Tradecraft Security Weekly (Audio)
By Security Weekly
To listen to an audio podcast, mouse over the title and click Play. Open iTunes to download and subscribe to podcasts.
Want to learn about all of the latest security tools and techniques? This is the show for you! We show you how to install, configure and use a wide variety of security tools for both offense and defense. Whether you are a penetration tester or defending enterprise networks, this show will help you!
||CleanPhishing 2FA Tokens with CredSniper - Tradecraft Security Weekly #25||Organizations are implementing two-factor on more and more web services. The traditional methods for phishing credentials is no longer good enough to gain access to user accounts if 2FA is setup. In this episode Mike Felch (@ustayready) and Beau...||4/13/2018||Free||View in iTunes|
||CleanEvading Network-Based Detection Mechanisms - Tradecraft Security Weekly #24||In this episode of Tradecraft Security Weekly hosts Beau Bullock (@dafthack) and Mike Felch (@ustayready) discuss methods for evading network-based detection mechanisms. Many commercial IDS/IPS devices do a pretty decent job of detecting standard...||3/29/2018||Free||View in iTunes|
|3||CleanVideoHTML5 Storage Exfil via XSS - Tradecraft Security Weekly #23||It is fairly common for pentesters to discover Cross-Site Scripting (XSS) vulnerabilities on web application assessments. Exploiting these issues potentially allow access to a user's session tokens enabling attackers to navigate a site as the victim...||1/12/2018||Free||View in iTunes|
||CleanLeaking Windows Creds Externally Via MS Office - Tradecraft Security Weekly #21||In this episode of Tradecraft Security Weekly, Mike Felch discusses with Beau Bullock about the possibilities of using framesets in MS Office documents to send Windows password hashes remotely across the Internet. This technique has the ability to...||12/1/2017||Free||View in iTunes|
||CleanGoogle Event Injection - Tradecraft Security Weekly 20||Google provides the ability to automatically add events to a calendar directly from emails received by Gmail. This provides a unique situation for phishing attempts as most users haven't been trained to watch their calendar events for social...||11/3/2017||Free||View in iTunes|
||CleanDomain Fronting - Tradecraft Security Weekly #18||Domain fronting is a technique used to mask command and control (C2) traffic. It is possible for C2 channels to be proxied through CDN's like Cloudfront to make it appear like normal Internet traffic. It is very difficult to detect and block for...||9/7/2017||Free||View in iTunes|
||CleanCracking Password Hashes Efficiently - Tradecraft Security Weekly #17||If you are a penetration tester password cracking is something you will inevitably do. On most engagements we typically don't have months on end to crack passwords. In an effort to help be more efficient in your cracking techniques Beau Bullock...||9/1/2017||Free||View in iTunes|
||CleanAutomating Screenshots to Quickly Assess Many WebApps - Tradecraft Security Weekly #12||On penetration tests we are often-times faced with very large external or internal attack surfaces that are made up of multiple web applications. When there is a need to assess thousands of webapps quickly manually navigating each page with a browser...||7/26/2017||Free||View in iTunes|
||CleanSituational Awareness with HostRecon - Tradecraft Security Weekly #7||After exploiting a system on a remote & unfamiliar network it is extremely important to gain situational awareness as quickly, and quietly as possible. This will help ensure success moving forward with other attacks. In this episode of Tradecraft...||6/21/2017||Free||View in iTunes|
||CleanWindows Privilege Escalation Techniques - Tradecraft Security Weekly #2||--||6/5/2017||Free||View in iTunes|
||CleanMeterpreter with Categorized Domains & Trusted Certs - Tradecraft Security Weekly #4||It is common for organizations to proxy web traffic so they can place restrictions on what websites can be visited by employees. To make the management of allowing or denying access to a large number of sites easier many web proxies utilize...||5/31/2017||Free||View in iTunes|
||CleanAttacking Exchange/OWA to Gain Access to AD Accounts - Tradecraft Security Weekly #3||Microsoft Exchange and Office365 are extremely popular products that organizations use for enterprise email. These services can be exploited by remote attackers to potentially gain access to Active Directory user credentials. In this Tradecraft...||5/24/2017||Free||View in iTunes|
||CleanPublic File Metadata Analysis - Tradecraft Security Weekly #1||Public File Metadata Analysis with PowerMeta - It is very common for organizations to post files (docx, pdf, xlsx, etc.) to publicly available websites on the Internet. Often times these organizations have not taken the time to strip the metadata...||5/18/2017||Free||View in iTunes|
Love the hands on approach
Thanks for actually talking about the actual tools and how they can be used and not just abstract concepts.