Brutalist is a cross-platform Python3+ based command line tool that can be used to generate very large word dictionaries based on minimal input. It can take a single word like “password” and generate up to 13,198,680 combinations using common special character substitutions and suffixes, and up to all possible 3-digit numerical suffixes with all variations of special characters appended. It is a highly-specialized tool, which should be a regular go-to in the tool belt of all red teamers and pentesters.Read More
This was obviously somewhat of an edge case, but I’m sure it will apply to many other users out there, and I hope it finds them well. This was one particular case where the Arch Wiki was a little shady and left me figuring out a lot of stuff on my own — as is the case for any Arch user — which is one of the reasons we punish ourselves by using it in the first place. That being said, this method should work with minimal tweaks for just about any OS, because the main things being modified here are the underlying disk formats, partitions, kernel, and bootloader. Everything else is left untouched.Read More
This may sound like a boring article to many, but it is a basic overview of some very important information that is crucial to include in the repertoire of knowledge for all IT and security professionals.
In this article, we will be going over the high points for the following industry standards: PCI DSS, ISO 27001/27002, HIPAA, and the NIST/DoD frameworks, and adding some comments along the way on the relationships and effects that these policies and frameworks have on network architecture, as well as what possible implications they could have on architectural solutions. Most of the architectural solutions provided come from an Amazon Web Services perspective, but the same basic principles apply, regardless of which cloud service provider (CSP) you use, or even if your infrastructure is hosted on-premises.Read More
With the new wave of ransomware attacks we have seen at the beginning of this week, especially targeted toward Spain, we can see that mostly Windows attack vectors are mostly being utilized, in what appears to be a variant of the Bitpaymer family, related to the Dridex group of malware.
But what does the future hold for attacks such as these? When will we see the attack vector change drastically to target something that your company is most-likely unprepared for? We are seeing bad actors targeting low-hanging fruit on Windows, while the world of end-users are going mobile. If iOS development is part of your enterprise, then whether you like it or not, MacOS literally has to be an integral part of your infrastructure…because XCode. Is it possible that this is something that has gone unnoticed in the threat detection landscape, or is the perception of the threat level just perceived to be so low that we haven’t yet come up with a good way to protect against it?Read More
I promised a follow-up review to This Mortal Coil for the sequel, This Cruel Design by Emily Suvada. I also promised to follow up on the technological themes posed by this series, and how in the very near future, we could easily see this work of fiction merge more into an account of fictional events based on non-fiction technology. Personally, I think this series to be slightly ahead of its time [in a good way], as to show readers what kind of scenarios could play out in our future. For readers who are not tech-savvy, this would probably be a 3-star read. For me, knowing about the underlying technology and just how realistic this book is, boosts that up to a 5-star read. Emily Suvada knocked it out of the park with this one, which was equally as good (if not better) than This Mortal Coil.Read More