can be utilized including direct TCP...
-
OSINT & External Recon Pt. 1: Host Discovery - Tradecraft Security Weekly #8
During the reconnaissance phase of a penetration test being able to discover the external assets of an organization is extremely important. It is also important to do so as stealthily as possible. Using open-source techniques and tools it is possible to enumerate an organizations external assets...
-
Situational Awareness with HostRecon - Tradecraft Security Weekly #7
After exploiting a system on a remote & unfamiliar network it is extremely important to gain situational awareness as quickly, and quietly as possible. This will help ensure success moving forward with other attacks. In this episode of Tradecraft Security Weekly Beau Bullock (@dafthack) will show...
-
WordPress Vulnerability Discovery and Exploitation - Tradecraft Security Weekly #6
Over 27% of all websites globally run WordPress. This makes WordPress a very highly targeted piece of software. There are numbers of different aspects to consider when attempting to discover vulnerabilities in WordPress. In this episode of Tradecraft Security Weekly Beau Bullock (@dafthack)...
-
Password Spraying Windows Active Directory Accounts - Tradecraft Security Weekly #5
Compromising the credentials of users in an Active Directory environment can assist in providing new possibilities for pivoting around the network. It allows for additional access to various network resources like shares, email and other systems. In this week's episode of Tradecraft Security…
more -
Meterpreter with Categorized Domains & Trusted Certs - Tradecraft Security Weekly #4
It is common for organizations to proxy web traffic so they can place restrictions on what websites can be visited by employees. To make the management of allowing or denying access to a large number of sites easier many web proxies utilize categorization engines to group sites into various...
-
Attacking Exchange/OWA to Gain Access to AD Accounts - Tradecraft Security Weekly #3
Microsoft Exchange and Office365 are extremely popular products that organizations use for enterprise email. These services can be exploited by remote attackers to potentially gain access to Active Directory user credentials. In this Tradecraft Security Weekly episode Beau Bullock (@dafthack)...
-
Public File Metadata Analysis - Tradecraft Security Weekly #1
Public File Metadata Analysis with PowerMeta - It is very common for organizations to post files (docx, pdf, xlsx, etc.) to publicly available websites on the Internet. Often times these organizations have not taken the time to strip the metadata attached to these files. This leaves the potential...
-
Windows Privilege Escalation Techniques (Local) - Tradecraft Security Weekly #2
In episode 2 of Tradecraft Security Weekly Beau Bullock (@dafthack) discusses Windows privilege escalation techniques. There are many reasons why normal employees should not be local administrators of their own systems. Network administrators tend to lock down permissions correctly for users, but...
We're indexing this podcast's transcripts for the first time — this can take a minute or two. We'll show results as soon as they're ready.
No matches for "" in this podcast's transcripts.
No topics indexed yet for this podcast.
Loading reviews...
ABOUT THIS SHOW
Want to learn about all of the latest security tools and techniques? This is the show for you! We show you how to install, configure and use a wide variety of security tools for both offense and defense. Whether you are a penetration tester or defending enterprise networks, this show will help you
HOSTED BY
Security Weekly
CATEGORIES
Loading similar podcasts...
Frequently Asked Questions
How many episodes does Tradecraft Security Weekly (Video) have?
Tradecraft Security Weekly (Video) currently has 29 episodes available on PodParley. New episodes are automatically indexed when they're published to the podcast feed.
What is Tradecraft Security Weekly (Video) about?
Want to learn about all of the latest security tools and techniques? This is the show for you! We show you how to install, configure and use a wide variety of security tools for both offense and defense. Whether you are a penetration tester or defending enterprise networks, this show will help you
How often does Tradecraft Security Weekly (Video) release new episodes?
Tradecraft Security Weekly (Video) has 29 episodes. Check the episode list to see recent publication dates and frequency.
Where can I listen to Tradecraft Security Weekly (Video)?
You can listen to Tradecraft Security Weekly (Video) on PodParley by clicking any episode. We provide an embedded audio player for direct listening, and you can also subscribe via your preferred podcast app using the RSS feed.
Who hosts Tradecraft Security Weekly (Video)?
Tradecraft Security Weekly (Video) is created and hosted by Security Weekly.
URL copied to clipboard!