Blog - Page 2 of 5 - Pentest Geek

Credential Harvesting via MiTM – Burp Suite Tutorial

Credential-Harvesting-Via-MiTM-Burp-Suite

In this step by step tutorial we will discuss some of the more advanced use cases for the Burp Suite.  Credential harvesting through Man In The Middle attack vectors can be your saving grace during an otherwise uneventful penetration test.  You can watch a video version of this tutorial Here. This guide is intended to be educational as well as entertaining.  The author does not condone or encourage illegal hacking activities.
Read More


SSL Certificate from letsencrypt.org – Setup Guide

SSL Certificate From letsencrypt.org

I’m sure many of you have heard of the new free service from letsencrypt.org which essentially offers a valid SSL Certificate for everyone. The goal of the project is to run the entire internet over HTTPS without any excuses.

Read More


Phishing Frenzy: SSL Support on Rails 4 with Syntax Highlighting

Phishing Frenzy: SSL Support on Rails 4

It’s been a little over a year since I started phishing full time with Phishing Frenzy and there is no looking back now. The project has really come a long way since I first started with it. I can’t thank the community enough for all the support and contributions along the way. Phishing today seems more enjoyable than ever before and I owe a lot of that gratification to Phishing Frenzy.

Read More


How To Use Burp Suite – Web Penetration Testing (Part 2)

Burp Suite Tutorial Part 2

In our last Burp Suite Tutorial we introduced some of the useful features that Burp Suite has to offer when performing a Web Application Penetration Test. In part 2 of this series we will continue to explore how to use Burp Suite including: Validating Scanner Results, Exporting Scanner Reports, Parsing XML Results, Saving a Burp Session and Burp Extensions. Lets get right to it!
Read More


Phishing Frenzy: HTA PowerShell Attacks with BeEF

If you’re not currently using Phishing Frenzy, BeEF, or PowerSploit for your Phishing campaigns you’re really missing out. In this article we are briefly going to cover what I consider to be one of the “new hotness” attack vectors that every pentester should be using in their next phishing assessment.

Read More


Burp Suite Tutorial – Web Application Penetration Testing (Part 1)

Burp Suite from Portswigger is one of my favorite tools to use when performing a Web Penetration Test. The following is a step-by-step Burp Suite Tutorial. I will demonstrate how to properly configure and utilize many of Burp Suite’s features. After reading this, you should be able to perform a thorough web penetration test. This will be the first in a two-part article series.
Read More


Hacking Jenkins Servers With No Password

Hacking Jenkins Servers With No Password

Here’s a fun Jenkins trick I have been using on some recent Information Security Assessments to gain an initial foothold. If you aren’t familiar with hacking Jenkins servers, it runs by default on port 8080 and also by default it has no password (Hurray!). According to their Wiki: “Jenkins is an award-winning application that monitors executions of repeated jobs, such as building a software project or jobs run by cron.” Here is what Jenkins looks like.Read More


Phishing Frenzy: Increase Reporting Fu

Phishing Frenzy: Increase Reporting Fu

The development and addition of new features within Phishing Frenzy (PF) continues to grow. Some of these latest upgrades and email phishing features come from a lot of feedback that I have obtained from the community. Thank you all for the great feedback regarding PF.

Recently PF was converted and upgraded to run the latest version of bootstrap. Previously PF was running bootstrap version 2 and was missing out on some of the latest bootstrap features. The conversion was fairly long and painful, but the end result is very pleasing.

Read More


Thotcon 0x5 Phishing Frenzy

Thotcon 0x5 Phishing Frenzy

As most of you already know, Thotcon one of the paramount security conferences took place a couple weeks ago in Chicago. I got the incredible opportunity to present on the main stage about Phishing Frenzy and show off some of the new features now available.

During the presentation at Thotcon Adam Ringwood and I gave a live demo of the new features and executed a simulated email phishing attack. Those of you who missed it I’ve summarized most of the details in this blog post.Read More


Share This

Recent Posts

Subscribe To Our Mailing List

Become a Web App Penetration Tester

Penetration Testing

Categories

Metasploit

Web Application Hacking


zeknox

Copyright 2018

css.php

Are You Using the Top 5 Pentest Tools?

Enter your email address to download your copy of our FREE e-book and find out now!

Thank you, now go check your email!!