x

75% of people globally want unbiased news (Pew Research) but are concerned they're not getting that.

Get balanced coverage with Symby. See how stories are covered across diverse outlets and spot when one side covers a story the other skips.

PODCAST

7 Minute Security

7 Minute Security is a weekly information security podcast focusing on penetration testing, blue teaming and building a career in security. The podcast also features in-depth interviews with industry leaders who share their insights, tools, tips and tricks for being a successful security engineer.

technology tech news

All Episodes

58:54

7MS #489: Ping Castle

7 Minute Security ·

2021/10/06

Today we're talking about Ping Castle (not a sponsor), an awesome tool for enumerating tons of info out of your Active Directory environment and identifying weaknesses, misconfigurations and paths to escalation! It's wonderful for both red and blue teamers. Some of Ping Castle's cool features include being able find: Kerberoastable and ASREPRoastable users Plain text passwords lingering in Group Policy Objects Users with never-expiring passwords Non-supported versions of Windows Machines configured

en

43:18

7MS #488: How to Succeed in Business Without Really...

7 Minute Security ·

2021/09/29

Today we continue our series focused on building a security consultancy and talk about: A phishing campaign that went off the rails, and lessons learned from it First impressions of an awesome tool to help add MFA to your Active Directory (not a sponsor) A tangent story about how my wife brought some thieves to justice!

en

07:02

7MS #487: Light Pentest eBook Announcement!

7 Minute Security ·

2021/09/28

Hey friends! Today I've got some exciting personal/professional news to share: our Light Pentest eBook - which is a practical, step-by-step playbook for internal network penetration testing - is now available for purchase! Note: this eBook and the Light Pentest LITE training are two separate things, but do cover some of the same topics. The Light Pentest eBook covers: Grabbing and analyzing packet captures Abusing insecure network protocols Exploiting (the lack of) SMB signing Capturing, cracking

en

39:53

7MS #486: Interview with Matt Quammen of Blue Team Alpha

7 Minute Security ·

2021/09/22

Today our good buddy Joe Skeen and I virtually sit down with Matt Quammen of Blue Team Alpha to talk about all things incident response! Topics covered include: Top 5 things to do and not do during ransomware event Challenges when responding to ransomware events Opportunities to break into infosec/IR The value of tabletop exercises, and some great ideas for conducting your own Incident response stress and success stories Cyber insurance - worth it or not?

en

52:57

7MS #485: Interview with Christopher Fielder

7 Minute Security ·

2021/09/15

Today our friend Christopher Fielder from Arctic Wolf is back for an interview four-peat! We had a great chat about making sense of vendor alphabet soup terms (like SIEM, SOC, EDR/MDR/XDR, ML, AI and more!), optimizing your SOC to "see" as much as possible, tackling vendor/customer communication problems, and simplifying security product pricing to make purchases less stressful for customers! And don't forget to check out Christopher's first, second and third interviews with 7MS.

en

46:38

7MS #484: Desperately Seeking a Super SIEM for SMBs -...

7 Minute Security ·

2021/09/08

Today we're continuing our series called Desperately Seeking a Super SIEM for SMBs - this time with a focus on a new contender in our bake-off: Perch Security! It might help you to go back and take in part 1 and part 2, but today we're focusing on the first experience I had chatting with the sales/technical folks at Perch. TLDL: I really liked a lot of things I was hearing and seeing. Pros (perceived) include: Simple pricing model Easy to use dashboard Cool "marketplace" of integrations you can

en

44:28

7MS #483: Desperately Seeking a Super SIEM for SMBs -...

7 Minute Security ·

2021/09/01

Today we continue our series we started recently (part 1 is here about finding a super SIEM for SMBs. Specifically I have some updates on (and frustrations with) Arctic Wolf, Elastic, Milton Security and Perch Security. Here's the TLDL version: Arctic Wolf They remain a strong contender in my bake-offs. They also could tick several boxes for an org as they offer continuous internal/external vulnerability scanning as well as a managed SOC. (And yes, I'm probably a tiny bit biased because I know a

en

13:19

7MS #482: Creating Kick-Butt Credential-Capturing...

7 Minute Security ·

2021/08/26

Today we're continuing our discussion on phishing campaigns - including a technical "gotcha" that might redirect your phishing emails into a digital black hole if you're not careful! As I mentioned last week, I've been heavy into spinning up and tearing down phishing campaigns, so I finally got around to documenting everything in episode 481. This week I ran into a bizarre issue where test phishes to myself suddenly disappeared from my Outlook altogether! After chatting with some folks on Slack I

en

27:24

7MS #481: Creating Kick-Butt Credential-Capturing...

7 Minute Security ·

2021/08/19

Today we're revisiting how to make a kick-butt cred-capturing phishing campaign with Gophish, Amazon Lightsail, LetsEncrypt, ExpiredDomains.net and a special little extra something that makes creating phishing landing pages waaaaaaayyyyyyyyyy easier! For some quicker review, you can check out part 1 and also the complementary YouTube video, but I wanted to revisit this kick-butt process and update a few items: First, this SingleFile extension is amaaaaaaaazing for making phishing landing pages with

en

49:18

7MS #480: Desperately Seeking a Super SIEM for SMBs

7 Minute Security ·

2021/08/12

Today we're talking about the SIEM bake-off for SMBs that we've recently embarked on. We're currently evaluating several solutions - either for customer-facing purposes, internal kick-the-tires fun, or both. Candiates include: Arctic Wolf Elastic Milton Security Protocol46 Sumo Logic First we're starting by running each vendor through a series of questions, then likely following up with a demo where we'll run some technical tests and simulated hacking to see which vendor or vendors reign

en

07:03

7MS #479: A Prelude to PwnTown

7 Minute Security ·

2021/08/06

Hey friends, today we're talking about a new security training offering 7MinSec has created called Light Pentest LITE - Live Interactive Training Experience. It's a 3-day course (with each class session being 3 hours long) consisting of live (via Zoom), hands-on, instructor-led sessions that are focused on teaching you how to find, exploit and defend against common Active Directory weaknesses! Check out today's episode to learn more and get a hint for an OSINT exercise that will get you 10% off of

en

37:18

7MS #478: Password Cracking in the Cloud - Part 4

7 Minute Security ·

2021/07/29

Hey friends, today we're continuing our discussion of password cracking by sharing some methodology that has helped us get a high cred yield, and some tips on taking cracked passwords from multiple sources and Frankensteining them into a beautiful report for your customer. For some background, when 7MS started as a biz, we used to crack passwords in Paperspace but invested in an on-prem cracking rig a few years ago. That rig has been flipping sweet, but had some heating issues which prompted me to

en

38:07

7MS #477: Cobalt Strike for Newbs

7 Minute Security ·

2021/07/21

Today we're talking about Cobalt Strike for newbs - including how to get it up and running, as well as some tools that will help you generate beacons while evading EDR at the same time! Some helpful things mentioned in today's episode: Wherever you spin up your CS instance, it's probably a good idea to lock down the firewall to only specific IPs. With Digital Ocean, I found this article helpful. When generating CS listeners, the C2Concealer from FortyNorth helped me get malleable C2 profiles

en

25:59

7MS #476: Tales of Pentest Pwnage - Part 28

7 Minute Security ·

2021/07/16

**STOP!** If you didn't listen to [last week's episode](https://7ms.us/7ms-475-tales-of-internal-network-pentest-pwnage-part-27/) you might want to, since this was a two-part tale of pwnage. Either way I'll get you up to speed and talk about why this was (of course) one of my favorite pentests ever.

en

56:27

7MS #475: Tales of Internal Network Pentest Pwnage -...

7 Minute Security ·

2021/07/08

Yeahhhhhh! Today's another fun tale of pentest pwnage, including: The importance of starting your pentest with an AD account that actually has access to...ya know...stuff The importance of starting your pentest plugged into a network that actually has...you know...systems connected to it! This BHIS article is awesome for finding treasures in SMB shares PowerUpSQL audits are a powerful way to get pwnage on a pentest - check out this presentation for some practical how-to advice IPMI/BMCs

en

46:12

7MS #474: Password Cracking in the Cloud - Part 3

7 Minute Security ·

2021/06/30

Hey friends! Today we're dusting off an old mini-series about password cracking in the cloud (check out part 1 and part 2) and sharing some awesome info on building a monster of a cracking rig in AWS! One reason we haven't talked about password cracking in the cloud in a while is because back in winter of 2019 I built baby's first password cracking. Unfortunately, this week, Hashy (the name I gave to the rig) is overheating, and GPUs are impossible to find, so what's a pentester to do? Well, in

en

51:09

7MS #473: Interview with Nikhil Mittal

7 Minute Security ·

2021/06/24

Hey everybody! Today Joe and I sat down with Nikhil Mittal of Pentester Academy and Altered Security to talk about a whole slew of fun security topics: How Nikhil first got involved in Pentester Academy Nikhil's hacker origin story How does Nikhil feel about his tools being used by baddies? What security tools/defenses would be good for SMBs to focus on? Active Directory security - is all hope lost? Will AI, ML, Terminator robots, etc. replace all of us who do pentesting for a

en

7MS #473: Interview with Nikhil Mittal

7 Minute Security ·

2021/06/24

Hey everybody! Today Joe and I sat down with Nikhil Mittal of Pentester Academy and Altered Security to talk about a whole slew of fun security topics: How Nikhil first got involved in Pentester Academy Nikhil's hacker origin story How does Nikhil feel about his tools being used by baddies? What security tools/defenses would be good for SMBs to focus on? Active Directory security - is all hope lost? Will AI, ML, Terminator robots, etc. replace all of us who do pentesting for a

en

52:24

7MS #472: Interview with Christopher Fielder

7 Minute Security ·

2021/06/16

Today our good pal Christopher Fielder from Arctic Wolf is back for an interview three-peat! He joins Joe "The Machine" Skeen (a.k.a. Gh0sthax) and I to talk about all things ransomware, including: How the Colonial Pipeline incident may have started from a weak VPN cred with no MFA. Silver lining (?) - they got some of the $ back. Was the federal government's response good enough? What should the government be doing to better handle and manage ransomware? Common ways ransomware gets in our

en

01:02:05

7MS #471: Cyber News - Ransomware Should Run...

7 Minute Security ·

2021/06/09

Hey everybody, happy June! Our pal Joe is back to cover some great security stories with us, including: Peloton's leaky API Some Colonial Pipeline discussion (story 1, story 2) Amazon Sidewalk doesn't really share your Internet connection with neighbors/strangers. The Hacker News article doesn't do an awesome job of clearing that up either.

en

710 results

Similar Podcasts

Lead With AI

Tamara Nall

Linux in the Ham Shack

Black Sparrow Media

Data Engineering Podcast

Tobias Macey

Eye On A.I.

Craig S. Smith

Reflections

Livewire Labs