How to Install Nmap From Source

Author: Royce Davis Posted In Tools On: 2016/09/28 No comments
How to Install Nmap From Source

Nmap is a network mapping tool used during the Information Gathering phase of a network penetration testing engagement. It is completely free and open source. Click on the following link for more information about the Nmap Project. In this step-by-step tutorial you will learn how to install nmap from scratch on an Ubuntu Linux machine. Read More


Another Lap Around Microsoft LAPS

Author: Leo Loobeek Posted In Penetration Testing Tutorials On: 2016/08/04 Comments: 2
Another Lap Around Microsoft LAPS

I recently landed on a client’s network with an implementation of Microsoft LAPS on a few thousand hosts. This blog post will walk through how to identify the users sysadmins delegated to view LAPS passwords, and how to identify the users sysadmins have no idea can view LAPS passwords. Read More


Credential Harvesting via MiTM – Burp Suite Tutorial

Author: Royce Davis Posted In Penetration Testing Tutorials On: 2016/06/09 Comments: 2
Credential Harvesting via MiTM - Burp Suite Tutorial

In this step by step tutorial we will discuss some of the more advanced use cases for the Burp Suite.  Credential harvesting through Man In The Middle attack vectors can be your saving grace during an otherwise uneventful penetration test.  You can watch a video version of this tutorial Here. This guide is intended to be educational as well as entertaining.  The author does not condone or encourage illegal hacking activities. Read More


SSL Certificate from letsencrypt.org – Setup Guide

Author: zeknox Posted In Phishing On: 2016/05/31 No comments
SSL Certificate from letsencrypt.org - Setup Guide

I’m sure many of you have heard of the new free service from letsencrypt.org which essentially offers a valid SSL Certificate for everyone. The goal of the project is to run the entire internet over HTTPS without any excuses.

I’ve been using the service since early this year when they launched the beta, and I have to tell you that it is legit and something you really should be incorporating into your e-mail phishing process. Since we are going to provide professional phishing services for our clients, doing it over HTTPS and with a valid SSL Certificate is a must whenever we harvest sensitive info. Read More


Phishing Frenzy: SSL Support on Rails 4 with Syntax Highlighting

Author: zeknox Posted In Phishing On: 2014/12/04 No comments
Phishing Frenzy: SSL Support on Rails 4 with Syntax Highlighting

It’s been a little over a year since I started phishing full time with Phishing Frenzy and there is no looking back now. The project has really come a long way since I first started with it. I can’t thank the community enough for all the support and contributions along the way. Phishing today seems more enjoyable than ever before and I owe a lot of that gratification to Phishing Frenzy.

If you haven’t had a chance to checkout the project, I highly recommend you do and get involved. We are always seeking new templates to be added to our official gallery for the entire community to use, tweak and share.

Read More


How To Use Burp Suite – Web Penetration Testing (Part 2)

Author: Royce Davis Posted In Web Applications On: 2014/11/14 Comments: 4
How To Use Burp Suite - Web Penetration Testing (Part 2)

In our last Burp Suite Tutorial we introduced some of the useful features that Burp Suite has to offer when performing a Web Application Penetration Test. In part 2 of this series we will continue to explore how to use Burp Suite including: Validating Scanner Results, Exporting Scanner Reports, Parsing XML Results, Saving a Burp Session and Burp Extensions. Lets get right to it!
Read More


Phishing Frenzy: HTA PowerShell Attacks with BeEF

Author: zeknox Posted In Phishing On: 2014/07/22 Comments: 2
Phishing Frenzy: HTA PowerShell Attacks with BeEF

If you’re not currently using Phishing Frenzy, BeEF, or PowerSploit for your Phishing campaigns you’re really missing out. In this article we are briefly going to cover what I consider to be one of the “new hotness” attack vectors that every pentester should be using in their next phishing assessment.

With that said we are very pleased to announce that BeEF is now integrated in Phishing Frenzy. If you’re not familiar with BeEF or its capabilities I would highly recommend you check it out. BeEF is the browser exploitation framework and one of the major features is the ability to hook browsers and inject JavaScript into browser sessions.

With the recent addition of BeEF integration to Phishing Frenzy you can now hook and launch client side attacks easier than ever. With a simple click of the button Phishing Frenzy will instantly add JavaScript tags that BeEF requires. This means any target landing on your phishing page will instantly get hooked if JavaScript is enabled (which it usually is!).

Read More


Burp Suite Tutorial – Web Application Penetration Testing (Part 1)

Author: Royce Davis Posted In Web Applications On: 2014/07/02 Comments: 8
Burp Suite Tutorial - Web Application Penetration Testing (Part 1)

Burp Suite from Portswigger is one of my favorite tools to use when performing a Web Penetration Test. The following is a step-by-step Burp Suite Tutorial. I will demonstrate how to properly configure and utilize many of Burp Suite’s features. After reading this, you should be able to perform a thorough web penetration test. This will be the first in a two-part article series.
Read More


Hacking Jenkins Servers With No Password

Author: Royce Davis Posted In Penetration Testing Tutorials On: 2014/06/13 Comments: 3
Hacking Jenkins Servers With No Password

Here’s a fun Jenkins trick I have been using on some recent Information Security Assessments to gain an initial foothold. If you aren’t familiar with hacking Jenkins servers, it runs by default on port 8080 and also by default it has no password (Hurray!). According to their Wiki: “Jenkins is an award-winning application that monitors executions of repeated jobs, such as building a software project or jobs run by cron.” Here is what Jenkins looks like. Read More


Subscribe To Pentest Geek

Follow Pentest Geek

twitterrssyoutubetwitterrssyoutube

Recent Posts

Penetration Testing

Categories

Metasploit

Archives

Web Application Hacking

css.php