Penetration Testing

The official banner image for ShmooCon 2025.

shmoocon-double-banner-2025

Career Management

Malware

Perspective

ShmooCon ends 20-year run with tears, malware and electronic fun

<body>We're a fan of hacker lore and history here at Security Weekly. In fact, Paul's Security Weekly has interviewed some of the most notable (and notorious) personalities from both the business side of the industry and the hacker community.</body>

<body>We're a fan of hacker lore and history here at Security Weekly. In fact, Paul's Security Weekly has interviewed some of the most notable (and notorious) personalities from both the business side of the industry and the hacker community.</body>

<body>We're very excited to share this new effort to document hacker history through in-person interviews. The series is called "Where Warlocks Stay Up Late", and is the creation of Nathan Sportsman and other folks at <a rel="noreferrer noopener" target="_blank" href="https://www.praetorian.com/">Praetorian</a>. The timing is crucial, as a lot of the original hackers and tech innovators are getting older, and we've already lost a few.</body>

<body>We're very excited to share this new effort to document hacker history through in-person interviews. The series is called "Where Warlocks Stay Up Late", and is the creation of Nathan Sportsman and other folks at <a rel="noreferrer noopener" target="_blank" href="https://www.praetorian.com/">Praetorian</a>. The timing is crucial, as a lot of the original hackers and tech innovators are getting older, and we've already lost a few.</body>

<body><ul><li>Check out the <a rel="noreferrer noopener" target="_blank" href="https://wherewarlocksstayuplate.com">Where the Warlocks Stay Up Late</a> website and subscribe to get notified of each episode as it is released</li><li>Check out the <a rel="noreferrer noopener" target="_blank" href="https://wherewarlocksstayuplate.com">anthropological hacker map</a> and relive your misspent youth!</li></ul></body>

Featured image for {“vendor”:”ppworks”,”type”:”segment”,”id”:”13562″} podcast from PPWorks

Leadership

Cyber veterans

Building a map of hacker history, one conversation at a time – Nathan Sportsman – ESW #389

Resource

Horizon3.ai

Five steps to better cyber risk assessments via autonomous pentesting

law_justice_AdobeStock_834621622

Government Regulations

Threat Intelligence

News

Legal protections for security researchers sought in new German draft law

<body>After spending a decade working for appsec vendors, Grant McKracken wanted to give something back. He saw a gap in the market for free or low-cost services for smaller organizations that have real appsec needs, but not a lot of means to pay for it. He founded DarkHorse, who offers VDPs and bug bounties to organizations of all sizes for free, or for as low of cost as possible.</body>

<body>After spending a decade working for appsec vendors, Grant McKracken wanted to give something back. He saw a gap in the market for free or low-cost services for smaller organizations that have real appsec needs, but not a lot of means to pay for it. He founded DarkHorse, who offers VDPs and bug bounties to organizations of all sizes for free, or for as low of cost as possible.</body>

<body>While not a non-profit, the company's goal is to make these services as cheap as possible to increase accessibility for smaller or more budget-constrained organizations. The company has also introduced the concept of "fractional pentesting", access to cyber talent when and how you need it, based on what you can afford. This implies services beyond just offensive security, something we'll dive deeper into in the interview.</body>

<body>While not a non-profit, the company's goal is to make these services as cheap as possible to increase accessibility for smaller or more budget-constrained organizations. The company has also introduced the concept of "fractional pentesting", access to cyber talent when and how you need it, based on what you can afford. This implies services beyond just offensive security, something we'll dive deeper into in the interview.</body>

<body>We don't see DarkHorse ever competing with the larger Bug Bounty platforms, but rather providing services to the organizations too small for the larger platforms to sell to.</body>

<body>We don't see DarkHorse ever competing with the larger Bug Bounty platforms, but rather providing services to the organizations too small for the larger platforms to sell to.</body>

Featured image for {“vendor”:”ppworks”,”type”:”segment”,”id”:”13280″} podcast from PPWorks

Vulnerability Management

Bug Bounties

Bug bounties, vulnerability disclosure, PTaaS, fractional pentesting – Grant McCracken – ASW #306

<body>Our latest in a series of interviews discussing cybersecurity career paths, today we talk to Jayson Grace his path into cybersecurity and his experience building red teams at national labs and purple teams at Meta. We also talk about his community impact, giving talks and building open source tools. Jayson just left Meta for an AI safety startup named <a rel="noreferrer noopener" target="_blank" href="https://www.dreadnode.io">Dreadnode</a>, which we'll discuss as well.</body>

<body>Our latest in a series of interviews discussing cybersecurity career paths, today we talk to Jayson Grace his path into cybersecurity and his experience building red teams at national labs and purple teams at Meta. We also talk about his community impact, giving talks and building open source tools. Jayson just left Meta for an AI safety startup named <a rel="noreferrer noopener" target="_blank" href="https://www.dreadnode.io">Dreadnode</a>, which we'll discuss as well.</body>

<body><ul><li><a rel="noreferrer noopener" target="_blank" href="https://arxiv.org/html/2408.01605v2">CyberSecEval 3: Advancing the Evaluation of Cybersecurity Risks and Capabilities in Large Language Models</a></li><li>The [TTPForge] (<a rel="noreferrer noopener" target="_blank" href="https://github.com/facebookincubator/TTPForge">https://github.com/facebookincubator/TTPForge</a>) is a Cybersecurity Framework for developing, automating, and executing attacker Tactics, Techniques, and Procedures (TTPs).</li><li><a rel="noreferrer noopener" target="_blank" href="https://github.com/facebookincubator/ForgeArmory">ForgeArmory</a> provides TTPs that can be used with the TTPForge</li><li>Wired, by Lily Hay Newman: <a rel="noreferrer noopener" target="_blank" href="https://www.wired.com/story/facebook-red-team-x-vulnerabilities/">Facebook's ‘Red Team X’ Hunts Bugs Beyond the Social Network's Walls</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://github.com/master-of-servers/mose">MOSE</a> (Master Of SErvers) is a post exploitation tool for configuration management servers.</li><li>BSides SF 2024 - <a rel="noreferrer noopener" target="_blank" href="https://www.youtube.com/watch?v=SnEG7LA0aPc">Beyond Quick Cash: Rethinking Bug Bounties for Greater Impact</a></li><li>BSides LV 2023 - [GF - Enemy Within: Leveraging Purple Teams for Advanced Threat Detection &amp; Prevention - <a rel="noreferrer noopener" target="_blank" href="https://www.youtube.com/watch?v=-MT0tNi2vvc">https://www.youtube.com/watch?v=-MT0tNi2vvc</a></li></ul></body>

Featured image for {“vendor”:”ppworks”,”type”:”segment”,”id”:”13171″} podcast from PPWorks

AI/ML

Automated penetration testing

Cybersecurity Career Paths: from touring musician to purple teaming at Meta – Jayson Grace – ESW #378

<body>In this interview we explore the new and sometimes strange world of redteaming AI. I have SO many questions, like what is AI safety?</body>

<body>In this interview we explore the new and sometimes strange world of redteaming AI. I have SO many questions, like what is AI safety?</body>

<body>We'll discuss her presence at Black Hat, where she delivered two days of training and participated on an AI safety panel.</body>

<body>We'll discuss her presence at Black Hat, where she delivered two days of training and participated on an AI safety panel.</body>

<body>We'll also discuss the process of pentesting an AI. Will pentesters just have giant cheatsheets or text files full of adversarial prompts? How can we automate this? Will an AI generate adversarial prompts you can use against another AI? And finally, what do we do with the results?</body>

<body>We'll also discuss the process of pentesting an AI. Will pentesters just have giant cheatsheets or text files full of adversarial prompts? How can we automate this? Will an AI generate adversarial prompts you can use against another AI? And finally, what do we do with the results?</body>

<body><ul><li><a rel="noreferrer noopener" target="_blank" href="https://github.com/Azure/PyRIT">PyRIT AI redteaming tool</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://learn.microsoft.com/en-us/security/ai-red-team/">Microsoft's AI redteaming guide</a></li></ul></body>