Tim Tomes

I encountered something on a penetration test today that I thought was kinda neat. I’m sure that others have encountered this before, but it was the first time I stumbled upon it and thought that this might be a good place to share the experience and keep notes for future use. The scenario goes like […]

SSL Stripping is an attack originally discovered by Moxie Marlinspike (@moxie) and released at BlackHat DC 2009 along with a tool called SSLStrip. SSL Stripping is an attack that takes advantage of the fact that server-side redirects are used to pass clients from HTTP versions of a page to the HTTPS, SSL encrypted, version. SSL […]

In episode 291 of Security Weekly, Paul did a tech segment on solving the problem of managing large quantities of web servers discovered by Nessus or Nmap scans. The traditional approach is to open up each of the servers in a browser to see what’s there, then make a decision on which servers to attack, […]

I stumbled upon something the other day that i think will be critical for most penetration testers. Chances are, you run many VMs which are responsible for carrying out a variety of tasks during a penetration test. Linux for attacking, Windows for reporting/attacking, etc. whatever. I use a windows box to do my reporting, because, […]

On a recent penetration test, I ran into an interesting problem whose solution resulted in several handy techniques for remote malware distribution and, in some cases, antivirus bypass. These techniques may be common amongst seasoned penetration testers, but I felt they were worth sharing with the rest of the information security community, seeing as it […]

A while back, Joshua Wright wrote a fantastic paper called “Vista Wireless Power Tools for the Penetration Tester”. At the end of paragraph 2.5, “Analyzing Wireless Profiles”, Josh writes, “The PSK itself and other metadata is stored in the keyMaterial element. At this time, it is not known how to decrypt the PSK, however, since […]

Ever have that moment where hashes just aren’t good enough? Where you don’t have time or power to brute force a 15 character NTLM password? Well, if you were able to dump hashes in the first place, then you’ve already achieved the necessary pre-requisites to dump the passwords in clear text. Yes… you read that […]

This post comes to you from Lamar Spells of http://foxtrot7security.blogspot.com/. ==================== As more companies fall victim to hacks based on SQL Injection and as the regulatory environment becomes more stringent, more and more companies are implementing network-based Web Application Firewalls (WAFs). Shares of one Web Application Firewall maker Imperva (NYSE: IMPV) are up about 40% […]

By now, the research I conducted on safely dumping hashes from live domain controllers is old news. However, there has been an interesting development since the initial release that is worth disclosing. Soon after the initial release of the VSS hash dumping technique, it was discovered and widely publicized that the tools I used in […]

This post comes to you from Lamar Spells of http://foxtrot7security.blogspot.com/. A while back, LaNMaSteR53 (Tim Tomes) discussed a method for brute forcing domain default passwords while avoiding account lockout.  This discussion was in response to a video by Dave Hoelzer on using PowerShell to hack domain user accounts.  The method proposed by LaNMaSteR53 relied on […]