2 min
Penetration Testing
This One Time on a Pen Test, Part 4: From Zero to Web Application Admin through Open-Source Intelligence Gathering
Open source intelligence gathering (OSINT) can sometimes take a backseat to more glamorous parts of pen tests—but in this case, it saved us.
3 min
Penetration Testing
Pen Test, Part 3: Jumping a Fence and Donning a Disguise
Here is the story of how I jumped a fence and broke into a construction vehicle to take control of an energy company's network.
3 min
Penetration Testing
How to Identify and Prioritize Gaps with the Cybersecurity Maturity Assessment, Post-2018 'Under the Hoodie'
At Rapid7, we believe that cybersecurity within a company is not just a function with many stakeholders, but rather a shared responsibility among all employees, regardless of role.
2 min
Penetration Testing
Pen Test, Part 2: How Just One Flaw Helped Us Beat the Unbeatable Network
During one pen testing engagement, we were pitted against a well-hardened, locked-down, and mature environment. However, all it took was one slip-up to give us the keys to the kingdom.
3 min
Penetration Testing
This One Time on a Pen Test, Part 1: Curiosity Didn’t Kill the Cat—Honesty Did
As part of a penetration test, I worked with the client to craft an engagement that would evaluate their employee and technology preparedness against a sophisticated, targeted phishing and vishing attack.
4 min
Penetration Testing
Under the Hoodie: Which Vulns Are Being Exploited by Attackers (and Our Pen Testers) in 2018?
Software vulnerabilities are at the core of pen testing—and our "Under the Hoodie" report provides insights and advice one can only get in the trenches.
3 min
IoT
Enhancing IoT Security Through Research Partnerships
Securing IoT devices requires a proactive security approach to test both devices and the IoT product ecosystem. To accomplish this, consider setting up a research partnership.
5 min
Penetration Testing
Password Tips from a Pen Tester: Taking the Predictability Out of Common Password Patterns
Humans are predictable. As unique as we like to think we all are, our actions tend to be similar—and our choices when creating a password are no different.
4 min
Penetration Testing
CIS Critical Security Control 20: Measure Your Security Standing with Penetration Tests and Red Team Exercises
Protecting yourself from threats requires consistently asking yourself whether your security program is working as designed. Critical Control 20 covers pen tests and Red Team exercises.
2 min
Penetration Testing
Under the Hoodie 2018: Lessons from a Season of Penetration Testing
Today, I’m excited to announce the release of our 2018 edition of Under the Hoodie: Lessons from a Season of Penetration Testing by the Rapid7 Global Services team, along with me, Tod Beardsley and Kwan Lin.
2 min
Penetration Testing
Password Tips from a Pen Tester: What is Your Company’s Default Password?
Welcome back to Password Tips From a Pen Tester.
The first day on the job: We fill out all the requisite paperwork for Human
Resources and get a computer and our network password. That password is often
something easy to remember, and is often the same for every new employee. It
might be Welcome1, ChangeMe! or one of our old favorites, the SeasonYear (ie.
Summer2018). If a new employee is having trouble signing in for the first time
and they call the help desk, they can easily get the help they
5 min
Penetration Testing
How to Build Your Own Caller ID Spoofer: Part 2
In Part 1 [/2018/05/24/how-to-build-your-own-caller-id-spoofer-part-1/], we
talked about the need for organizations to test their security programs by
performing social-engineering campaigns with their employees so they can
understand employee susceptibility to these kinds of tactics, the potential
impact to the organization of this kind of attack, and develop methods of
defending against a real attack. We spoke about the need for accurately
simulating threat actors by setting up an Asterisk PBX
7 min
Penetration Testing
How to Create a Secure and Portable Kali Installation
The following is a guest post from Rapid7 customer Bo Weaver.
Hi, everyone. I’m Bo, a penetration tester at CompliancePoint (and also a
customer of Rapid7). If you’re just getting started in penetration testing
[https://www.rapid7.com/fundamentals/penetration-testing/], or are simply
interested in the basics, this blog is for you.
An Intro to Kali
Kali Linux is an open source project that is maintained and funded by Offensive
Security [https://www.offensive-security.com/], a provider of inform
3 min
Penetration Testing
Password Tips From a Pen Tester: Common Patterns Exposed
When my colleagues and I are out on penetration tests, we have a fixed amount of
time to complete the test. Efficiency is important. Analyzing password data like
we’re doing here helps pen testers better understand the likelihood of password
patterns and choices, and we use that knowledge to our advantage when we perform
penetration testing [https://www.rapid7.com/fundamentals/penetration-testing/]
service engagements at Rapid7.
In my experience, most password complexity policies require at l
6 min
Penetration Testing
How to Build Your Own Caller ID Spoofer: Part 1
Purpose
Organizations with mature security programs often test their own internal
awareness programs by performing social engineering campaigns (e.g., telephone
pretexting) on their personnel. These may include hiring third-party consulting
companies as well as performing internal tests. These tests should strive to be
as real-world as possible in order to accurately simulate a malicious actor and
learn from employees’ reactions and ascertain the level of risk they pose to the
organization.
Spo