Speaker 1: So have you ever really stopped to think about how
Speaker 1: ethical hackers, yeah, you know, the good guy, the penetration testers,
Speaker 1: how they actually think not just the tools, but their
Speaker 1: whole strategy.
Speaker 2: Or maybe how much info about a company and maybe
Speaker 2: even your company is just well out there, yeah.
Speaker 1: Just floating around the digital ether kind of waiting for
Speaker 1: someone to piece it together into a strategic map.
Speaker 2: It's often a surprising amount, really often lying in plain sight.
Speaker 2: And yeah, most people don't realize how easily it connects exactly.
Speaker 1: So today we're taking a real deep dive into that
Speaker 1: strategic world penetration testing. Our mission basically is to give
Speaker 1: you a solid but you know, digestible overview the key phases,
Speaker 1: the clever techniques these ethical hackers use. We're going to
Speaker 1: explore that mindset, the core methods they use to find vulnerabilities,
Speaker 1: get that initial foothold, stay hidden.
Speaker 2: Move through networks, move through networks, and.
Speaker 1: Yeah, ultimately pull out valuable information. And the whole point,
Speaker 1: of course is to make systems more secure for everyone.
Speaker 2: And we'll show you how they turn these like disparate
Speaker 2: bits of public data into a really precise blueprint for
Speaker 2: an attack. Okay, and even how they use these well
Speaker 2: ingenious tricks to live off the land once they're inside,
Speaker 2: living off the land. Yeah, think of it as maybe
Speaker 2: a shortcut to understanding the real tactics behind digital defense.
Speaker 1: And where are we getting this from? Well, our insights
Speaker 1: today they come straight from a detailed guide for the
Speaker 1: GIA Certified Penetration Tester exam, the GPM.
Speaker 2: Oh yeah, that solid stuff.
Speaker 1: Methodologies, tools, potential methodologies, practical tools, even real world lab exercises.
Speaker 1: This is the good stuff, really pulled right from the
Speaker 1: experts to give you that kind of insider view. Definitely. Okay,
Speaker 1: so let's unpack this. Let's imagine our target is a
Speaker 1: hypothetical company. We'll call it Acmecorp.
Speaker 2: Okay, Acmecorp Classic.
Speaker 1: So before anyone tries to break in, there's this really
Speaker 1: crucial first step reconnaissance pricon. Yeah, it's like being a
Speaker 1: digital detective, right, gathering clues, particulously building this detailed profile
Speaker 1: of ACME core M, but without firing a single shot,
Speaker 1: so to speak.
Speaker 2: And what's really fascinating here isn't just that you can
Speaker 2: find info, but how easily these separate pieces can be
Speaker 2: woven together into a well potentially devastatingly precise attack plan. Right,
Speaker 2: we're talking open source intelligence ocent ocent. Yeah, there are
Speaker 2: two main flavors, passive and active information.
Speaker 1: Gathering passive and active. How big a deal is that difference?
Speaker 1: In practice? Does one like lead to the other or
Speaker 1: for they for totally different things.
Speaker 2: Oh, that's a crucial difference, mainly because of the risk involved.
Speaker 1: You know, Okay.
Speaker 2: Passive recon is all about discovery through observation. You stay anonymous,
Speaker 2: hard to detect. Think of it like watching a building
Speaker 2: from across the street, just.
Speaker 1: Looking, looking, not touching exactly.
Speaker 2: Active recon, though, that's when you start interacting directly with
Speaker 2: ACME systems, which is much more likely to create logs
Speaker 2: potentially get you notice, It's like knocking on the buildings
Speaker 2: or gotcha.
Speaker 1: So more risk, maybe more reward.
Speaker 2: Potentially both are valuable, but yeah, the risks are different.
Speaker 2: You usually start passive.
Speaker 1: So what does all this mean for our ACMECORB You're
Speaker 1: saying you can learn a ton about their tech stack,
Speaker 1: their people, maybe even their culture just from.
Speaker 2: Public stuff, a tremendous amount. The key thing is every
Speaker 2: digital interaction leaves some kind of trace. Yeah, and when
Speaker 2: you add up all these seemingly harmless little traces.
Speaker 1: You get a blueprint.
Speaker 2: You get a blueprint for an attacker precisely like what
Speaker 2: give me example? Okay, Well, ethical hackers they analyze organizational cultures,
Speaker 2: sometimes through job posting.
Speaker 1: Job postings really yeah, if.
Speaker 2: ACNCRE is hiring for say a Solaris ten system administrator, boom,
Speaker 2: that tells you immediately they're using Solaris ten. Some more important,
Speaker 2: probably data centers. That kind of detail helps define their
Speaker 2: attack surface, what specific systems might be vulnerable. It's often
Speaker 2: just unintended data leakage. Nobody thinks twice about posting it.
Speaker 1: That's a really interesting angle using job ads. Is there
Speaker 1: a downside? Like can companies hide that stuff?
Speaker 2: Well, it's about corroboration, right, You never rely on just
Speaker 2: one thing. And yeah, companies might try to be vague,
Speaker 2: but they usually need specific skills, so they have to
Speaker 2: reveal something makes sense and it goes further social media
Speaker 2: behavior think LinkedIn profiles for IT staff. Oh yeah, they
Speaker 2: might detail their experience CERTs, maybe even tech conferences they
Speaker 2: go to. That's gold for tailoring attacks, especially social engineering. Howso, well,
Speaker 2: you can craft much more convincing phishing emails if you
Speaker 2: know someone's specific tech interests or who they know, what
Speaker 2: events they attended. It makes it personal believable.
Speaker 1: So we've got the human side, the company culture clues.
Speaker 1: What about the pure tech data, the digital fingerprints from the.
Speaker 2: Machines right exactly? Now we're digging into things like the
Speaker 2: whois Database woaas.
Speaker 1: Think of it as the public phone book for domain names.
Speaker 1: It listens on TCP port forty three, gives you registration
Speaker 1: info for acmecore's domain, contact details, their name servers.
Speaker 2: Okay, basic contact info, basic but essential.
Speaker 1: Did you move on to querying DNS records? The Internet's
Speaker 1: address books actually.
Speaker 2: DNS records like soa SRV cnamey. They reveal specific domain
Speaker 2: assets like server names, fully qualified domain names, FQDNS, IP addresses.
Speaker 1: Okay, can you quickly break down those record types? Soa
Speaker 1: SRV sure? Sure?
Speaker 2: The SOA startup authority tells you who's officially in charge
Speaker 2: of the domains records, set some rules, scott it. SRV
Speaker 2: records point to specific services like where's acme's email server
Speaker 2: or their internal chat SRV might tell you. And cnames
Speaker 2: are like nicknames, mapping one name to another. But here's
Speaker 2: the kicker. If Acmecorp has a misconfigured DNS server, oh,
Speaker 2: it might allow something called a DNS zone.
Speaker 1: Transfer zone transfer. What's that?
Speaker 2: Normally DNA servers keep their full list of internal names
Speaker 2: and addresses pretty secret. But a misconfigured one you can
Speaker 2: trick it into dumping its entire internal aggress book the
Speaker 2: whole network map to you, the attacker.
Speaker 1: WHOA that sounds bad, like finding the entire internal phone
Speaker 1: directory for.
Speaker 2: A company HQ Exactly like that, a potentially colossal leak
Speaker 2: gives you a map of their whole internal network structure.
Speaker 1: Okay, And I've heard people mention Google dorking. Is that
Speaker 1: part of this tech recon Oh?
Speaker 2: Absolutely? Google dorking is basically using advanced search operators in
Speaker 2: Google to find things that aren't supposed to be public.
Speaker 2: Like what like using say cite dot axmecorp, dot com
Speaker 2: entitled dot index dot f that might find web directories
Speaker 2: and admin forgot to secure okay, or maybe entitled dot
Speaker 2: index dot of uploads that could find directories where users
Speaker 2: upload files, potentially a place an attacker could drop malicious
Speaker 2: code or find sensitive stuff someone uploaded by mistake.
Speaker 1: Wow, I've bet pentesters find some embarrassing.
Speaker 2: Stuff that way you can only imagine. So, yeah, Google
Speaker 2: can be an unwitting helper here, No Google helps.
Speaker 1: What about tools built specifically for mapping devices online, more
Speaker 1: specialized stuff.
Speaker 2: Yeah, now you're talking about search engines like showd in and.
Speaker 1: Senses Showdan heard of that one.
Speaker 2: Showdan's often called the search engine for Internet connected devices,
Speaker 2: not websites, but devices.
Speaker 1: What's the difference really?
Speaker 2: It reviews stuff like open ports, the services running on
Speaker 2: those ports, device locations, banner data for specific ips or keywords.
Speaker 1: Banner dat.
Speaker 2: Yeah, like the welcome message a service gives out often
Speaker 2: includes the exact software name and version. Super useful for
Speaker 2: finding known vulnerabilities.
Speaker 1: So searching showdan for like FTP could show all of
Speaker 1: acme's exposed FTP servers.
Speaker 2: Exactly and maybe tell you they're running an old vulnerable version.
Speaker 2: Showdan excels at mapping that Internet facing attack surface. It
Speaker 2: shows what services are listening, what software they're running. Okay,
Speaker 2: and sen Census is similar from the folks behind zMap.
Speaker 2: It maintains huge data sets on IPv four addresses, websites, certificates.
Speaker 2: These tools let pen testers and importantly defenders too see
Speaker 2: their own footprint from an attacker's view, what's actually exposed?
Speaker 1: Fascinating the search engine for devices, and it's not just
Speaker 1: about what's obviously visible, is it? What about hidden data
Speaker 1: like inside files?
Speaker 2: Ah? Good point, you're hitting on metadata analysis metadata. Even
Speaker 2: seemingly harmless files, you know, PDFs, jpg images, word docs.
Speaker 2: They can contain hidden info metadata like what kind of info,
Speaker 2: things like the version of Photoshop used to make an image,
Speaker 2: the operating system it was created on, maybe the author's name,
Speaker 2: creation dates.
Speaker 1: Seriously, Yeah, in a picture file?
Speaker 2: Oh yeah. Analyzing this with tools like x off tool
Speaker 2: or even just the basic strings command can give clues,
Speaker 2: maybe hints about client side software they use, which could
Speaker 2: have vulnerabilities, or it could help make a phishing email
Speaker 2: more convincing. Wow, it really makes you think, doesn't it.
Speaker 2: How often do we share files without realizing what hidden
Speaker 2: info is tagging along?
Speaker 1: Yeah?
Speaker 2: Really, imagine a competitor or worse, building this detail profile
Speaker 2: of acme's whole tech setup, even down to software versions
Speaker 2: their designers use, just from public files. That's the power
Speaker 2: of good recon.
Speaker 1: Okay, so you've done your recon. You've built this detailed
Speaker 1: map of Acmecorp. The next logical step for a pintester
Speaker 1: that's getting initial access.
Speaker 2: Right right, finding a weak spot, and actually getting inside
Speaker 2: the network perimeter.
Speaker 1: How does that usually happen?
Speaker 2: Well, exploitation, gaining access. It can take different forms. You
Speaker 2: can attack servers directly, but honestly, servers are getting much
Speaker 2: better defended.
Speaker 1: These days, so attackers look elsewhere.
Speaker 2: They often do. The big shift isn't just what they target,
Speaker 2: but who. With servers hardened, the human element, the user
Speaker 2: often becomes the weakest link ah the user, So client
Speaker 2: side exploits targeting the users themselves through things like phishing
Speaker 2: or malicious websites are really common.
Speaker 1: Makes sense. And once you're in what then?
Speaker 2: While usually you have basic access first, so the next
Speaker 2: step is often privilege.
Speaker 1: Escalation, escalation going higher up.
Speaker 2: Exactly, move from that basic, low level user access to
Speaker 2: something more powerful, like becoming an administrator or gaining system
Speaker 2: level control that lets you access more data, control more systems.
Speaker 1: Okay, got it. And I've heard this phrase for after
Speaker 1: you get in, or maybe to help stay in living
Speaker 1: off the land. It sounds like something from a survival show.
Speaker 2: Huh, yeah, it doesn't, bit, but it's a really critical
Speaker 2: skill in modern pen testing. Especially inside Windows networks.
Speaker 1: So what is it really in the cyber context?
Speaker 2: Living off the land means using tools and programs that
Speaker 2: are already on the system, trusted built in applications and binaries,
Speaker 2: but you use them to do things they weren't necessarily
Speaker 2: designed for malicious things.
Speaker 1: Usually, why do that? Why not just bring in your
Speaker 1: own hacking tools?
Speaker 2: Ah? Because the whole point is evasion, blending in, blending
Speaker 2: in defensive tools like Windows Defender, AppLocker, other endpoint security.
Speaker 2: They're looking for known bad files, known malicious executables. If
Speaker 2: you bring in custom malware, it might get flagged immediately, right,
Speaker 2: But if you use the system's own tools, tools that
Speaker 2: are supposed to be there, often signed by Microsoft, they're
Speaker 2: much less likely to raise alarms. You're using the system
Speaker 2: against itself, So.
Speaker 1: You're turning trusted tools into weapons. Basically, m could you preconxample?
Speaker 2: Sure? Take searchitil dot ex in Windows search it til
Speaker 2: for certificates exactly. Its legitimate job is managing digital certificates.
Speaker 2: But guess what it can also be used to download
Speaker 2: files from the Internet.
Speaker 1: No way?
Speaker 2: Yeah? And because searchitol dot etc. Is a standard Microsoft
Speaker 2: signed program, security software often trusts it it might let
Speaker 2: it download a malicious file without blinking an.
Speaker 1: Eye, whereas if you try to use something obvious like
Speaker 1: reigate or a PowerShell download.
Speaker 2: Command exactly, those might get blocked instantly, especially by things
Speaker 2: like Powershells constrained language mode, which really limits what scripts
Speaker 2: can do. If it's enabled. Curtitil often flies under the radar.
Speaker 1: So a harmless certificate tool becomes a stealthy downloader. That's clever.
Speaker 1: But how to defend even spot that if you're using
Speaker 1: legitimate tools.
Speaker 2: That is the million dollar question for defenders, and it's
Speaker 2: why this technique is so powerful. This blending in is
Speaker 2: the whole goal. It's a key part of what miter
Speaker 2: ATD and CK calls the defense evasion tactic tie zero
Speaker 2: zero zero five. I think, Okay, the better you are
Speaker 2: at living off the land, the quieter you are, the
Speaker 2: less likely you get caught. You make your malicious actions
Speaker 2: look like normal system activity, even against advanced defenses, even
Speaker 2: against things like Windows Defenders AMSI, the Anti Malware Scan
Speaker 2: Interface AMSI. Yeah, it's pretty clever. It hooks into scripting
Speaker 2: engines like PowerShell and tries to inspect commands before they run,
Speaker 2: looking for a malicious patterns, but.
Speaker 1: It can be bypassed.
Speaker 2: It can, especially once an attacker has local access. They
Speaker 2: can use techniques like obfuscation, deliberately scrambling or hiding parts
Speaker 2: of their malicious scripts to confuse AMSI make it harder
Speaker 2: for it to see the malicious intent.
Speaker 1: So even AMSI isn't fool proof if someone's already inside
Speaker 1: and knows what they're doing.
Speaker 2: Nothing ever completely fool proof, but yeah, obfuscation can be
Speaker 2: effective against it.
Speaker 1: This really highlights that the threat isn't always some exotic
Speaker 1: new malware. Sometimes it's just the clever misuse of everyday
Speaker 1: tools already on your machine.
Speaker 2: Precisely, it's like being a digital chameleon, using what's there
Speaker 2: to achieve your goals without standing out.
Speaker 1: For defenders, then it's not just about what tools are running,
Speaker 1: but how and why they're being run, looking for abnormal
Speaker 1: use of normal tools exactly.
Speaker 2: Context is everything.
Speaker 1: Okay, So let's say our pentester is inside acbecores network.
Speaker 1: They got initial access, maybe using searchole to download something,
Speaker 1: and they're living off the land blending in.
Speaker 2: What's next Now they want to expand their reach, move around,
Speaker 2: find more valuable targets. That's lateral movement.
Speaker 1: Going sideways through the network right.
Speaker 2: And to do that effectively, you need really good situational
Speaker 2: awareness inside the network, well kind of awareness. You need
Speaker 2: to gather tons of local info. What processes are running
Speaker 2: on this machine, what software is installed, what are the
Speaker 2: detailed network settings? Who else is logged in? What groups
Speaker 2: does this user belong to? System configuration details?
Speaker 1: Okay, mapping the immediate surrounding exactly.
Speaker 2: You're looking for opportunities, maybe cached credentials left behind by
Speaker 2: an admin, misconfigurations that let you jump to another server,
Speaker 2: shared folders.
Speaker 1: And you mentioned not relying on a single tool crucial.
Speaker 2: Because you never know what tools will be available or
Speaker 2: allowed on the specific machine you land on. You need
Speaker 2: to be adaptable, no different ways to get the same information,
Speaker 2: using built in commands or whatever tools are present. Resourcefulness
Speaker 2: is key, got it?
Speaker 1: And are there tools that help map out the whole
Speaker 1: internal network, especially complex ones? I heard you mentioned something
Speaker 1: that visualizes attack paths. That sounds like a superpower.
Speaker 2: Ah? Yeah, absolutely for mapping complex active directory environments, which
Speaker 2: you find in most large organizations like our acmecorp. A
Speaker 2: standout tool is sharpound. Sharpound, which is actually the data
Speaker 2: collector component of the larger Bloodhound project.
Speaker 1: Sharpound and Bloodhound the sound like a cybersecurity detective agency.
Speaker 1: How do they work together?
Speaker 2: Huh yeah, you can think of it like that. Shartpound
Speaker 2: is the field agent, the data gatherer. It used to
Speaker 2: be a mainly PowerShell, but now it's often a sea shard, executable, faster,
Speaker 2: sometimes stealthier. It goes out and queries active directory and
Speaker 2: the computers in the domain.
Speaker 1: What data does it collect?
Speaker 2: Things like user accounts, group memberships, who's logged in, where,
Speaker 2: active sessions, computer configurations, access control lists acls, who has
Speaker 2: permission to what? Group? Policy objects? GPO's tons of relationship data.
Speaker 1: Okay, so Chartpound gathers all that raw relationship data.
Speaker 2: Then what then that data is fed into Bloodhound. Bloodhound
Speaker 2: uses a graph database in neofour j usually to store
Speaker 2: all those relationships, and crucially, it provides a graphical interface
Speaker 2: to visualize it all.
Speaker 1: Visualize it like a map.
Speaker 2: Ex exactly like a map, but a map of relationships
Speaker 2: and permissions within the active directory for us.
Speaker 1: And why is that so powerful?
Speaker 2: Because it lets pentest and defenders see attack paths they'd
Speaker 2: likely never find otherwise. Bloodhound is famous for identifying the
Speaker 2: shortest paths to domain.
Speaker 1: Admit, shortest path to domain admin. That's like keys to
Speaker 1: the kingdom, right pretty much?
Speaker 2: Yeah, full control over the entire Windows domain. Bloodhound shows
Speaker 2: you how seemingly minor connections or permissions can be chained
Speaker 2: together together. Like it might show you that this random
Speaker 2: low privileged user account you compromised happens to have an
Speaker 2: active login session on a server. Okay, and maybe a
Speaker 2: domain admin logged into that same server recently, maybe leaving
Speaker 2: credentials cased in memory, or maybe that server has a
Speaker 2: certain vulnerability. Bloodhound connects those dots. It shows you that
Speaker 2: path user as server x, domain admin credential nash game over.
Speaker 1: Wow, that visual connection makes all the difference. It's not
Speaker 1: just lists of users and groups, it's the pathways between them.
Speaker 2: Precisely. It turns abstract permissions into concrete attack roots.
Speaker 1: So from a defender's viewpoint, seeing those ads must completely
Speaker 1: change how they prioritize security efforts.
Speaker 2: Right absolutely. It's a game changer for defenders too. Instead
Speaker 2: of just patching random vulnerabilities, Bloodhound shows you the relationship vulnerabilities.
Speaker 1: Relationship vulnerabilities.
Speaker 2: I like that it highlights the critical choke points, which users,
Speaker 2: if compromised, give attackers easy routes, Which systems are stepping
Speaker 2: stones to sensitive areas. It lets defenders focus hardening efforts
Speaker 2: on breaking those specific paths, maybe tightening permissions on a
Speaker 2: key group, removing local admin rights, segmenting networks better.
Speaker 1: So it guides defensive strategy based on actual attack paths,
Speaker 1: not just generic best practices.
Speaker 2: Exactly. It helps you prioritize based on real risk revealed
Speaker 2: by those connections, group membership sessions, acls, GPOs, all the
Speaker 2: data Sharpound collects.
Speaker 1: That's incredible. It really is like having a dynamic GPS
Speaker 1: for the entire corporate network, showing all the hidden roads
Speaker 1: and shortcuts right to the crown jewels.
Speaker 2: It's a fantastic example of how critical thinking, data collection,
Speaker 2: and visualization come together in cybersecurity. It makes complex relationships
Speaker 2: tangible and actionable in a way that scrolling through logs
Speaker 2: just can't.
Speaker 1: Okay, wow, we've covered a lot today. We journeyed through
Speaker 1: these crucial phases of a pen test, starting with that
Speaker 1: detailed reconnaissance, turning those scattered digital breadcrumbs bat Ecnicorp into.
Speaker 2: A full blueprint, right building the map.
Speaker 1: Then gaining initial access, maybe using those clever evasion tactics
Speaker 1: like living off the land to stay hidden.
Speaker 2: Blending in using their own tools against them.
Speaker 1: And finally charting the internal network, finding those critical attack paths,
Speaker 1: maybe using powerful tools like Sharpound and bloodhound and see
Speaker 1: the hidden connections.
Speaker 2: Yeah, we've really seen how these ethical hackers meticulously transform
Speaker 2: all these disparate bits of information into a strategic map,
Speaker 2: not just to break in, but ultimately to help secure
Speaker 2: these digital environments, make them stronger.
Speaker 1: Yeah, that's the key point, isn't it. The ultimate goal
Speaker 1: of a penetration test isn't just finding flaws. It's about
Speaker 1: providing that critical intelligence needed to build tougher, more resilient defenses.
Speaker 2: Exactly. It's proactive security.
Speaker 1: So maybe final thought for everyone listening, what hidden connections,
Speaker 1: what overlooked details might be lurking in your digital environment
Speaker 1: right now, just waiting to be discovered.
Speaker 2: Mm hmm. Makes you think?
Speaker 1: It's a powerful reminder. I think that real security isn't
Speaker 1: just about building higher walls around the perimeter. It's also
Speaker 1: about understanding all the pathways, the obvious ones and especially
Speaker 1: the hidden ones that could potentially lead an adversary right
Speaker 1: to your front door, or maybe even inside already