Docker for Pentesters
Docker has become such an integral part of my worfklow recently. These examples should demonstrate how Docker can help you be a more efficient pentester
[Read More]
Attacking Default Installs of Helm on Kubernetes
Default installations of Helm on Kubernetes can make it trivial for attackers to escalate to cluster admin. In this post I'll demonstrate how.
[Read More]
Serverless Toolkit for Pentesters
Serverless functions have so much potential - here's a few useful examples I use when pentesting or doing bug bounties. Who needs testing infrastructure?
[Read More]
Extracting SSH Private Keys From Windows 10 ssh-agent
The newest Windows 10 update includes OpenSSH utilities, including ssh-agent. Here's how to extract unencrypted saved private keys from the registry
[Read More]
SANS Holiday Hack 2017 Writeup
The SANS team hit another homerun with the HHC including awesome challenges that mimicked real-world pentest activities. Here's my solutions!
[Read More]
Using Credentials to Own Windows Boxes - Part 3 (WMI and WinRM)
WMI and WinRM are two Windows administrative "features" that are ripe for abuse if you have credentials. In this post, I'll show how to (mis)use them...
[Read More]
Plundering Docker Images
On a recent pentest, we recovered credentials to a private Docker registry. Looting the contained images yielded us source code and admin ssh keys.
[Read More]