Speaker 1: All right, let's get ready for a deep dive into
Speaker 1: the world of penetrition testing. Exciting, but not the kind
Speaker 1: you see in the movies, you know, the Hollywood stuff. Right,
Speaker 1: We're gonna be looking at the real deal. The secrets
Speaker 1: from this book pentised Secrets. Okay, Breaking the Unbreakable Enterprise Security.
Speaker 2: I like that title.
Speaker 1: It's by Sager Bonsall and au j Burala. Hmmm, I'm
Speaker 1: not familiar, and it's it's fascinating because it really pulls
Speaker 1: back the curtain on what it actually takes to break
Speaker 1: into these systems that everyone thinks are you know, unbreakable.
Speaker 2: Right, yeah, So much of what we see about hacking
Speaker 2: is so unrealistic totally. It's all you know, flashy graphics
Speaker 2: and people typing really fast.
Speaker 1: Yeah yeah, yeah.
Speaker 2: But this book, it focuses on the strategy, the mindset. Okay,
Speaker 2: you know, the real secrets.
Speaker 1: So you're saying it's more like a mental game than
Speaker 1: a technical one.
Speaker 2: It's both, really, but the technical stuff that tools and techniques,
Speaker 2: that's just one part of the equation this book does
Speaker 2: is it gives you a much more realistic understanding of
Speaker 2: how enterprise security actually works. Okay, and maybe where it doesn't.
Speaker 1: So this is going to be like our you know,
Speaker 1: our mythbusting deep Dove's the real world of pen testing.
Speaker 2: Awesome.
Speaker 1: Let's start by debunking a major myth. Okay, the lone
Speaker 1: wolf hacker.
Speaker 2: Oh yeah, that's a good one, right.
Speaker 1: You always see that in the movies, right.
Speaker 2: The lone genius working in the dark.
Speaker 1: Yeah, all by themselves cracking these impossible.
Speaker 2: Codes, hacking into the CIA or something exactly.
Speaker 1: But in reality, it's not like that at all. Yep,
Speaker 1: especially when it comes to enterprise pen testing.
Speaker 2: Ah.
Speaker 1: This book makes it clear that it's a team effort.
Speaker 2: It's definitely team sport.
Speaker 1: Yeah, a team sport.
Speaker 2: Any different skills, different perspectives.
Speaker 1: Okay, so let's break down this team. Then, the book
Speaker 1: describes the structure of Sager Banzol's global pen testing team.
Speaker 2: Right, so Sager he's a founder of the company. He's
Speaker 2: the one who heads things up thanks overseeing projects, managing clients,
Speaker 2: you know that kind of stuff.
Speaker 1: Like the CEO, the big boss.
Speaker 2: Yeah you could say that.
Speaker 1: Okay, And then who else is on this team?
Speaker 2: Well, there's Aju. He's X Navy, which is interesting X.
Speaker 1: Navy, so he brings a different kind of experience exactly.
Speaker 2: His expertise is in GRC PRC. What's that governance, risk
Speaker 2: and compliance okay?
Speaker 1: And why is that important for a pen testing team.
Speaker 2: Because it's not just about breaking into systems, right, you
Speaker 2: need to understand the rules, the regulations. Oh I see
Speaker 2: the legal frameworks, and then you need to be able
Speaker 2: to assess the risks, identify the vulnerabilities.
Speaker 1: So AJ is like the strategic planner, making sure everything
Speaker 1: is done by the book.
Speaker 2: Yeah, you could say that. He's also really good with
Speaker 2: digital forensics.
Speaker 1: Okay, so if something goes wrong, he can cover their track.
Speaker 2: Not exactly covering their right of course, i'mant more like
Speaker 2: understanding how the attack happened, gathering evidence, you know that
Speaker 2: kind of stuff.
Speaker 1: Got it. So we've got the CEO and the strategist.
Speaker 1: Who else is on the stream team?
Speaker 2: Well, then you've got the specialists.
Speaker 1: The specialist okay.
Speaker 2: Like Jatindraendra. He's the web app whiz web app whiz. Yeah,
Speaker 2: he's got tons of bug bounty hunting experience.
Speaker 1: Called bounty hunting.
Speaker 2: Basically finding and reporting vulnerabilities in websites and apps, so he.
Speaker 1: Knows all the tricks of the trade. When it comes
Speaker 1: to web application exactly.
Speaker 2: He's the one who can find those subtle weaknesses that
Speaker 2: others might miss.
Speaker 1: Okay, and what about infrastructure.
Speaker 2: For that, you've got Man Deep Man Deeprak. He's top
Speaker 2: ranked in infrastructure testing.
Speaker 1: Top ranked. That's impressive.
Speaker 2: Yeah, and he's all the way from Australia. Wow.
Speaker 1: So they've really assembled a global team here.
Speaker 2: They've got the best of the best.
Speaker 1: Okay. So we've got the CEO, the strategists, the web
Speaker 1: app whiz, the infrastructure expert, anyone else.
Speaker 2: Oh yeah. They also have a senior exploit writer, Miss X.
Speaker 1: Let's call her Miss X Mysterious.
Speaker 2: She's brought in for specific projects that require her unique skills.
Speaker 1: Unique skills like.
Speaker 2: What well, she's the one who can create those custom
Speaker 2: exploit the ones that can bypass even the toughest security measures.
Speaker 1: So she's like the secret weapon, you could say that.
Speaker 1: And then lastly they have Paul right he handles network
Speaker 1: pen testing, but he also has expertise in compliance and
Speaker 1: legal matters.
Speaker 2: Yeah, he's one who make sure they stay on the
Speaker 2: right side of the law.
Speaker 1: Okay. So this team is like a well oiled machine.
Speaker 1: It is with specialists for every aspect of appentist.
Speaker 2: And that's what it takes to be successful.
Speaker 1: So it's not just about being a hacker, No, it's
Speaker 1: about having a diverse team with a wide range of skills.
Speaker 2: Absolutely.
Speaker 1: Now I'm curious with all this expertise, Yeah, did they
Speaker 1: still face challenges?
Speaker 2: Oh? Absolutely, Even the best teams run into roadblocks.
Speaker 1: Okay, So what kind of challenges did they encounter?
Speaker 2: Well, the book describes how even this elite team faced
Speaker 2: some serious hurdles right from the start.
Speaker 1: From the start, you mean, during the initial recon Exactly.
Speaker 2: They were targeting a company with all the standard defenses
Speaker 2: cloud flair protection.
Speaker 1: Oh yeah, cloud flair. That's tough to get around.
Speaker 2: It is rate limiting, user agent locking.
Speaker 1: Okay. So they were trying to slow them down and
Speaker 1: filter out any suspicious traffic exactly. And they suspected there
Speaker 1: might be a web application firewall.
Speaker 2: Yeah a waif. That's a common defense, and.
Speaker 1: Of course endpoint security on all the computers.
Speaker 2: Right, So even if they managed to get through the
Speaker 2: perimeter defenses, they'd still have to deal with security software
Speaker 2: on individual machines.
Speaker 1: It's like a fortress with multiple layers of walls and moats,
Speaker 1: it is.
Speaker 2: But these guys they were determined.
Speaker 1: Okay, so how did they get.
Speaker 2: Past all that, Well, they had to get creative.
Speaker 1: Creative how so.
Speaker 2: They used custom scripts to bypass cloud flares protections. Custom
Speaker 2: scripts interesting, and they rotated EPs to.
Speaker 1: Make it look like the traffic was coming from different
Speaker 1: locations exactly.
Speaker 2: And they even analyzed user agent strings.
Speaker 1: User agent strings, what are those?
Speaker 2: Basically, it's a piece of information that your browser sends
Speaker 2: to a website. Okay, it tells the website what kind
Speaker 2: of browser you're using, what operating system you have, that
Speaker 2: kind of thing.
Speaker 1: I see.
Speaker 2: So they were trying to make their traffic look like
Speaker 2: it was coming from legitimate users.
Speaker 1: So they were like digital chameleons, blending in with the
Speaker 1: crowd exactly.
Speaker 2: Yeah. And what's even more impressive is their use of deduction.
Speaker 1: Deduction like Sherlock Holmes Exactly. They were looking for clues,
Speaker 1: clues like what kind of clues.
Speaker 2: Subtle hints that could reveal information about the company's systems.
Speaker 1: Hmmm, this sounds intriguing.
Speaker 2: It is. For example, they noticed some subtle differences in
Speaker 2: the way the website loaded, differences like what tiny things
Speaker 2: like the spacing of elements, okay, the way certain images
Speaker 2: were rendered, I see, and based on these tiny clues,
Speaker 2: they were able to deduce that the company was using
Speaker 2: WordPress word Press.
Speaker 1: Really that's pretty common.
Speaker 2: It is, but it narrows down the possibilities.
Speaker 1: Okay.
Speaker 2: And then they went even further. Yeah, they figured out
Speaker 2: that they were using a specific theme, a theme.
Speaker 1: What's that.
Speaker 2: It's like a template that determines the look and feel
Speaker 2: of a website. And the theme they were using was OCEANWP.
Speaker 1: OCEANWP.
Speaker 2: Okay, it's a popular theme. But now they knew exactly
Speaker 2: what they were dealing with.
Speaker 1: So they were like digital detectives putting together a puzzle.
Speaker 2: They were. And this is all before they even tried
Speaker 2: to break in.
Speaker 1: This is just the recon phase exactly.
Speaker 2: They were gathering information, building a profile of their target.
Speaker 1: So persistence, adaptability, attention to detail. Those are the key
Speaker 1: takeaways and a little bit of Sherlock Holmes thrown in exactly.
Speaker 1: But let's be honest, the part everyone's waiting for is
Speaker 1: the social engineering attack.
Speaker 2: Right, That's where things get really interesting. So tell me
Speaker 2: about it. We'll forget about those simple phishing emails, Okay,
Speaker 2: you know ones that say click here to reset your password.
Speaker 1: Yeah, those are so obvious.
Speaker 2: Like these guys. They went for something much more sophisticated. Sophisticated,
Speaker 2: a multi stage operation.
Speaker 1: Multi stage operation, okay, lay it on me.
Speaker 2: They did their research and they specifically targeted an employee.
Speaker 1: It's an employee, okay, who was it?
Speaker 2: A female secure the administrator.
Speaker 1: A security administrator.
Speaker 2: Yes, someone who should know better.
Speaker 1: I see. They wanted to challenge themselves.
Speaker 2: Maybe, But there's more to it. Uh huh. They also
Speaker 2: knew that she was a parent.
Speaker 1: A parent. Hmmm. Why is that important?
Speaker 2: Because parenting can create vulnerabilities.
Speaker 1: Vulnerabilities how so, well, think about it.
Speaker 2: Parents are always worried about their kids, right, especially their education.
Speaker 1: Uh huh.
Speaker 2: So they prayed on that concern.
Speaker 1: Okay, So it's not just about technical skills. Yeah, it's
Speaker 1: about understanding human psychology exactly. That's fascinating it is.
Speaker 2: So here's how they did it, all right, I'm all yours.
Speaker 2: They created a fake website.
Speaker 1: A fake website okay.
Speaker 2: Offering free online math classes.
Speaker 1: Free math class.
Speaker 2: Yeah, they knew that would be tempting for a parent.
Speaker 1: Makes sense. Who wouldn't want free help with math?
Speaker 2: Exactly?
Speaker 1: That's what happened.
Speaker 2: Next, they created a sign in with Google button.
Speaker 1: Oh those are everywhere these days.
Speaker 2: They are, and that's what makes them so dangerous.
Speaker 1: Dangerous how so because.
Speaker 2: They allow websites to access to your Google account. But
Speaker 2: here's the clever part. Yeah, they restricted the scope.
Speaker 1: Of access, restricted the stove.
Speaker 2: Yeah, so they only requested access to her Gmail account.
Speaker 1: Hmmm, that's sneaky. So she wouldn't be suspicious exactly.
Speaker 2: She probably just thought, oh, they need my email to
Speaker 2: send me updates, right, that makes sense. But what she
Speaker 2: didn't realize is that they were now inside her Gmail. Wow.
Speaker 1: So stage one of their attack was a success. It was,
Speaker 1: but it doesn't stop there.
Speaker 2: Oh no, they had more tricks up their sleeves.
Speaker 1: Okay, what else did they do?
Speaker 2: They embedded a beef payload on the website.
Speaker 1: Beef payload. What's that?
Speaker 2: It's a tool for browser exploitation.
Speaker 1: Browser exploitation? You mean they could take control of her
Speaker 1: browser potentially potentially.
Speaker 2: Yeah, it depends on whether her browser had any vulnerabilities.
Speaker 2: But if it did, they could have gained further access
Speaker 2: to her computer.
Speaker 1: So beef was like their backup plan.
Speaker 2: Yeah, you could say that.
Speaker 1: And they also offered a dummy software installer m a
Speaker 1: software installer yeah, with a hidden interpreter shell.
Speaker 2: A interpreter shell.
Speaker 1: Yeah, it's like a backdoor that allows remote access and control.
Speaker 2: Though they were really covering.
Speaker 1: Their bases, they were, They had multiple ways to potentially
Speaker 1: get into her.
Speaker 2: System, and that's what makes them so dangerous.
Speaker 1: So what happened? Did any of these later stages work?
Speaker 2: It seems not.
Speaker 1: They didn't work. Why not?
Speaker 2: It's hard to say for sure. Yeah, but it's possible
Speaker 2: she had good antivirus software, okay, or data loss prevention tools.
Speaker 1: So even with a sophisticated plan, sometimes the simplest defenses
Speaker 1: can work.
Speaker 2: Absolutely.
Speaker 1: But these guys, they were prepared for setbacks.
Speaker 2: Oh yeah, they always had a backup plan.
Speaker 1: So what did they do next?
Speaker 2: They used the compromise Gmail.
Speaker 1: Account, the Gmail they already had access to.
Speaker 2: Exactly. They used it to reset her LinkedIn password.
Speaker 1: Her LinkedIn password? Why LinkedIn?
Speaker 2: Because they wanted to target someone else, someone else, an intern?
Speaker 2: An intern, Yeah, a classic dumb admin.
Speaker 1: Dumb admins?
Speaker 2: What do you mean, someone who's eager to please? Okay,
Speaker 2: maybe a little too trusting, I see.
Speaker 1: They were going to exploit his naivety exactly.
Speaker 2: They created a sense of urgency. Urgency how they claimed
Speaker 2: the company was under.
Speaker 1: Attack, under attack, what kind of attack? Adidos attack add astack?
Speaker 1: Oh wow, that's serious.
Speaker 2: Yeah, and this poor intern he panicked, panicked, Yeah, he
Speaker 2: wanted to be the hero. Simmy fell for it, hook
Speaker 2: line and sinker.
Speaker 1: And what did they get from him?
Speaker 2: The information they needed to bypass cloud.
Speaker 1: Flare, the cloud Flare protection that they had been.
Speaker 2: Struggling with, exactly.
Speaker 1: So this intern he accidentally gave them the keys to
Speaker 1: the kingdom. You could say that it's amazing how one
Speaker 1: mistake can have such a huge impact.
Speaker 2: It is, and that's why social engineering is so.
Speaker 1: Effective, because it exploits human weaknesses exactly. But let's not
Speaker 1: forget about the technical side of things, right. The book
Speaker 1: also highlights the importance of misconfigurations.
Speaker 2: Oh yeah, misconfigurations can be just as valuable as any expert.
Speaker 1: So what kind of misconfigurations did they find?
Speaker 2: Well, remember those cloud Flare rules they got from the intern.
Speaker 2: One of them was a real golden ticket, A golden ticket. Yeah,
Speaker 2: it allowed bypass access.
Speaker 1: Bypass access, so they could get around cloud Flare.
Speaker 2: But there was a catch, a catch.
Speaker 1: What was it?
Speaker 2: It required a very specific whitelisted.
Speaker 1: IP address, whitelisted IP address okay.
Speaker 2: And they didn't have it, so it was a dead end.
Speaker 2: Not quite, not quite.
Speaker 1: Why not.
Speaker 2: Remember that dumb admin who gave them the cloud Flare details, Yeah,
Speaker 2: well he also inadvertently revealed the real IP address of
Speaker 2: their web server. He did through DNS entries.
Speaker 1: DNS entries, oh, icee.
Speaker 2: So now they had the IP address they needed, so they.
Speaker 1: Could just walk right in.
Speaker 2: Not so fast, not so fast?
Speaker 1: What else was there?
Speaker 2: There was an ADC and ADC an application delivery.
Speaker 1: Controller okay, And what does that do.
Speaker 2: It's like a security guard that stands between the outside
Speaker 2: world and your web server ICE. And this ADC was
Speaker 2: locked down tight walk down. Yeah, I was only talking
Speaker 2: to cloud.
Speaker 1: Flare so they could access it directly, not without the
Speaker 1: right credential. So it was another dead end, it seemed
Speaker 1: that way. But I have a feeling they found a
Speaker 1: way around it.
Speaker 2: They did. How they discovered that an exchange.
Speaker 1: Server an exchange server, what's that?
Speaker 2: It's a mail server?
Speaker 1: A mail server okay.
Speaker 2: And it was placed in the DMZ, the DMZ the
Speaker 2: demilitarized zone okay.
Speaker 1: And why is that a problem.
Speaker 2: Because the DMZ is meant for public facing services. It's
Speaker 2: like leaving the front door to your house wide open.
Speaker 1: So it was a major security risk. It was, and
Speaker 1: they found a way to exploit it.
Speaker 2: They did tell me more. Remember how we talked about
Speaker 2: staying up to date. Uhh, Well, their diligence paid off.
Speaker 2: They discovered a zero day exploit.
Speaker 1: A zero day exploit, what's that?
Speaker 2: A vulnerability that's unknown to the public. Okay, and this
Speaker 2: exploit specifically targeted exchange server.
Speaker 1: So they had the keys and the map to the vault.
Speaker 2: You could say that it work. They were cautious.
Speaker 1: Cautious.
Speaker 2: Yeah, they tested it in a controlled environment.
Speaker 1: First, Okay, that makes sense.
Speaker 2: To make sure it worked as expected. And of course
Speaker 2: they had the username and password.
Speaker 1: From our friend, the dumb admin.
Speaker 2: Exactly.
Speaker 1: It's like a domino effect. One mistake leads to.
Speaker 2: Another, and that's how they got into the exchange server.
Speaker 1: So they were in. They had a foothold in network.
Speaker 2: But they weren't done yet.
Speaker 1: There's more.
Speaker 2: Oh yeah, the story's just getting started, all right.
Speaker 1: Well, I can't wait to hear what happens next.
Speaker 2: Me neither. So remember that keylogger, Yeah.
Speaker 1: The one running on the GRC admin's.
Speaker 2: Computer, right on his Buntu machine Ubuntu, right, it actually
Speaker 2: caught something really interesting?
Speaker 1: Oh like what, Well, it seems.
Speaker 2: He used RDP to log into another machine RDP, what's
Speaker 2: that Remote desktop protocol?
Speaker 1: Okay?
Speaker 2: And the keylogger, well, it caught everything everything, you mean,
Speaker 2: his username is password, the whole thing.
Speaker 1: So they had access to another machine just like.
Speaker 2: That, not exactly, just like that.
Speaker 1: What do you mean?
Speaker 2: The keylogger logs, they were a bit of a puzzle.
Speaker 2: A puzzle, yeah, like a co They needed to crack
Speaker 2: a code. I don't get it, okay. So for example,
Speaker 2: instead of seeing chloroeyah, the log showed xlr okay.
Speaker 1: So it was jumbled up exactly, so they had to
Speaker 1: decode it.
Speaker 2: They had to figure out what each jumbled sequence represented.
Speaker 1: So it wasn't just a simple substitution cipher.
Speaker 2: No, it was more complex than that.
Speaker 1: Give me another example.
Speaker 2: Okay, So perch top roochtop that actually stood for rusktop.
Speaker 1: Okay. And what about the username and password?
Speaker 2: The username was logged as rossok do rosok do.
Speaker 1: That doesn't sound like a real name.
Speaker 2: It wasn't. Everything was encoded, so how.
Speaker 1: Did they even begin to decipher all this?
Speaker 2: They started by looking for patterns patterns. Yeah, they noticed
Speaker 2: that certain letters never got replaced, like witch letters the
Speaker 2: ones on the top row of a cordy keyboard. Oh interesting,
Speaker 2: like E R tuop.
Speaker 1: So maybe the key logger was recording keystrikes based on
Speaker 1: their physical location.
Speaker 2: That's what they thought.
Speaker 1: Okay, so what about the other letters, Well.
Speaker 2: They noticed that some letters were replaced by the letter
Speaker 2: before them on the keyboard.
Speaker 1: Okay, give me an example.
Speaker 2: So C was replaced by x x's before C.
Speaker 1: Right exactly, and L became K right again. But you
Speaker 1: said it wasn't a simple substitution.
Speaker 2: There were some inconsistencies like what well A, for example,
Speaker 2: it had no clear relation to any other letter, so.
Speaker 1: It was random, it seemed that way. And JAY was
Speaker 1: replaced by K, which is the letter after it, not
Speaker 1: before right.
Speaker 2: So there were definitely some exceptions to the rule.
Speaker 1: So how did they figure out the rest of the code,
Speaker 1: especially the username and password.
Speaker 2: Through careful analysis?
Speaker 1: Analysis?
Speaker 2: Yeah, they use a tool called CrypTool.
Speaker 1: Cryptol what's that.
Speaker 2: It's a program that can help you analyze and decrypt
Speaker 2: different types of codes.
Speaker 1: So they fed the key lugger logs into CrypTool and.
Speaker 2: It helped them generate possible combinations.
Speaker 1: Based on the rules they had already discovered.
Speaker 2: Exactly, and eventually they cracked the code.
Speaker 1: So what was the decoded username?
Speaker 2: Rosokdo turned out to be Redolphe Dulfa.
Speaker 1: That sounds like an actual name.
Speaker 2: It is, It's a Spanish name.
Speaker 1: So they had the username. What about the IP address?
Speaker 2: That was easy. It was just logged with commas instead
Speaker 2: of periods.
Speaker 1: Commas instead of periods. That's it.
Speaker 2: That's it, okay.
Speaker 1: And what about the password? Was that encoded too?
Speaker 2: Oh? Yeah? The password was the trickiest part.
Speaker 1: What did it look like?
Speaker 2: It was a long string of characters with a bunch
Speaker 2: of LFFT thrown in lsft.
Speaker 1: What's that?
Speaker 2: They figured out it represented the left shift key.
Speaker 1: Oh so it meant the following letter was capitalized exactly.
Speaker 1: So they had to figure out which letters were capitalized
Speaker 1: and which ones weren't on.
Speaker 2: Top of the other substitution rules. That's complicated, it was,
Speaker 2: but they managed to narrow it down to eighty two
Speaker 2: possible passwords.
Speaker 1: Eighty two.
Speaker 2: That's still a lot, it is, but it's better than
Speaker 2: trying every single combination.
Speaker 1: So what did they do?
Speaker 2: They decided to test them one by.
Speaker 1: One, one by one, but wouldn't that take forever?
Speaker 2: It could, but they had to be careful, careful. Yeah,
Speaker 2: they didn't want to trigger any security alerts.
Speaker 1: Like what kind of alert?
Speaker 2: I got? Lockout mechanism?
Speaker 1: I count lockout? What's that?
Speaker 2: Basically, if you enter the wrong password too many times, Yeah,
Speaker 2: the system can lock you out.
Speaker 1: Oh, I see. So they had to limit their attempts exactly.
Speaker 2: They decided to try one password every ten minutes.
Speaker 1: Ten minutes, so six attempts per hour.
Speaker 2: Right. It was a slow process.
Speaker 1: But they couldn't risk getting locked out.
Speaker 2: No, they had to be patient.
Speaker 1: So did it work? Did they find the right password?
Speaker 2: After seven hours?
Speaker 1: They got in seven hours? That must have been.
Speaker 2: Nerve wracking, it was, but they got there in the end.
Speaker 1: So what was the password?
Speaker 2: It was sixty MP two mjyypv at VK.
Speaker 1: Wow. That's a strong password.
Speaker 2: It was, But it wasn't strong enough to stop them.
Speaker 1: So they were in. They had access to another machine.
Speaker 2: But now the question was what to do next.
Speaker 1: I would think they'd go straight for the domain controller,
Speaker 1: the heart of the network. Yeah, the crown jewels.
Speaker 2: That's what most attackers do, but not this team. They
Speaker 2: decided to take a different.
Speaker 1: Approach, a different approach.
Speaker 2: Why, because attacking the DC directly is risky, risky. Yeah,
Speaker 2: it could trigger all sorts of alarms.
Speaker 1: So they didn't want to tip their hand exactly.
Speaker 2: They wanted to stay under the radar.
Speaker 1: So what do they do instead?
Speaker 2: They focused on lateral movement.
Speaker 1: Lateral movement, what's.
Speaker 2: Moving from one machine to another? Okay, expanding their access
Speaker 2: within the network.
Speaker 1: I see. And they did this stealthily.
Speaker 2: As stealthily as possible.
Speaker 1: So they were playing the long game. You can say that,
Speaker 1: But how did they actually do it? How did they
Speaker 1: move from one machine to another?
Speaker 2: Well, they used a combination of tools and techniques like
Speaker 2: what they used Empire and metasploit.
Speaker 1: Those are powerful tools.
Speaker 2: They are, but they didn't use them for brute force attacks.
Speaker 1: What did they use them for?
Speaker 2: Then? For passive data collection?
Speaker 1: Passive data collection?
Speaker 2: What's that? Gathering information without actively attacking the system.
Speaker 1: So they were spying on the company in a way. Yes,
Speaker 1: wasn't that unethical?
Speaker 2: Remember this was a controlled penetration test, right, they had
Speaker 2: permission and their goal was to assess the company's security posture.
Speaker 1: Okay, I see. So they set up keyloggers, keyloggers to
Speaker 1: capture keystrokes exactly.
Speaker 2: What else They took screenshots at regular intervals. Screenshots had
Speaker 2: to see what users were doing on their computers.
Speaker 1: Wow, this is getting a bit creepy.
Speaker 2: And the even recorded audio.
Speaker 1: Audio using the computer's microphones, so they were listening in
Speaker 1: on conversations potentially. Yes, that's a bit invasive, isn't it.
Speaker 2: It is, but it's all part of a penetration test.
Speaker 1: Okay, So how did this passive approach work out?
Speaker 2: It was incredibly effective effective. How so they gathered over
Speaker 2: twenty gigabytes of data.
Speaker 1: Twenty gigabytes that's a lot.
Speaker 2: Of data, it is, and it included all sorts of
Speaker 2: sensitive information like what.
Speaker 1: What kind of information did they find?
Speaker 2: Unfortunately I can't divulge specific details.
Speaker 1: That's right confidentiality, but trust me, it was juicy stuff.
Speaker 1: So this passive persistence strategy it really paid off, it did.
Speaker 1: They got tons of information without raising any red flags exactly.
Speaker 1: So sometimes the best approach isn't the most aggressive, exactly.
Speaker 2: It's about knowing your goals, adapting to the situation.
Speaker 1: Using a combination of skills and strategy.
Speaker 2: And patients don't forget patients.
Speaker 1: So what happened next? Did they eventually go after the
Speaker 1: demand controller.
Speaker 2: Well that's where things get even more interesting.
Speaker 1: Okay, I'm hooked. Tell me more.
Speaker 2: Well, the book actually leads us hanging at this point.
Speaker 1: Hanging.
Speaker 2: What do you mean? It mentions chapter ten, Chapter ten. Yeah,
Speaker 2: it's titled the Biggest Secret to Nail any double blind
Speaker 2: penetration test.
Speaker 1: Sounds intrinking, it does, right.
Speaker 2: What but this chapter was never published?
Speaker 1: Never published? Why not?
Speaker 2: The author says it was too sensitive?
Speaker 1: Too sensitive?
Speaker 2: Yeah, he couldn't risk publishing it.
Speaker 1: Why not? What was so dangerous about it?
Speaker 2: We can only speculate, speculate. Yeah, maybe it contained a
Speaker 2: technique that was too powerful, too powerful, like what something
Speaker 2: that could be used by malicious actors.
Speaker 1: Oh, I see, so he didn't want to give them
Speaker 1: any ideas, is exactly? Or maybe it exposed a.
Speaker 2: Vulnerability, vulnerability that was two widespread.
Speaker 1: So disclosing it could have had devastating consequences. So this
Speaker 1: deep dive leaves us with more questions than answers in
Speaker 1: a way. Yes, but that's the nature of cybersecurity, isn't it.
Speaker 2: It is It's a constantly evolving.
Speaker 1: Field, always something new to learn, something new to discover.
Speaker 2: And something new to protect, well said, Well said, so,
Speaker 2: what are your thoughts on all of this.
Speaker 1: I'm still processing at all, but one thing's for sure. Yeah,
Speaker 1: this book has given me a whole new perspective on
Speaker 1: penetration testing.
Speaker 2: Me too.
Speaker 1: It's not just about hacking into systems.
Speaker 2: It's about understanding how attackers think.
Speaker 1: How they operate, how they exploit weaknesses.
Speaker 2: And how they can stand of the radar exactly. So
Speaker 2: what do you think is the biggest takeaway for our listeners.
Speaker 1: I think it's this security isn't about building an impenetrable.
Speaker 2: Fortress because there's no such.
Speaker 1: Thing, right, There's no such thing.
Speaker 2: Every system has vulnerabilities.
Speaker 1: And attackers are always looking for ways to exploit them exactly.
Speaker 1: The best defense is a multi layered.
Speaker 2: Approach, combining technology, processes and human awareness.
Speaker 1: That's the key.
Speaker 2: And don't forget security is a journey, not a destination.
Speaker 1: It's an ongoing process.
Speaker 2: Of learning, adapting, and improving.
Speaker 1: Well said, Well said, So on that note, I think
Speaker 1: we should wrap up Part two.
Speaker 2: SOA's good.
Speaker 1: That's stay tuned for Part three, where we'll delve deeper
Speaker 1: into the strategic side of pen testing.
Speaker 2: And the broader implications for cybersecurity in the real world.
Speaker 1: It's going to be fascinating. I promise. It's been quite
Speaker 1: a journey, hasn't it.
Speaker 2: It really has this whole.
Speaker 1: Deep dive into the world of pen testing.
Speaker 2: Yes, fascinating stuff.
Speaker 1: We've seen how these teams operate, how they think, the
Speaker 1: strategies they use.
Speaker 2: It's eye opening for sure.
Speaker 1: What stands out most to you from all this.
Speaker 2: That's a good question. Yeah, I think it's how different
Speaker 2: it is from what most people think. Different how what
Speaker 2: you know people imagine hacking is this fact fast paced, action.
Speaker 1: Packed thing, right, like in movies.
Speaker 2: Exactly, lots of frantic typing bypassing firewalls and seconds. But
Speaker 2: this book it shows the reality which it's much more methodical,
Speaker 2: much more strategic in a way. Yes, it's more like
Speaker 2: a game of chess.
Speaker 1: A game of chess, I like that you have.
Speaker 2: To think several moves ahead, okay, anticipate your opponent's reactions.
Speaker 1: The company's security.
Speaker 2: Team, right, and you have to exploit subtle weaknesses, find
Speaker 2: those tiny cracks in their defenses.
Speaker 1: And sometimes the best move is to just.
Speaker 2: Wait, Yeah, observe, gather information, be patient. Exactly.
Speaker 1: They're like digital ninjas. Ninjas yeah, moving through the network undetected.
Speaker 2: I like that analogy no trace, And that's a key
Speaker 2: principle in PIN testing.
Speaker 1: Stay under the radar.
Speaker 2: As much as possible.
Speaker 1: Don't do anything to alert the security.
Speaker 2: Team, right blend in, be invisible.
Speaker 1: But even though they're being stealthy, they're still making progress.
Speaker 1: Oh yeah, gathering information, expanding their access, inching closer to
Speaker 1: their goal.
Speaker 2: Every move is calculated.
Speaker 1: And remember that cliffhanger from part two, the missing chapter, Yeah,
Speaker 1: chapter ten, the one that was too dangerous to publish,
Speaker 1: the biggest secret to nail any double blind penetration test.
Speaker 2: It still makes you wander, doesn't it?
Speaker 1: It really does.
Speaker 2: What could be so sensitive that it couldn't even be
Speaker 2: hinted at?
Speaker 1: What secrets are they keeping from us?
Speaker 2: We may never know, but it's fun to speculate it is.
Speaker 2: Maybe it's some super secret technique.
Speaker 1: Something that would give attackers a huge advantage.
Speaker 2: Or maybe it exposes the flaw of vulnerability that's so widespread.
Speaker 1: That telling people about it would cause chaos exactly, So
Speaker 1: where does that leave us? We've gone through this whole book,
Speaker 1: warned all these secrets.
Speaker 2: And yet there's still this big unknown.
Speaker 1: This missing piece of the puzzle.
Speaker 2: It's frustrating in a way.
Speaker 1: Yeah, but I think that's part of the point. What
Speaker 1: do you mean this book? It's not just about giving
Speaker 1: you a step by step guide to hacking. It's about
Speaker 1: showing you the mindset.
Speaker 2: The way these teams think, the challenges their face, and
Speaker 2: the constant evolution of the game.
Speaker 1: Because cybersecurity it's never static.
Speaker 2: Right, absolutely not.
Speaker 1: It's a moving target, always changing, always adapted.
Speaker 2: We have to adapt with it.
Speaker 1: We can't just rely on firewalls and anti virus software.
Speaker 2: Those are important, but they're not enough.
Speaker 1: We have to understand how attackers.
Speaker 2: Think, anticipate their moves, and be.
Speaker 1: Prepared for the unexpected.
Speaker 2: Exactly.
Speaker 1: So what's the biggest takeaway for our listeners do you think?
Speaker 2: Hmm? I'd say it's this security isn't about building an
Speaker 2: impenetrable fortress because that's impossible. Exactly. There's no such thing
Speaker 2: as perfect security.
Speaker 1: There's always a way in if someone's determined enough.
Speaker 2: So what can we do.
Speaker 1: We have to be proactive, we have to be vigilant,
Speaker 1: and we.
Speaker 2: Have to be willing to learn and.
Speaker 1: Adapt because the bad guys they're not standing still.
Speaker 2: They're constantly evolving their.
Speaker 1: Tactics, finding new ways to exploit weaknesses, and.
Speaker 2: We have to stay one step ahead.
Speaker 1: So it's a constant challenge.
Speaker 2: But it's a challenge worth taking.
Speaker 1: On absolutely because the stakes are high.
Speaker 2: Secure of our data, our systems, our businesses.
Speaker 1: It all depends on us being smart, being aware.
Speaker 2: And never underestimating the ingenuity of the attackers.
Speaker 1: Will said, well, on that note, I think we've reached
Speaker 1: the end of our deep dive into Pentist secrets. It's
Speaker 1: been a fascinating journey, it really has, and I hope
Speaker 1: our listeners have learned a lot.
Speaker 2: I hope so too.
Speaker 1: We've covered a lot of ground.
Speaker 2: From social engineering to zero day exploits.
Speaker 1: From lateral movement to passive persistence, and.
Speaker 2: We've seen how even the most secure systems can be breached.
Speaker 1: If you know where to look and how to exploit
Speaker 1: the weaknesses.
Speaker 2: So remember, security is a journey, not a destination.
Speaker 1: Stay heurious, stay informed.
Speaker 2: And stay secure.
Speaker 1: Thanks for joining us on this deep dive. Until next time.